4 ms·
How the hell do you pwn a server with iDRAC?
by LennyWhiteJr 7y ago
How the hell do you pwn a server with iDRAC?
- berbec 7y agoIn certain configurations, iDRAC gives you an rdp connection. If idrac is left at default, windows admin login not being changed isn't too much of a stretch.
- zeta0134 7y agoIf you can reboot it without anyone noticing? Really, really easily: iDRAC gives you access to the local console, like a remote KVM. Reboot into single user mode, change a password, done.
- notyourday 7y agoOh, IPMI and friends are a total mess. Some implementations allow one to take control of a running server remotely especially if they use a shared ethernet for management ( popular in supermicros ). I once had our security geek demonstrate it by taking over the running server, rebooting it using network emulated USB stick, adding a file into /etc and rebooting the server again. In secure environments one pulls IPMI module from the server or only uses the modules that have their own dedicated NICs that have to be wired to their own management network.
- tonyarkles 7y agoThe first time I booted a server using a virtual CD-ROM (iso on my laptop shows up as a hardware CD-ROM on the server) over IPMI I was simultaneously relieved (because I could fix the machine remotely) and absolutely totally horrified.
- kevin_b_er 7y agoiDRAC is a full onboard whitehat rootkit manufactured and supported by Dell. It runs independently of any OS and has control over the system. It is intended to be a substitute for physical access.
- luch 7y agoiDrac have a default password : https://danblee.com/dell-idrac-default-username-and-password/ https://danblee.com/dell-idrac-default-username-and-password... There also quite a number of sysadmins that connect idrac's to the "regular" network, instead of the sysadmin VLAN ...