Skip to main content
Default Port: 623/UDP (occasionally also TCP) IPMI is the protocol behind out-of-band server management, the Baseboard Management Controller (BMC) it talks to runs independently of the host OS, which means it’s reachable (and attackable) even when the server itself is powered off or completely locked down. Dell iDRAC, HP iLO, and Supermicro IPMI are all the same protocol underneath, and all three show up constantly with weak or default credentials in real environments.

Cipher Zero Bypass

A flaw in IPMI 2.0’s authentication negotiation lets an attacker skip authentication entirely on vulnerable firmware, no credentials needed at all.

RAKP Hash Disclosure

IPMI 2.0’s authentication handshake leaks a password hash to anyone who asks, before authentication even succeeds, making offline cracking possible without any valid credentials first.
A BMC is management hardware, not a general-purpose server. If you get in, you’re not just reading data, you have chassis power control, remote console/KVM access, and often virtual media mounting, enough to fully compromise the physical host.

​
Recon

Running every IPMI-related NSE script at once covers version detection, the cipher zero check, and brute-forcing in a single pass:

​
Cipher Zero Authentication Bypass

A positive result here means full administrative access with no credentials at all. Treat it as a critical finding and stop to assess impact before going further.
IPMI 2.0 supports a “cipher type 0” authentication mode that, on vulnerable firmware, accepts a session with no real authentication check at all.
If vulnerable, ipmitool can connect directly using cipher 0, blank credentials included:
On vulnerable firmware, cipher zero doesn’t just allow read access, it allows writes too, including resetting user passwords outright. Confirm scope before testing beyond a read-only command like chassis status.

​
RAKP Hash Disclosure and Cracking

Even without the cipher zero flaw, IPMI 2.0’s RAKP authentication handshake discloses a password hash to any client that requests one, before the password itself is ever verified. No valid credentials are needed to pull the hash.
A dictionary attack is worth trying before the brute-force mask above, it’s far faster when the password isn’t fully random:

​
Default Credentials

BMC firmware ships with vendor-specific defaults far more often than general-purpose server software does, these are worth testing before any cracking attempt.
HP iLO’s randomized default isn’t guessable, but it’s frequently left unrotated from whatever shipped on the physical hardware, worth checking asset labels or documentation if you have physical or procurement access during an engagement.

​
Interacting via ipmitool

Once you have valid credentials (or a cipher zero bypass), ipmitool is the standard way to actually interact with the BMC.
ipmitool can also control the physical machine directly, chassis power off, chassis power reset, and similar commands take real, immediate effect on the hardware. Never run power or reset commands outside of an explicitly approved maintenance window.

​
Quick Reference Tools

HackTricks: IPMI

Deeper breakdown of IPMI enumeration and exploitation techniques.
IPMI grants control over physical hardware, not just data. Power, reset, and credential-reset actions have real-world consequences, confirm scope before going beyond passive enumeration.