A Framework for BMC Firmware Vulnerability Analysis and Exploitation

The Out-of-Band management system for server is a specialized controller used for monitoring and managing the status of servers. Server BMC(Baseboard Management Controller) firmware has higher privileges, and conducting firmware vulnerability analysis and exploitation based on the characteristics of the BMC firmware operating environment has become an important research direction at present. To improve the effectiveness and ease of BMC firmware detection, non-intrusive methods of firmware code retrieval need to be investigated. We propose a technique called lateral extension to transfer control from the BMC to the server. It accesses high-value targets in the server environment, including RAM, code, and files. The BMC controller is emulated as a master/slave device over the PCI bus of the server. Arbitrary read/write access to the hard drive, memory, and UEFI firmware of the server is accomplished by starting Direct Memory Access (DMA) operations.