ipmi

Overview ¶

Package ipmi decodes IPMI (Intelligent Platform Management Interface) messages carried over RMCP (Remote Management Control Protocol) on UDP/623. Covers IPMI 1.5 (auth_type != 0x06) and IPMI 2.0 / RMCP+ (auth_type == 0x06) session headers, plus the inner IPMI message frame. Implements no cryptographic operations — all payloads that are encrypted are surfaced as opaque byte counts.

Operationally, IPMI is a **critical-severity datacenter BMC surface** — every server sold since 1998 includes an out-of-band management controller (iLO on HPE, iDRAC on Dell, IMM/XCC on Lenovo, ASMB on ASUS, BMC on Supermicro) that speaks IPMI over UDP/623. The BMC runs independently of the host OS, persists across reboots, and has full power-cycle, firmware-flash, and console-redirection access.

The wire format leaks:

• **Get Channel Auth Capabilities (NetFn 0x06, cmd 0x38)** — THE canonical pre-auth enumeration command. Every pentest script (ipmitool, metasploit auxiliary/scanner/ipmi/ipmi_version, ipmi-scan) sends this first. The response reveals: supported auth types (None / MD2 / MD5 / Password / OEM), whether IPMI 2.0 is available, and supported cipher suites. Auth type None = unauthenticated access, cipher suite 0 = no auth at all (CVE-2013-4786).

• **Cipher Suite 0 (CVE-2013-4786)** — IPMI 2.0 mandates cipher suite 0 be supported; suite 0 = RAKP-None authentication with no integrity and no confidentiality. Many BMCs accept commands via suite 0 without credentials. Dan Farmer's 2013 "Sold Down the River" paper catalogued this across major vendors; it was present in iDRAC, iLO, IMM, and Supermicro BMCs.

• **RAKP Message 2 (payload_type 0x13)** — during RMCP+ authentication, the BMC responds to the client's RAKP-1 with RAKP-2 which includes a HMAC-SHA1 hash computed over the session IDs + random nonces + username. This hash is offline-crackable with hashcat mode 7300 ("IPMI2 RAKP HMAC-SHA1"). Any unauthenticated client can trigger RAKP-2 and capture the hash.

• **Get Device ID (NetFn 0x06, cmd 0x01)** — firmware version fingerprint. The response reveals device ID, firmware revision, IPMI version, manufacturer ID (IANA PEN), and product ID. Canonical pre-exploit version check.

• **Default credentials** — iDRAC 6/7/8 ship root/calvin; iLO ships Administrator/<serial>; Supermicro ships ADMIN/ADMIN; many IMM/XCC ship USERID/PASSW0RD. Shodan finds tens of thousands of IPMI endpoints; ipmitool's default admin/admin succeeds on a startling fraction of unpatched BMCs.

Wrap-vs-native judgement:

Native. The RMCP specification (ASF 2.0) and IPMI specifications
(v1.5 IPMI-Spec-V1.5 / v2.0 IPMI-Spec-V2-Rev1.1) are publicly
available. The RMCP header is 4 bytes; the IPMI session wrappers
are 9 bytes (v1.5 without auth) / 13+16 bytes (v1.5 with auth) /
12 bytes (RMCP+). The inner IPMI message header is 6 bytes. No
crypto at the parse layer.

What this package covers:

• **RMCP header**: version (must be 0x06) + reserved + sequence + message class (0x07 = IPMI, 0x06 = ASF).

• **IPMI 1.5 session header**: auth_type (0x00=None, 0x01=MD2, 0x02=MD5, 0x04=Password, 0x05=OEM) + session_seq (4 LE) + session_id (4 LE) + optional auth_code (16 bytes when auth_type != 0) + message_length (1 byte).

• **IPMI 2.0 / RMCP+ session header**: auth_type=0x06 + payload_type byte (encrypted/authenticated bits + 6-bit type) + session_id (4 LE) + session_seq (4 LE) + payload_length (2 LE). payload_type values: 0x00=IPMI, 0x10=Open Session Request, 0x11=Open Session Response, 0x12=RAKP Message 1, 0x13=RAKP Message 2, 0x14=RAKP Message 3, 0x15=RAKP Message 4.

• **IPMI message**: rsAddr (target, 0x20=BMC) + netFn/rsLUN (upper 6 bits = netFn, lower 2 = rsLUN) + checksum1 + rqAddr (source) + rqSeq/rqLUN + command + data[...] + checksum2.

• **NetFn + command name table**: NetFn 0x06 App (Get Device ID, Get Channel Auth Capabilities, Get Session Challenge, Activate Session, Close Session, Get Channel Cipher Suites, Get System GUID); NetFn 0x0A Storage (Get SEL Info); NetFn 0x0C Transport; NetFn 0x2C Group Extension.

• **Security classification**: is_auth_probe (Get Channel Auth Capabilities — THE recon command), is_version_probe (Get Device ID), is_rakp_exchange (RAKP Message 1-4), is_cipher_suite_zero (CVE-2013-4786 no-auth path).

What this package does NOT cover (deliberately out of scope):

• **Response parsing** — IPMI responses follow command-specific layouts; the decoder focuses on requests where the operator controls the input.
• **Payload decryption** — encrypted RMCP+ payloads (AES-CBC-128 or xRC4) are surfaced as byte counts only.
• **RAKP hash extraction** — RAKP-2 contains the HMAC-SHA1 offline-crackable material; the decoder surfaces the payload type name but does not extract the hash bytes.
• **ASF (Alert Standard Format, class 0x06)** — ASF Presence Ping / Pong on the same port; surfaced as class_name only.
• **Serial-over-LAN (SoL)** — payload type 0x01, complex framing.