Anoymask

Posted on Jul 29

IPMI/BMC Authentication Hash Leak: Stealing Out-of-Band Server Management via Offline Cracking

#security #threatintel

IPMI/BMC Authentication Hash Leak: Stealing Out-of-Band Server Management via Offline Cracking

1. Basic Information

Article Title: Over 24,000 exposed server BMCs leak password hash via decades-old flaw
Publisher: BleepingComputer
Publication Date: July 28, 2026
Original Source: https://www.bleepingcomputer.com/news/security/over-24-000-exposed-server-bmcs-leak-password-hash-via-decades-old-flaw/
Related Sources: Lava research (linked in original), CVE-2013-4786
Related Entities: CVE-2013-4786, IPMI 2.0, BMC, Supermicro, HPE iLO 4, UDP/623, GPU/AI servers
Severity: High

2. Executive Summary

Attackers can send an authentication request to exposed IPMI/BMC interfaces on the internet and receive a password-derived response. They can crack this response offline using GPUs to gain server management privileges that sit below the operating system. A recent scan found 24,650 devices leaking authentication material, with 2,340 using weak, dictionary-based administrator passwords.

3. Attack Flow

Scan the internet for IPMI 2.0 services on UDP/623.
Start an RMCP+/RAKP authentication handshake with the BMC.
Obtain the password-derived authentication response without credentials.
Perform offline cracking using dictionaries, default ADMIN users, and vendor-generated password rules.
Log in to the BMC using the recovered password.
Control power, virtual media, firmware, and low-level settings.
Reuse the same credentials on other management interfaces.
Inference: Use virtual media or boot settings to compromise the OS, establish persistence, and move laterally across the management network.

4. Attacker Position and Execution Location

Attackers connect to UDP/623 from the internet or a reachable management network.
Hash cracking happens on the attacker's GPU/CPU, avoiding failed login alerts on the target system.
Post-compromise actions run on the BMC processor, which is independent of the OS.

5. Visibility for Victims and Administrators

The OS, EDR, and host logs may not show the theft of authentication material or BMC operations.
BMC audit logs may retain records of the authentication handshake, logins, and power/virtual media/setting changes.
Network logs may show UDP/623 scanning and post-compromise HTTPS/management traffic.
Users may notice sudden reboots, shutdowns, changed boot images, or service disruptions.

6. Success and Failure Conditions

Success Conditions

IPMI 2.0/BMC is reachable from the attacker.
The device responds to CVE-2013-4786.
The administrator password is weak, default, or guessable via generation rules.
The same credentials are reused across multiple devices.

Failure Conditions

BMC is completely isolated from the internet.
Source traffic is restricted using VPNs, jump hosts, or management ACLs.
Passwords are long, random, and unique for every device.
Unnecessary IPMI 2.0/UDP/623 services are disabled.
BMC logs are forwarded externally to monitor for suspicious actions.

7. What Happens on Success

Attackers can stop the OS, reboot the system, connect virtual media, update firmware, and change low-level settings. This can lead to post-OS-rebuild persistence, disruption or exposure of multi-tenant GPU workloads, and lateral movement to the same management plane.

8. Observable Logs

Email

None.

Proxy / SWG / DNS

Traffic to unknown destinations if the BMC is configured to reach the internet via HTTP(S).
Usually bypasses proxies, resulting in low visibility.

Endpoint / EDR

Activity on the BMC is generally invisible.
After success, the OS may show unexpected reboots, virtual media usage, new drivers, or boot changes.

Identity / IdP

Logins to local BMC accounts.
Unknown source authentication when using LDAP/AD integration.
Sequential use of the same administrator ID across multiple BMCs.

SaaS / Cloud

Abnormal operations on bare-metal or GPU cloud management planes.
Inference: If BMC credentials are saved in external secrets managers, those access logs must also be audited.

Network

Scans or handshakes from the internet to UDP/623.
New traffic sources to the BMC segment.
Abnormal HTTPS logins and virtual media transfers.

