EU ebay: Supermicro X10SLE-F (Micro-Cloud node) usually under 10 Euro

Notice: Page may contain affiliate links for which we may earn a small commission through services like Amazon Affiliates or Skimlinks.

nerdalertdk

Fleet Admiral
Mar 9, 2017
228
118
43
::1
Possibly the Ram or the CPU, a G3258 and some 4GB generic Gskill udimm.

interestingly, there is once 5V on the mentioned pin, and then twice 3.3V on JP18, pin 6 and 4 to be precise. JP17 Pin2 is GND to have at least mentioned where or how i wired it up.

Any change for an Paint drawing of that pin out :D
 

hmartin

Active Member
Sep 20, 2017
316
243
43
37
Pin 1 of JP18 is 5V on mine. thinking about the circuit on the back behind the 8pin powerblug with Q130, Q131 and Q126, i came to the conclusion that THAT pin needs to be connected to ground.
JP17 pin 5 on the other hand seems to need some voltage to then pull Q130 down and allow the Enable pin to not be pulled low.
With 3.3V on pin 5, led5 turns off.
interestingly, there is once 5V on the mentioned pin, and then twice 3.3V on JP18, pin 6 and 4 to be precise. JP17 Pin2 is GND to have at least mentioned where or how i wired it up.
I would also love a summary of the pinout. From your investigation, it sounds like the following:

JP17:
  1. N/C
  2. GND
  3. N/C
  4. N/C
  5. 3.3V (Input)
  6. N/C
JP18:
  1. 5V (Output?)
  2. N/C
  3. N/C
  4. 3.3V (Output?)
  5. N/C
  6. 3.3V (Output?)
Or does JP18 require those voltages as inputs?

My board arrived today, packed in peanuts. It seems the seller learned their lesson though, and put a paper in the CPU socket to prevent damage from the peanuts. Still, there is a bent pin :(





This board is nasty. I don't mean just dusty, it seems to have some kind of residue on it. It almost seems like it came from an environment with cigarette tar...
 
  • Like
Reactions: JustinClift

RageBone

Active Member
Jul 11, 2017
617
159
43
Decided to put it on github since i can't put pictures up on here. Some error.
Ragebone/nr64_supermicro_x10sle-f

@hmartin damn that pin. Looks fixable though.
But if you don't want to, you can tell the seller and in my own experience, they will send you another one.

Could send the broken one to me ;D
 
Last edited:
  • Like
Reactions: nerdalertdk

hmartin

Active Member
Sep 20, 2017
316
243
43
37
I think I managed to bend the pin back. I'll test on the weekend, after I make a power cable for the board. The molex connector is the same as an ATX EPS power, so if you have an EPS extension cable around you can butcher that instead of hacking the cable from the backplane connector.

If my counting is correct, the bent pin is AU13 which is SA_MA0 (Intel PDF, page 118). I guess I will know pretty quickly if it doesn't recognize memory in channel A that I need to ask the seller for a replacement...
 

RageBone

Active Member
Jul 11, 2017
617
159
43
@hmartin Since it was bent upward, pushing it down should fix it. But i digress and you are the one doing it. So good luck and much success!

I just pushed the 4th 12V pin out of an EPS, put the 5VSB pin there, and added a switch to the PSON line.

Gona get a hopefully working ddr3 udimm ecc dimm this evening from a friend, so that i can hopefully report success on the hole operation.
 
  • Like
Reactions: hmartin

RageBone

Active Member
Jul 11, 2017
617
159
43
So i got the Ram from a friend and i can now happily say and confirm that those boards only work with udimm ecc, and in that pin bridged configuration.

Well, i just went into the bios and stayed there for a while. U11 didn't get noticeably hot but you should keep an eye on it.
So i now should actually buy some ram, when my budget refills next month.

pictures as proof are in the repo.
 

hmartin

Active Member
Sep 20, 2017
316
243
43
37
So, my BMC has a static IP address (140.0.33.35) and the ADMIN account is disabled. It's beyond the firmware version where you can extract the admin login by using nc on port 49152. I don't have the Supermicro SUVI cable, so I don't have VGA, and there is no jumper on the motherboard to reset the BMC to defaults.

