module

Supermicro Onboard IPMI url_redirect.cgi Authenticated Directory Traversal

Try Surface Command
Back to search
Disclosed
Nov 6, 2013
Created
May 30, 2018

Description

This module abuses a directory traversal vulnerability in the url_redirect.cgi application
accessible through the web interface of Supermicro Onboard IPMI controllers. The vulnerability
is present due to a lack of sanitization of the url_name parameter. This allows an attacker with
a valid, but not necessarily administrator-level account, to access the contents of any file
on the system. This includes the /nv/PSBlock file, which contains the cleartext credentials for
all configured accounts. This module has been tested on a Supermicro Onboard IPMI (X9SCL/X9SCM)
with firmware version SMT_X9_214. Other file names to try include /PSStore, /PMConfig.dat, and
/wsman/simple_auth.passwd

Authors

hdm [email protected]
juan vazquez [email protected]

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use auxiliary/scanner/http/smt_ipmi_url_redirect_traversal
    msf auxiliary(smt_ipmi_url_redirect_traversal) > show actions
        ...actions...
    msf auxiliary(smt_ipmi_url_redirect_traversal) > set ACTION < action-name >
    msf auxiliary(smt_ipmi_url_redirect_traversal) > show options
        ...show and set options...
    msf auxiliary(smt_ipmi_url_redirect_traversal) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today