9. Attack Success Determination

Contact Only: UDP/623 scanning, RAKP response retrieved.
User Action: None.
Initial Execution: Offline cracking is difficult to detect directly on the target.
Malware or Successful Auth: Successful BMC login, session established.
Data Theft / Session Compromise: Retrieval of configuration/hardware info, use of virtual media.
Subsequent Compromise: Power operations, firmware/boot changes, OS compromise, lateral movement to other BMCs.

10. Investigation Playbook

Trigger

Externally exposed UDP/623, a surge in BMC handshakes, logins from unknown IPs, or unexpected power/virtual media operations.

Initial Verification

Inventory all BMCs for external reachability, product type, generation, and IPMI settings.
Preserve BMC audit logs and network flows.
Check if administrator passwords rely on defaults, reuse, or predictable generation rules.

Endpoints

Check OS boot history, reboots, virtual media usage, and firmware status.
Compare vendor trusted images with BMC/BIOS settings.

Authentication & Cloud

Rotate local/integrated BMC accounts for every device.
Review access history for management secrets and automation jobs.

Subsequent Actions

Investigate the use of the same credentials on other BMCs, KVMs, switches, and management portals.
Check for OS re-compromise, bootkits, and firmware tampering.

Containment

Immediately block UDP/623 and management UIs from the internet.
Migrate to management VLANs, jump hosts, or source ACLs.
Re-flash suspected devices to a trusted BMC/BIOS state and re-evaluate the OS.

Determination Levels

Exposed / Handshake Captured / Password Recovered Suspected / BMC Login Confirmed / Management Action / Host or Fleet Compromise.

11. Defense and Detection Ideas

Single Events

External traffic to UDP/623.
Authentication requests with empty usernames.
BMC logins from unknown IPs.
Virtual media, firmware, or power operations.

Timeline Correlation

UDP/623 handshake → Delayed BMC login → Virtual media/power operations → OS boot changes

Threat Hunting Perspectives

Compare exposed BMCs from Shodan/ASM with the internal CMDB.
Identify weak patterns such as default ADMIN, reused passwords, or 10-character uppercase rules.
Look for unauthorized clients and lateral logins within the BMC segment.

Log Gaps

Without BMC logs, UDP NetFlow, power/virtual media audits, and firmware integrity checks, determining success is difficult.

12. Facts / Inference / Hypothesis

Facts

Out of 36,872 exposed IPMI devices, 24,650 leaked password-derived authentication material.
6,240 devices accepted empty usernames, and 2,340 used weak administrator passwords found in dictionaries.
The issue stems from CVE-2013-4786 and the IPMI 2.0 authentication design.
Ransom notes were observed on public HPE iLO 4 screens, though there is no evidence of widespread exploitation.

Inference

OS EDR alone cannot detect or eradicate management plane compromises.
Shared management passwords can scale a single BMC compromise to an entire rack or site.

Hypothesis

Combining RAKP response collection with subsequent management UI logins from the same source/ASN can detect post-cracking intrusions.
AI/GPU infrastructure has high sharing levels and value, meaning a single physical machine compromise could impact multiple organizations.

13. MITRE ATT&CK Mapping

T1046 Network Service Discovery — High confidence.
T1110.002 Password Cracking — High confidence.
T1078 Valid Accounts — High confidence when using recovered passwords.
T1133 External Remote Services — High confidence when using BMC management planes.
T1021 Remote Services — Medium confidence during management plane lateral movement.
T1542.001 Pre-OS Boot: System Firmware — Medium to low confidence, only when tampered with.
T1496.004 Compute Hijacking — Hypothesis, only when GPUs or other resources are abused.

14. Unknowns and Additional Investigation

Number of exposed hosts globally.
Actual number of credentials recovered and abused.
Vendor-specific and generation-specific log specifications and mitigations.
Entry vector for the HPE iLO 4 ransomware display.

15. Impact on SOCs and General Enterprises

Data centers, manufacturing, telecommunications, research institutions, and AI/GPU infrastructures often host large numbers of BMCs. Organizations must treat BMCs as independent assets and include them in ASM, authentication, network, and log monitoring scopes, rather than focusing solely on server OS vulnerability management.