Skip to content

Tool for decrypting Supermicro BMC firmware images

License

Notifications You must be signed in to change notification settings

c0d3z3r0/smcbmc

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

1 Commit
 
 
 
 
 
 

Repository files navigation

Supermicro BMC firmware image decryptor

This tiny tool can decrypt Supermicro BMC firmware images by first reading the keys from libipmi.so inside the rootfs, then decrypting the headers of the three regions rootfs, webfs and metadata.

Questions & Answers

How to use it?

Just provide the encrypted image as input and a filename for the decrypted image:

./smcbmc.py SMT_X11_xyz.bin decrypted.bin

How is that possible? The image is encrypted!

This is a very nice example of Security-by-Obscurity ...

They keys are hardcoded in libipmi.so, which contains the code to decrypt and flash the image through the web interface or via IPMI. This library is inside the root filesystems, a CRAMFS. The header of this filesystem was encrypted with AES-CBC using these keys, to "protect" the firmware image. That means, the main part of the filesystem is unencrypted and can be extracted to get the keys.

Can I modify the decrypted filesystem(s)?

Yep. Just split the image with dd or the tool of your choice. Look at offset 0x01fc0000 for the metadata section containing the other offsets.

Can I flash the encrypted image?

Yes, the BMC accepts unencrypted images, too.

Can I flash a modified image?

Yes, you just have to adapt the offsets, sizes and CRC checksums in the metadata section. Use ipmi_firmware_tools for example.

I have been hacked and they used your tool!

Well, this is not a question. You should contact someone helping you to fix your (physical) security issues. This is not a "hacking tool" ...

You published our encryption keys / secret information / our intellectual property!!!

No, I did not. You published the keys in the image.

You are infringing our Copyright!!!11111

Uhm, nope.

More information

License

Copyright (C) 2020 Michael Niewöhner

This is open source software, licensed under GPLv2. Refer to the license header in each covered file. See LICENSE for the full license.

About

Tool for decrypting Supermicro BMC firmware images

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages