Conversation

Notices

1. Embed this notice
   Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Tuesday, 01-Sep-2026 23:37:16 JST Ryan Castellucci (they/them) :nonbinary_flag:

   pulls spi flash chip off a motherboard to root a bmc

   sysadmin:$1$A17c6z5w$5OsdHjBn1pjvN6xXKDckq0:14386:0:99999:7:::

   Hmm.

   john -wordlist:/usr/share/dict/words shadow
   Loaded 1 password hash (md5crypt [MD5 32/64 X2])
   Will run 18 OpenMP threads
   Press 'q' or Ctrl-C to abort, almost any other key for status
   superuser (sysadmin)
   1g 0:00:00:01 100% 0.9803g/s 90352p/s 90352c/s 90352C/s squanders..teazel
   Warning: passwords printed above might not be all those cracked
   Use the "--show" option to display all of the cracked passwords reliably
   Session completed
   

   I... see.

   • Embed this notice
     Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Tuesday, 01-Sep-2026 23:55:14 JST Ryan Castellucci (they/them) :nonbinary_flag:

     in reply to

     • Manawyrm

     @manawyrm It had SSH on by default.

   • Embed this notice
     Manawyrm (manawyrm@chaos.social)'s status on Tuesday, 01-Sep-2026 23:55:25 JST Manawyrm

     in reply to

     @ryanc I could've told you that xD
     It's also in some manuals xD

     You can also just enable SSH. You can also access it from the host system.

     BMCs are very fun and very insecure devices :D

   • Embed this notice
     Martin Boller :debian: :tux: :freebsd: :windows: :mastodon: (itisiboller@infosec.exchange)'s status on Wednesday, 02-Sep-2026 01:20:40 JST Martin Boller :debian: :tux: :freebsd: :windows: :mastodon:

     in reply to

     @ryanc I too can never guess the easy guessable ones - It's like brain revolts and says Naaaa, no-one - and I mean no-one - would do that....

   • Embed this notice
     Ryan Castellucci (they/them) :nonbinary_flag: (ryanc@infosec.exchange)'s status on Wednesday, 02-Sep-2026 15:29:59 JST Ryan Castellucci (they/them) :nonbinary_flag:

     in reply to

     • Martin Boller :debian: :tux: :freebsd: :windows: :mastodon:

     @itisiboller I didn't expect to be able to ssh in and get a root shell with well known credentials!

   • Embed this notice
     Martin Boller :debian: :tux: :freebsd: :windows: :mastodon: (itisiboller@infosec.exchange)'s status on Wednesday, 02-Sep-2026 16:52:52 JST Martin Boller :debian: :tux: :freebsd: :windows: :mastodon:

     in reply to

     @ryanc No, often we expect at least a certain level of "secure by default" even though we've been in the gutter and seen reality sooo many times.