Skip to content
Achieving root & other modifications on Dell IPMI/BMC
Branch: master
Clone or download
Latest commit 919d18b Feb 17, 2019
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
build-scripts
compiled-image
modified-files-only/etc add isolated modified files Sep 25, 2018
squashfs-ipmi
squashfs-linux folder cleanup Sep 25, 2018
Flash-Map.txt add extra info files Sep 25, 2018
README.md
Vendor-Mode-Boot.txt

README.md

Special thanks to Adam Nielsen for his help and poking through sources with me over 70+ emails in two timezones. Also, for keeping the same Uni email for 10+ years

idrac-7-8-reverse-engineering

Achieving undetectable root + loading of arbitrary code on Dell IDRAC7 & IDRAC8 IPMI/BMC server hardware.

Featured on:

CVE: CVE-2018-15776

Instructions

The build-scripts folder contains basic scripts for modifying and rebuilding the kernel and squashFS images from the official firmware image. Once extracted and unsquashed, you are free to modify the linux filesystem as you please. If you plan on adding binaries, please be aware the onboard IDRAC BMC is SuperH/RISC, details in iDRAC_opensource_2.60.60.60/externalsrc/linux-yocto/.config assuming you have dell's IDRAC8 sources (IDRAC7 & IDRAC8 run the same codetrain).

What is not covered in this repo is instructions on bypassing Dell's PGP signature checks to load and run your modified firmware onto the controller. These instructions may be added at a later date

display_factory_info.sh[2377]: 0x14000000 = 01 00 03 00 02 00 00 00 : 08 00 00 00 01 00 06 0b
display_factory_info.sh[2377]: 0x14000010 = 00 08 08 00 04 00 04 00 : 00 07 0c 09 03 0c 0c 0f
display_factory_info.sh[2377]: 0x14000020 = 07 07 0e 07 00 00 00 00 : 00 00 00 01 00 00 01 01
display_factory_info.sh[2377]: 0x14000030 = 00 00 00 00 00 00 00 00 : 00 00 00 00 00 00 00 00
display_factory_info.sh[2377]: -------------------------------------------
display_factory_info.sh[2377]: Custom Image Booted: v1.1 @J.Sands @A.Nielsen
display_factory_info.sh[2377]: Enjoy Enjoy Enjoy Enjoy
display_factory_info.sh[2377]: -------------------------------------------
display_factory_info.sh[2377]: -------------------------------------------
display_factory_info.sh[2377]: Files Edited:
display_factory_info.sh[2377]: /etc/fsdf/DebugCaps.ini              Removed auth requirement for "racadm debug invoke rootshell"
display_factory_info.sh[2377]: /etc/passwd                          Removed forcing of logins to limited RACADM shell
display_factory_info.sh[2377]: /etc/def_ssh/sshd_config             Removed prevention of root logins
display_factory_info.sh[2377]: /etc/ssh-motd.txt                    Added SSH MOTD
display_factory_info.sh[2377]: /etc/init.d/display_factory_info.sh  Added these messages
display_factory_info.sh[2377]: -------------------------------------------

drac-1

drac-2

You can’t perform that action at this time.