Otherwise, the power light is always on green, which is a bit strange. The board does squeal when it's on (even with the NIC installed), so it does seem to have some life, but without iKVM I won't get far.

Unless someone can crack the hashed password from an IPMI firmware dump, I guess I need to find a SUVI cable...

Edit: If someone has a SUVI cable and can tell me the pins used for RS-232, that would be super helpful!
 
Last edited:
  • Like
Reactions: JustinClift

hmartin

Active Member
Sep 20, 2017
316
243
43
37
Hey DanAnd, I have some passwords for wsman too in the BMC SPI dump, but I don't think they're hashed?
Code:
ADMIN:eCCR81e5DFfg6
myloc_admin:/g8OFglXcntsY
Edit: never mind, they're obviously hashed. ADMIN/ADMIN, and the myloc_admin is unknown, currently trying to crack with my 1070 but it will take days at least...

Edit2: since I have SPI access, I could just change the password for myloc_admin to the hashed password for ADMIN, but I'm not convinced this wsman conf file is also the login for the web admin users. It would be nice to know where the users are dis/enabled and then I could just re-enable the ADMIN account...
 
Last edited:
  • Like
Reactions: DanAnd and RageBone

DanAnd

Member
Jul 25, 2016
58
47
18
48
Dortmund, Germany
www.danand.de
mine are:
ADMIN:eCCR81e5DFfg6
myloc_admin:110478VFEgq0Q
ilo_user_I1xsB:I969cX77eN55.
ilo_user_gY42z:MgRYwofGaV/jk

The Hash algorythm is RAKP HMAC-SHA1, which could be decyphered with hashcat (Mode 7300). However I gave up trying, after I completed all keys from 1 to 6 characters. I assume it will be easier with local login/bios.
 

DanAnd

Member
Jul 25, 2016
58
47
18
48
Dortmund, Germany
www.danand.de
I tried @RageBone 's wiring and I see that my board Power-Button lids up. I still don't get any boot up screen. I am really confused what I did differently with my first blown-up board, which at least show me the SUPERMICRO screen.

I used RAM and a CPU which works fine on my X10SLM+-LN4F , which is standard micro-atx board also based on the Intel C224 as the X10SLE-F.

I am currently out of ideas.
 
Last edited:

pif43

New Member
Jun 30, 2019
9
4
3
I am really confused what I did differently with my first blown-up board, which at least show me the SUPERMICRO screen.
I am currently out of ideas.
I got the same result except the board didn't blew up. First launch got a SUPERMICRO screen, but I was lacking a heatsink. I installed one and after that power button stopped working. Very confusing.
 

hmartin

Active Member
Sep 20, 2017
316
243
43
37
What's the behaviour of your power button? Mine is on green all the time, even when the board is off (no heat from the PCH or CPU). Sometimes the BMC randomly stops responding on the network and I have to power cycle the board. It's very strange.

I'm wondering if the boards are actually working reliably, or if this is the reason they're being sold for so little...
 

RageBone

Active Member
Jul 11, 2017
617
159
43
I had to resolder the large mio Rom on mine to get the ipmi working.
Noticed that it didn't enable unless i flexed the board or pushed it down on that mio rom, or near the BMC.

The joints looked matt and not shiny and had a bit of gunk on them.


My powerbutton is lit up green all the time.

The postcode displays FF, unless the system is turned on, then it posts ^^
 
Last edited:
  • Like
Reactions: JustinClift

ecosse

Active Member
Jul 2, 2013
463
111
43
Got to say I love the dedication you are putting in to try to get these things to work. They'd be chucked into the deepest recesses of my garage by now.
 
  • Like
Reactions: RageBone

DanAnd

Member
Jul 25, 2016
58
47
18
48
Dortmund, Germany
www.danand.de
I did a few more investigations.
My first board must have been used in production and wasn't cleaned up, as I found the mentioned simple_auth passwd file of wsman in the BMC rom.

