Nmap: Network Exploration and Security Auditing Cookbook - Second Edition

How to do it...

Some supermicro IPMI/BMC controllers allow unauthenticated access to a configuration file (/PSBlock) that stores plain text administrative credentials. Let's write a simple NSE script to detect these vulnerable controllers.

For now, let's ignore the documentation tags and keep it simple:

1. Create the file supermicro-psblock.nse and start by filling up the NSE script basic information fields:

   description = [[    Attempts to download an unprotected configuration file    containing plain-text user credentials in vulnerable Supermicro         Onboard IPMI controllers.    The script connects to port 49152 and issues a request for       "/PSBlock" to download the file. This configuration file  contains users with their passwords in plain text.  ...