CVE-2013-4786
HIGH EXPLOITED IN THE WILD RANSOMWAREFujitsu M10 Firmware < 2290 - Unauthenticated Password Hash Exposure via IPMI RAKP HMAC
Title source: llmExploitation Summary
CVE-2013-4786 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns.
EIP tracks 3 public exploits from researchers including Dan Farmer, fin3ss3g0d, including a Metasploit module auxiliary/scanner/ipmi/ipmi_dumphashes.
AI-analyzed exploit summary This Perl script exploits CVE-2013-4786, an information disclosure vulnerability in IPMI 2.0's RAKP protocol. It performs a brute-force attack to guess passwords by extracting HMAC hashes from the BMC's response during session establishment.
Description
The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol (RAKP) authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC.
Exploits (3)
This Perl script exploits CVE-2013-4786, an information disclosure vulnerability in IPMI 2.0's RAKP protocol. It performs a brute-force attack to guess passwords by extracting HMAC hashes from the BMC's response during session establishment.
This repository contains a Go-based tool that exploits CVE-2013-4786 to dump IPMI hashes by leveraging the RAKP protocol with 'None' authentication. It includes functionality to scan IP ranges or target files for vulnerable IPMI devices.
This Metasploit module exploits CVE-2013-4786 to retrieve HMAC-SHA1 password hashes from IPMI 2.0-compatible systems by sending RAKP messages. It supports offline cracking and outputs hashes in formats compatible with hashcat and John the Ripper.
References (7)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N