{"id":1227,"date":"2025-02-01T17:53:26","date_gmt":"2025-02-01T17:53:26","guid":{"rendered":"https:\/\/trouble.org\/?p=1227"},"modified":"2025-02-10T18:39:51","modified_gmt":"2025-02-10T18:39:51","slug":"remotely-access-supermicro-firmware","status":"publish","type":"post","link":"https:\/\/trouble.org\/?p=1227","title":{"rendered":"Remotely Access Live Supermicro Firmware+"},"content":{"rendered":"

TLDR; a vendor supported\/supplied utility allows download of live BMC1<\/a><\/sup> firmware\/configuration on (at least) some SuperMicro BMCs. It’s hard to tell who might be affected, but the utility used was written by ATEN Technology, ASRock ASPEED, and others all seem to be connected in various ways in not only SuperMicro firmware but the rest of the BMC world, and it’s not clear to me what other vendors might have this feature (sic) as well (QEMU lists many vendors<\/a> using Aspeed BMCs that potentially could have something similar.)<\/p>\n

I’ve only tested this on a couple of systems – a Supermicro X11SSZ-QF and a Supermicro X10-based virtual BMC (this firmware<\/a> was run under QEMU (release notes claim to support their X10DRU-I+, X10DRT-P, X10DRG-H, X10DRW-I, X10DRI-T4+, X10DDW-I, X10DRFR, X10DRI-T, X10DRFF, X10DRFR-T, X10DRD, X10DRD-L motherboards.)<\/b><\/i> That said, I’d say evidence strongly suggests this extends to other versions, as nearly identical strings2<\/a><\/sup> are hardcoded in \/lib\/libipmi.so<\/tt> that show the dd<\/tt> command dumping firmware to the same location. This is at least true for Supermicro servers in their X10, X11, X12, and X13 families; it’s been around for some time and presumably still is. Feel free to send me intel on test results of other systems, and update as appropriate.<\/p>\n

The downloaded firmware includes the base OS, web pages\/programs, BMC configuration, most files, and the kernel. Yes, you can change the firmware remotely by any number of methods, but here an attacker can see exactly what is going on on the BMC. Compromising the BMC becomes much easier if you can observe what the exact system is doing. Consider: would you want a potential attacker to be able to see your server\/app configurations, password files, SSH keys, etcetera? It’s a dangerous thing, even if it’s not a bug but a feature. But hey, they didn’t ask me. <\/p>\n

I think it’s especially interesting because it’s not simply being able to get the firmware of a BMC server, but it does so via valid IPMI by leveraging the OEM commands (the specification details how vendors can extend the protocol to allow vendor-specific commands\/functionality3<\/a><\/sup>.) In the past I’ve heard rumors of various features from BMC vendors, such as capturing and freezing RAM, generating SMIs, etc., but these are all hidden from public view… how much do you trust your server vendor?) Ironically I’d actually seen this utility many years ago, but could never get it to work, apparently because I didn’t have the right hardware.<\/p>\n

Details<\/h4>\n
\n

ATEN Technology has a freely downloadable tool – AlUpdate<\/tt>4<\/a><\/sup> that can do a variety of operations to a local or remote BMCs; here’s what I used in tests –<\/p>\n

$ <\/span>.\/<\/span>AlUpdate -h<\/span> 192.168.0.24 -u<\/span> ADMIN -p<\/span> ADMIN -i<\/span> lan -r<\/span> y -d<\/span> over-lan.img<\/div><\/div>\n

Under the hood (each item representing packet(s) sent\/received) it has 4 stages –<\/p>\n

    \n
  1. authenticate to BMC and set communication parameters<\/li>\n
  2. get ready to send<\/li>\n
  3. send a I’m-ready-when-you-are-command<\/li>\n
  4. let me have it!<\/li>\n<\/ol>\n

    The first step is the setup request via a RMCP+ Open Session request via UDP on port 623, the standard IPMI port. I only mentioned it because while it could request any of a number encryption and data integrity algorithms, they instead shut off data integrity and confidentiality by using the 0x00 algorithms for both, meaning that all of this all sent in the clear with no protection.<\/p>\n\n\n\n\n\n
    Authentication Algorithm<\/td>\nRAKP-HMAC-SHA1<\/td>\n<\/tr>\n
    Integrity Algorithm(s)<\/td>\nNone<\/td>\n<\/tr>\n
    Confidentiality Algorithm(s)<\/td>\nNone<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

    After the connection is established, the AlUpdate<\/tt> tool sends three OEM IPMI commands in sequence –<\/p>\n