My replacement buy does not have users configured. I haven't found anything inside the BMC flash. Except: ipmi user list just includes the empty user '' (anonymous user) with the password "admin" (in low case instead of the usual supermicro uppercase ipmi passwords).
The empty user does not have administrator rights, so I didn't got forward on that.

I inspected the blown-up board again and figured out that my bmc flash chip does is shorted between +3V and GND. I don't know if this is the effect of the blown up U11 or if the flash chip had a shortened circuit which blown up the power stage (U11).

U11 is at least responsible for the 3V power of the BMC flash (and more components, I assume).

A nicer shot of the working board U11.

2019-09-22-155419.jpg
 
  • Like
Reactions: JustinClift

hmartin

Active Member
Sep 20, 2017
316
243
43
37
Could anyone send me a dump of their BMC ROM with known admin credentials? :)

Is the simple_auth.passwd config file the credentials for the WebUI? If so, I don't understand how users are disabled.

Otherwise, I was able to find a mirror of older Supermicro BMC firmwares for the X10 series. If I can't get a dump from someone else, I'm going to try the following:
  1. Editing the username/passwords in the JFFS2 partition of the BMC firmware and reflashing that (probably using devicenull/ipmi_firmware_tools )
  2. Flashing an older X10 BMC firmware release and trying some known exploits (here is a mirror of older BMC firmware releases: ftp://ftp.abacus.cz/support/FW/MB/SUPERMICRO/IPMI/A1/STARSI/ )
  3. Oscilloscope on the JKVM1 connector to try and locate the RS-232 pins

The ETA on brute forcing an 8 character password on my 1070 is 127 days, so I'm going the physical access route now.

Edit: Well, #1 is out:

Code:
$ python read_header.py --extract ../x10sle-f_bmc.bin
Read 33554432 bytes
Warning: bootloader (first 64040 bytes of file) md5 doesn't match.  This parser may not work with a different bootloader
Expected 166162c6c9f21d7a710dfd62a3452684, got c72bf051f0569a6ca809eb7750364562
Dumping bootloader to data/bootloader.bin
Error: Unable to determine what type of IPMI firmware this is!
 
Last edited:
  • Like
Reactions: JustinClift

hmartin

Active Member
Sep 20, 2017
316
243
43
37
So, I managed to reset the BMC back to factory defaults and login. I took a dump of the 32MB SPI for the BMC firmware, extracted the JFFS2 region, mounted it (in Linux) and then deleted the files listed in the environment variables rm_files (found in the cramfs rootfs in bin/define_var.sh )
Code:
export rm_files="lighthttpd.conf OEMPSBlock service.conf bmc_hostname ddns PSBlock FWBlock SDRBlock network ntp/ntp.conf SELBlock server.pem timezone vm_image.conf wsman enSSL.config sysmacaddr.conf wsman/simple_auth.passwd wsman/openwsman.conf ipctrl/rultbl.sav snmpd.conf ddns/DDNS_CONFIG ddns/ddns.key ddns/ddns.private IKVMViewerLang stunnel.conf redfish/event.ini"
Unmount the JFFS2 after deleting the above files and use dd to replace the JFFS2 region in the BMC dump with the modified filesystem. Reflash. Boot, and the BMC will be reset to factory defaults (DHCP, ADMIN/ADMIN). :) You will however, lose any installed licenses.

Unfortunately now that the BMC and remote console are working, I find that my board is dead. It does not pass POST. I'm using a CPU and RAM from another server which I know work.

I have the POST codes 15 3B 32 4F on the remote console and then the board resets. I've contacted the vendor to replace the board and I'll update when I have something more to share.



BTW, PSBlock seems to be the file of interest for the web admin authentication. It was the file that on older BMC firmwares could be gotten with a simple nc on port 49152, which Supermicro patched. The new file seem to be in some kind of binary format, file claims it's a dbView III file, but dbview cannot read it.

Removing the PSBlock file from the JFFS2 filesystem will result in /lib/libipmi.so recreating the file with the default ADMIN/ADMIN login.
 
Last edited: