{"id":712,"date":"2013-01-26T21:58:59","date_gmt":"2013-01-26T21:58:59","guid":{"rendered":"https:\/\/trouble.org\/?p=712"},"modified":"2013-07-17T15:11:22","modified_gmt":"2013-07-17T15:11:22","slug":"one-packet-auditing","status":"publish","type":"post","link":"https:\/\/trouble.org\/?p=712","title":{"rendered":"one packet auditing"},"content":{"rendered":"

Not all packets are equal.<\/p>\n

If you send a single UDP packet to port 623 that contains an “Get Channel Authentication Capabilities” (see secion 22.13 of the IPMI v2 spec), you’ll get back a packet that has some interesting features.<\/p>\n

You can get this by parsing the output of “ipmitool -v -v -H 10.0.0.1 -U user -P password lan print”, but more systems have python than ipmitool, so I wrote a python script to send the magic packet and parse the return. Data data everywhere, fun finding the information.<\/p>\n

The script takes a IP\/hosts as a single argument, will time out after 5 seconds if it doesn’t get a response. You really don’t want to see it come back with anonymous login enabled… interesting you can tell, per the spec, of problems w\/o any auth.<\/p>\n

1 packet, tens of bytes, 11 potential issues; best bang for the buck I’ve seen… perhaps ever.<\/p>\n

– what version of IPMI is supported, 1.5, 2.0,. or both
\n– “none” authentication is supported
\n– MD2 auth is allowed
\n– use of the straight password\/key auth supported
\n– OEM auth (maybe ok, maybe not)
\n– reserved auth bit in use
\n– KG key is set to default
\n– per message auth is disabled
\n– user level auth is disabled
\n– null usernames allowed
\n– anonymous login enabled and in use<\/p>\n

