Nmap NSE Category vulns Script：ipmi-cipher-zero 偵測IPMI 2.0 密碼零認證繞過掃描器的漏洞

已更新：8月26日

指令類型：portrule
類別：vuln, safe
下載：https://svn.nmap.org/nmap/scripts/ipmi-cipher-zero.nse

Nmap Script指令摘要

IPMI 2.0 密碼零認證繞過掃描器。此模塊識別兼容 IPMI 2.0 的系統，這些系統容易通過使用密碼零來繞過認證漏洞。

Nmap Script指令參數

vulns.short, vulns.showall

請參閱 vulns 函式庫的文檔。

Nmap Script指令範例

nmap -sU --script ipmi-cipher-zero -p 623 <host>

Nmap Script指令輸出

PORT      STATE         SERVICE REASON
623/udp open|filtered unknown no-response
| ipmi-cipher-zero:
|   VULNERABLE:
|   IPMI 2.0 RAKP Cipher Zero Authentication Bypass
|     State: VULNERABLE
|     Risk factor: High
|     Description:
|
|       The issue is due to the vendor shipping their devices with the
|       cipher suite '0' (aka 'cipher zero') enabled. This allows a
|       remote attacker to authenticate to the IPMI interface using
|       an arbitrary password. The only information required is a valid
|       account, but most vendors ship with a default 'admin' account.
|       This would allow an attacker to have full control over the IPMI
|       functionality.
|
|     References:
|       http://fish2.com/ipmi/cipherzero.html
|_      https://www.us-cert.gov/ncas/alerts/TA13-207A