mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2026-11-11 04:01:35 -10:00
47 lines
1.5 KiB
YAML
47 lines
1.5 KiB
YAML
id: ipmi-checks
|
|
|
|
info:
|
|
name: IPMI Checks
|
|
author: pdteam
|
|
severity: info
|
|
|
|
javascript:
|
|
- code: |
|
|
const ipmi = require('nuclei/ipmi');
|
|
const caps = ipmi.GetAuthCapabilities(Host, Port);
|
|
const root = ipmi.GetRAKPHash(Host, Port, 'root');
|
|
|
|
// cipher suite 0 lets a wrong password in
|
|
const anyPassword = new ipmi.Client();
|
|
const cipherZero = anyPassword.Login(Host, Port, 'ADMIN', 'wrong', 0);
|
|
anyPassword.Close();
|
|
|
|
// an encrypted, signed session, then Get Device ID and admin privilege
|
|
const client = new ipmi.Client();
|
|
client.Login(Host, Port, 'ADMIN', 'ADMIN', 3);
|
|
const device = client.Command(0x06, 0x01, []);
|
|
const admin = client.Command(0x06, 0x3b, [0x04]);
|
|
client.Close();
|
|
const manufacturer = device.Data[6] | device.Data[7] << 8 | device.Data[8] << 16;
|
|
|
|
let wrongRejected = false;
|
|
try { new ipmi.Client().Login(Host, Port, 'ADMIN', 'wrong', 3); } catch (e) { wrongRejected = true; }
|
|
|
|
ipmi.Ping(Host, Port) && caps.IPMI20 && caps.AnonymousLogin &&
|
|
ipmi.GetCipherSuites(Host, Port).includes(0) &&
|
|
ipmi.GetSystemGUID(Host, Port).length == 32 &&
|
|
ipmi.FindRAKPPassword(root, ['admin', 'calvin']) == 'calvin' &&
|
|
!ipmi.CheckRAKPPassword(root, 'admin') &&
|
|
cipherZero && wrongRejected &&
|
|
device.CompletionCode == 0 && manufacturer == 4753 &&
|
|
admin.CompletionCode == 0;
|
|
|
|
args:
|
|
Host: "{{Host}}"
|
|
Port: "623"
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- "success == true"
|