#!\/usr\/bin\/python<\/span>
\n
\n#<\/span>
\n# do an Get Channel Authentication Capabilities (see p142 of the IPMI v 2 spec)<\/span>
\n#<\/span>
\n# Usage: $0 ip-address<\/span>
\n#<\/span>
\n# Sends request, tears up response, does a little sanity checking, prints out some stuff<\/span>
\n#<\/span>
\n# Lots of comments are quotes from the most recent IPMI 2.0 spec.<\/span>
\n#<\/span>
\n
\nfrom<\/span> socket<\/span> import<\/span> *
\nimport<\/span> sys<\/span>
\n
\nBYTE_SIZE =<\/span> 8<\/span>
\n
\ntry<\/span>:
\ntarget =<\/span> sys<\/span>.argv<\/span>[<\/span>1<\/span>]<\/span>
\nexcept<\/span>:
\nprint<\/span>(<\/span>"usage: %s target"<\/span> % sys<\/span>.argv<\/span>[<\/span>0<\/span>]<\/span>)<\/span>
\nexit(<\/span>1<\/span>)<\/span>
\n
\n# in seconds<\/span>
\ntimeout =<\/span> 5<\/span>
\n# udp<\/span>
\nPORT =<\/span> 623<\/span>
\n
\n# assume not until proven otherwise<\/span>
\nipmi15_support =<\/span> 1<\/span>
\nipmi20_support =<\/span> 0<\/span>
\n
\n# get chan auth packet... snuffled from tcpdump & wireshark traffic<\/span>
\npayload =<\/span> "\\x<\/span>06\\x<\/span>00\\x<\/span>ff\\x<\/span>07\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>00\\x<\/span>09\\x<\/span>20\\x<\/span>18\\x<\/span>c8\\x<\/span>81\\x<\/span>00\\x<\/span>38\\x<\/span>8e\\x<\/span>04\\x<\/span>b5"<\/span>
\n
\n#<\/span>
\n# helper function, just looks up a position in a string, which<\/span>
\n# is representing a byte of network data.<\/span>
\n#<\/span>
\n# The function returns the bit at position X; position 0 == least significant<\/span>
\n#<\/span>
\n# lots of assumptions! #1 is that byte is 8 bits, #2 is that the bits are in a certain order<\/span>
\n#<\/span>
\ndef<\/span> check_bit(<\/span>byte,<\/span> position)<\/span>:
\n
\nif<\/span> position ><\/span> BYTE_SIZE:
\nprint<\/span>(<\/span>"out-of-byte-bounds (%s)"<\/span> % position)<\/span>
\nreturn<\/span>(<\/span>-1<\/span>)<\/span>
\n
\n# print("\\t\\tchecking %s[%d]:" % (byte, position)),<\/span>
\nbyte =<\/span> bin(<\/span>byte)<\/span>[<\/span>2<\/span>:]<\/span>.rjust<\/span>(<\/span>8<\/span>,<\/span> '0'<\/span>)<\/span>[<\/span>::-1<\/span>]<\/span>
\n# print("\\tbits => " + byte),<\/span>
\n
\n#<\/span>
\n# make a string of bits that make up the bytes; flip byte<\/span>
\n# so bit[0] = LSD (least-sig-digit)<\/span>
\n#<\/span>
\n# print("\\tB:"),<\/span>
\n# print(byte)<\/span>
\n
\nif<\/span> byte[<\/span>position]<\/span> ==<\/span> "1"<\/span>:
\nreturn<\/span>(<\/span>1<\/span>)<\/span>
\n
\nreturn<\/span>(<\/span>0<\/span>)<\/span>
\n
\n#<\/span>
\n# all the action goes here... if get a response, rip it up,<\/span>
\n# compare it to the IPMI spec to see if it makes sense.<\/span>
\n#<\/span>
\ndef<\/span> parse_response(<\/span>source,<\/span> packet)<\/span>:
\n
\n# sum of problems found<\/span>
\nproblems =<\/span> 0<\/span>
\n
\n# did we get something that looks IPMI-esque?<\/span>
\nipmi_support =<\/span> ord<\/span>(<\/span>packet[<\/span>3<\/span>]<\/span>)<\/span>
\n
\nif<\/span> check_bit(<\/span>ipmi_support,<\/span> 0<\/span>)<\/span>:
\nipmi20_support =<\/span> 1<\/span>
\nif<\/span> check_bit(<\/span>ipmi_support,<\/span> 1<\/span>)<\/span>:
\nipmi15_support =<\/span> 1<\/span>
\n
\nif<\/span> not<\/span> ipmi20_support and<\/span> not<\/span> ipmi15_support:
\nprint<\/span>(<\/span>"this doesn't support 1.5 or 2.0 IPMI, bailin' out"<\/span>)<\/span>
\nexit(<\/span>2<\/span>)<\/span>
\n
\n#<\/span>
\n# Channel Number<\/span>
\n#<\/span>
\n# Channel number that the Authentication Capabilities is being<\/span>
\n# returned for. If the channel number in the request was set to<\/span>
\n# Eh, this will return the channel number for the channel that the<\/span>
\n# request was received on.<\/span>
\n#<\/span>
\nchannel =<\/span> ord<\/span>(<\/span>packet[<\/span>0<\/span>]<\/span>)<\/span>
\n
\nprint<\/span>(<\/span>"Channel %s:"<\/span> % channel)<\/span>,<\/span>
\n
\nprint<\/span>(<\/span>"IPMI "<\/span>)<\/span>,<\/span>
\nif<\/span> ipmi15_support:
\nprint<\/span>(<\/span>"1.5"<\/span>)<\/span>,<\/span>
\n
\nif<\/span> ipmi20_support:
\nprint<\/span>(<\/span>"2.0"<\/span>)<\/span>,<\/span>
\nprint<\/span>(<\/span>" supported"<\/span>)<\/span>
\n
\n#<\/span>
\n# Authentication Type Support<\/span>
\n#<\/span>
\n# Bit-by-bit breakdown of this byte<\/span>
\n
\n# [7] 1b = IPMI v2.0+ extended capabilities available.<\/span>
\n# 0b = IPMI v1.5 support only.<\/span>
\n#<\/span>
\n# [6] reserved<\/span>
\n#<\/span>
\n# [5] OEM proprietary (per OEM identified by the IANA OEM ID in the RMCP Ping Response)<\/span>
\n# [4] straight password \/ key<\/span>
\n# [3] reserved<\/span>
\n# [2] MD5<\/span>
\n# [1] MD2<\/span>
\n# [0] none<\/span>
\n#<\/span>
\nauth_support =<\/span> ord<\/span>(<\/span>packet[<\/span>1<\/span>]<\/span>)<\/span>
\n
\nif<\/span> check_bit(<\/span>auth_support,<\/span> 7<\/span>)<\/span>:
\n# print("\\tIPMI 2.0 extended data:")<\/span>
\nif<\/span> check_bit(<\/span>auth_support,<\/span> 0<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>No auth is supported"<\/span>)<\/span>
\nproblems +=<\/span> 1<\/span>
\nif<\/span> check_bit(<\/span>auth_support,<\/span> 1<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>MD2 auth supported"<\/span>)<\/span>
\nproblems +=<\/span> 1<\/span>
\nif<\/span> check_bit(<\/span>auth_support,<\/span> 2<\/span>)<\/span>:
\nprint<\/span>(<\/span>"\\t<\/span>MD5 auth supported"<\/span>)<\/span>
\nif<\/span> check_bit(<\/span>auth_support,<\/span> 4<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>straight password\/key auth supported"<\/span>)<\/span>
\nproblems +=<\/span> 1<\/span>
\nif<\/span> check_bit(<\/span>auth_support,<\/span> 5<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>OEM auth supported (maybe it's ok, maybe not)"<\/span>)<\/span> # maybe good, maybe not<\/span>
\nproblems +=<\/span> 1<\/span>
\nif<\/span> check_bit(<\/span>auth_support,<\/span> 6<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>Using funky reserved bit, maybe trouble?"<\/span>)<\/span>
\n
\n#<\/span>
\n# next thingee... this byte is a bit overloaded, so<\/span>
\n# it has a few things here.<\/span>
\n#<\/span>
\n# Bit-by-bit breakdown from spec:<\/span>
\n#<\/span>
\n# [7:6] - reserved<\/span>
\n# [5] - KG status (two-key login status). Applies to v2.0\/RMCP+ RAKP Authentication only. Otherwise, ignore as "reserved".<\/span>
\n#<\/span>
\n# 0b = KG is set to default (all zeros). User key KUID will be used in place of KG in RAKP<\/span>
\n# 1b = KG is set to non-zero value. (Knowledge of both KG and user password (if not anonymous login) required for activating session.)<\/span>
\n#<\/span>
\n# Following bits apply to IPMI v1.5 and v2.0:<\/span>
\n#<\/span>
\n# [4] - Per-message Authentication status<\/span>
\n# 0b = Per-message Authentication is enabled<\/span>
\n# 1b = Per-message Authentication is disabled<\/span>
\n#<\/span>
\n# [3] - User Level Authentication status<\/span>
\n# 0b = User Level Authentication is enabled<\/span>
\n# 1b = User Level Authentication is disabled<\/span>
\n#<\/span>
\n# [2:0] - Anonymous Login status<\/span>
\n#<\/span>
\n# [2] 1b = Non-null usernames enabled. (One or more users are enabled that have non-null usernames).<\/span>
\n#<\/span>
\n# [1] 1b = Null usernames enabled (One or more users that have a null username, but non-null password, are presently enabled)<\/span>
\n#<\/span>
\n# [0] 1b = Anonymous Login enabled (A user that has a null username and null password is presently enabled)<\/span>
\n#<\/span>
\nauth_stuff =<\/span> ord<\/span>(<\/span>packet[<\/span>2<\/span>]<\/span>)<\/span>
\n
\n#<\/span>
\n# if !IPMI 2.0\/RMCP+ RAKP ignore<\/span>
\n#<\/span>
\nif<\/span> ipmi20_support:
\nif<\/span> check_bit(<\/span>auth_stuff,<\/span> 5<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>KG key is set to default (all 0's)"<\/span>)<\/span>
\nproblems +=<\/span> 1<\/span>
\nelse<\/span>:
\nprint<\/span>(<\/span>"\\t<\/span>KG key has been set to a non-zero value"<\/span>)<\/span>
