We discovered a private key for accessing an IBM Hardware Management Console (HMC) during a recent red team engagement. The IBM Hardware Management Console (HMC) is a dedicated management system used to control and manage IBM servers, especially those running on Power Systems (like IBM Power9/Power10) and mainframes (z Systems). After brief research, we identified two security vulnerabilities that can be leveraged to gain root access to the HMC.
Access for most users via SSH is limited through the hmcbash, a restricted
shell environment. Using LD_PRELOAD, attackers can break out of the restricted
bash and gain access to additional binaries installed on the system. With the
restrictions lifted, attackers can use a setuid binary, copysshkey, to
elevate privileges to root.