https://jhalderm.com/pub/papers/ipmi-woot13.pdf https://jhalderm.com/pub/papers/ipmi-woot13.pdf suggests one (fairly visible) way: > Another common feature is

https://jhalderm.com/pub/papers/ipmi-woot13.pdf https://jhalderm.com/pub/papers/ipmi-woot13.pdf suggests one (fairly visible) way: > Another common feature is virtual USB disk media, which can be used to infiltrate or exfiltrate files or to provide new boot media. The combination of these capabilities and remote power cycling would allow an attacker to seize control of most common server configurations. For instance, they could restart the system and boot from a virtual live CD, then directly copy or modify data on the host’s storage devices If the IPMI has write access to disc and/or main memory, you can do it more directly - drop a new /bin/login on the disc, or patch it in memory (similar to the LoJax attack: https://news.ycombinator.com/item?id=18090651 https://news.ycombinator.com/item?id=18090651)