Out-of-band management controls a server's hardware remotely and independently of its operating system, through a baseboard management controller (BMC): a small always-on computer on the motherboard with its own network interface, reachable whether or not the host OS is running. BMCs speak IPMI and the vendor stacks (Dell iDRAC, HPE iLO) and expose the Redfish REST API. The security is notoriously poor, and the impact is total: a BMC controls host power, the physical console (KVM), and virtual media (mounting an attacker ISO), so compromising it compromises the host itself, below and around any OS defense. The surface is IPMI's protocol flaws, pervasive default credentials, and vendor controller exploits.
nmap -sU -p623 --script ipmi-version,ipmi-cipher-zero <target> # IPMI/BMC on UDP 623
curl -sk https://<bmc>/redfish/v1/ # Redfish API
Subtopics#
- IPMI cipher 0 bypass: authentication-disabling cipher suite zero.
- IPMI RAKP hash disclosure: pre-auth password-hash retrieval.
- BMC default credentials: shipped admin credentials.
- iDRAC and iLO: Dell and HPE controller exploits and virtual media.
- Redfish API: abusing the modern BMC REST API.