https://insinuator.net/tags/red-teaming/ Recent content in Red Teaming on Insinuator.net - Bold Statements Hugo en-us Fri, 25 Apr 2025 00:00:00 +0000 https://insinuator.net/2025/04/vulnerability-disclosure-restricted-shell-breakout-cve-2025-1950-and-privilege-escalation-cve-2025-1951-in-ibm-power-hardware-management-console-hmc/ Fri, 25 Apr 2025 00:00:00 +0000 https://insinuator.net/2025/04/vulnerability-disclosure-restricted-shell-breakout-cve-2025-1950-and-privilege-escalation-cve-2025-1951-in-ibm-power-hardware-management-console-hmc/ <p>We discovered a private key for accessing an IBM Hardware Management Console (HMC) during a recent red team engagement. The IBM Hardware Management Console (HMC) is a dedicated management system used to control and manage IBM servers, especially those running on Power Systems (like IBM Power9/Power10) and mainframes (z Systems). After brief research, we identified two security vulnerabilities that can be leveraged to gain root access to the HMC.</p> <p>Access for most users via SSH is limited through the <code>hmcbash</code>, a restricted shell environment. Using <code>LD_PRELOAD</code>, attackers can break out of the restricted bash and gain access to additional binaries installed on the system. With the restrictions lifted, attackers can use a <code>setuid</code> binary, <code>copysshkey</code>, to elevate privileges to <code>root</code>.</p>