CosmicRakp

CosmicRakp 目次 はじめに CVE-2013-4786 インストール 使用方法 クレジット ライセンス はじめに CosmicRakp は Go で書かれた強力なツールで、レッドチームやペネトレーションテスターが IPMI のハッシュをダンプできるようにします。このプロジェクトは、効率的で高速かつ使いやすいことを目指しています。 CVE-2013-4786 このツールは CVE-2013-4786 で詳細に説明されている脆弱性を悪用します。この脆弱性により、不正ユーザーが RAKP（Remote Authentication Key Protocol）メカニズムを介して IPM...

ipmitest

ipmitest IPMIの暗号タイプゼロ認証バイパス脆弱性（CVE-2013-4784）をテストするためのシェルスクリプト IPMIは、システム管理者がコンピュータシステムのアウトオブバンド管理とその動作監視に使用する標準化されたコンピュータシステムインターフェースです。これは、オペレーティングシステムやログインシェルではなく、ネットワーク接続を介してハードウェアにアクセスすることで、電源がオフになっている、または応答しないコンピュータを管理する方法です。 この脆弱性により、リモートの攻撃者は、暗号スイート0（別名 cipher...

SuperMicro-Password-Scanner

Supermicro IPMI/BMC 平文パスワードスキャナ v20140622 by 1N3 https://crowdshield.com 使用方法: sh supermicroscan.sh proxy 概要: SupermicroのIPMI/BMC実装では、リモートの未認証攻撃者がポート49152を介してPSBlockファイルを要求することができます。この平文パスワードファイルには、IPMIのユーザー名とパスワード情報が含まれています。このスクリプトを使用すると、ユーザーはネットワークをスキャンして、パッチ適用が必要な脆弱なシステムを確認できます。 使用方法:...

ipmi

私はIPMIを調査するためのソフトウェアをいくつか書きました。以下はその結果の一部です。通常の「検出、データ取得、監査」というサイクルを実行しようと考えました。これらのそれぞれは、少なくとも私にとっては、それ自体がかなり興味深い問題であることがわかりました。 ちなみに/参考までに - IPMIを調査するための新しいツールをリリースしました - https://github.com/zenfish/zipmi - また、BMCをQemu上の仮想システムとして実行するためのQemuレシピ/イメージ等のセットも https://github.com/zenfish/zbmc にあります。...

Linux Distros Unpatched Vulnerability : CVE-2026-59785

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a...

CVE-2026-59785

A flaw was found in Zabbix. The host search functionality in the web frontend allows filtering against fields that are not displayed, including stored Intelligent Platform Management Interface IPMI and Pre-Shared Key PSK credentials. An authenticated attacker with read access can exploit this by...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ipmi: Revised the handling of user message limits. The limit on the number of user messages had several issues; improper counting occurred in some cases, and there were issues with operations after memory allocation. The process...

Astra Linux – Vulnerability in openipmi

OpenIPMI before version 2.0.36 has a buffer overflow vulnerability related to the authentication type in the ipmisim simulator. This vulnerability can lead to denial of service, or with a very low probability authentication bypass or code execution...

DEBIAN-CVE-2026-59785

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

CVE-2026-59785

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

CVE-2026-59785

The Frontend host search functionality is vulnerable to an information disclosure flaw due to improper filtering in multiselect.get . This allows users with read access to filter by hidden fields, specifically stored IPMI and PSK credentials . By observing differences in search results, an attack...

CVE-2026-59785 Hidden host credentials inferable via multiselect.get filtering

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

EUVD-2026-92397

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

CVE-2026-59785: Observable Response Discrepancy

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

PT-2026-104803

Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can guess a credential and see from the search result whether the guess was right, letting them uncover it...

Rocky Linux 9 [CIQ] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-bmc-watchdog-debuginfo / etc (crlsa-2026_36210)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202636210 advisory. freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client CVE-2026-50031 Tenable has extracted the preceding description block directly from the...

Rocky Linux 8 [CIQ] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-bmc-watchdog-debuginfo / etc (crlsa-2026_36307)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202636307 advisory. freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client CVE-2026-50031 Tenable has extracted the preceding description block directly from the...

Rocky Linux 9 [CIQ] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-bmc-watchdog-debuginfo / etc (crlsa-2026_14819)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202614819 advisory. freeipmi: buffer overflows on response messages via ipmi-oem CVE-2026-33554 Tenable has extracted the preceding description block directly from the CIQ security...

Rocky Linux 8 [CIQ] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-bmc-watchdog-debuginfo / etc (crlsa-2026_20579)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202620579 advisory. freeipmi: buffer overflows on response messages via ipmi-oem CVE-2026-33554 Tenable has extracted the preceding description block directly from the CIQ security...

AlmaLinux 9.2 [TuxCare] Security Update: freeipmi / freeipmi-bmc-watchdog / freeipmi-devel / etc (ALMALINUX9.2:CLSA-2026:1785840756)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1785840756 advisory. - ipmi-oem in FreeIPMI before 1.6.18 has exploitable buffer overflows on response messages. The Intelligent Platform Management Interface IPM...