\n
\n# both 1.5\/2.0<\/span>
\nif<\/span> check_bit(<\/span>auth_stuff,<\/span> 4<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>Per message auth is disabled"<\/span>)<\/span>
\nproblems +=<\/span> 1<\/span>
\nelse<\/span>:
\nprint<\/span>(<\/span>"\\t<\/span>Per message auth is enabled"<\/span>)<\/span>
\n
\nif<\/span> check_bit(<\/span>auth_stuff,<\/span> 3<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>User lvl auth is disabled"<\/span>)<\/span>
\nproblems +=<\/span> 1<\/span>
\nelse<\/span>:
\nprint<\/span>(<\/span>"\\t<\/span>User lvl auth is enabled"<\/span>)<\/span>
\n
\nif<\/span> check_bit(<\/span>auth_stuff,<\/span> 2<\/span>)<\/span>:
\nprint<\/span>(<\/span>"\\t<\/span>Non-null usernames enabled"<\/span>)<\/span>
\nelse<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>null usernames allowed"<\/span>)<\/span>
\nproblems +=<\/span> 1<\/span>
\n
\nif<\/span> check_bit(<\/span>auth_stuff,<\/span> 6<\/span>)<\/span>:
\nprint<\/span>(<\/span>"*\\t<\/span>Anonymous login enabled (really bad: a user that has a null username & password is enabled!)"<\/span>)<\/span>
\nproblems +=<\/span> 1<\/span>
\nelse<\/span>:
\nprint<\/span>(<\/span>"\\t<\/span>Anonymous login disabled"<\/span>)<\/span>
\n
\nif<\/span> problems ><\/span> 0<\/span>:
\nprint<\/span>(<\/span>"%s\\t<\/span>%s problems found (marked with *'s)"<\/span> % (<\/span>target,<\/span> problems)<\/span>)<\/span>
\nelse<\/span>:
\nprint<\/span>(<\/span>"%s\\t<\/span>No problems found"<\/span> % target)<\/span>
\n
\n#<\/span>
\n# create socket & bind to local port<\/span>
\n#<\/span>
\n
\nudp =<\/span> socket<\/span>(<\/span>AF_INET,<\/span> SOCK_DGRAM)<\/span>
\nsake =<\/span> udp.getsockname<\/span>(<\/span>)<\/span>
\nudp.bind<\/span>(<\/span>sake)<\/span>
\n
\n# actually send packet<\/span>
\ntry<\/span>:
\nudp.settimeout<\/span>(<\/span>timeout)<\/span>
\n
\n# if udp.sendto(" ", (target, PORT)) <= 0:<\/span>
\nif<\/span> udp.sendto<\/span>(<\/span>payload,<\/span> (<\/span>target,<\/span> PORT)<\/span>)<\/span> <=<\/span> 0<\/span>:
\nprint<\/span>(<\/span>"couldn't send packet to %s"<\/span> % target)<\/span>
\n
\n# catch response<\/span>
\ndata,<\/span>addr =<\/span> udp.recvfrom<\/span>(<\/span>512<\/span>)<\/span>
\n
\n# skip the header<\/span>
\ndata =<\/span> data[<\/span>21<\/span>:]<\/span>
\n
\nudp.close<\/span>(<\/span>)<\/span>
\n
\nparse_response(<\/span>addr[<\/span>0<\/span>]<\/span>,<\/span> data)<\/span>
\n
\n#<\/span>
\n# exceptions... this should also catch parsing stuff in parse_response<\/span>
\n#<\/span>
\nexcept<\/span> Exception<\/span>,<\/span> e:
\nprint<\/span>(<\/span>"hmmm.... problems in paradise, tonto: %s, bailin'"<\/span> % e)<\/span><\/div><\/div>\n","protected":false},"excerpt":{"rendered":"

Not all packets are equal. If you send a single UDP packet to port 623 that contains an “Get Channel Authentication Capabilities” (see secion 22.13 of the IPMI v2 spec), you’ll get back a packet that has some interesting features. You can get this by parsing the output of “ipmitool -v -v -H 10.0.0.1 -U […]<\/p>\n","protected":false},"author":44,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[146,154,172,4],"tags":[184,113,185,186,183],"class_list":["post-712","post","type-post","status-publish","format-standard","hentry","category-hack","category-ipmi-2","category-python","category-security","tag-184","tag-ipmi","tag-network","tag-rmcp","tag-udp"],"_links":{"self":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/users\/44"}],"replies":[{"embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=712"}],"version-history":[{"count":10,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/712\/revisions"}],"predecessor-version":[{"id":875,"href":"https:\/\/trouble.org\/index.php?rest_route=\/wp\/v2\/posts\/712\/revisions\/875"}],"wp:attachment":[{"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trouble.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}