EU ebay: Supermicro X10SLE-F (Micro-Cloud node) usually under 10 Euro

Discussion in 'Great Deals' started by DanAnd, Jun 23, 2019.

  1. Rand__

    Rand__ Well-Known Member

    Joined:
    Mar 6, 2014
    Messages:
    3,464
    Likes Received:
    501
    If you can't find any let me know, should have some I could borrow you
     
    #61
    RageBone likes this.
  2. DanAnd

    DanAnd Member

    Joined:
    Jul 25, 2016
    Messages:
    49
    Likes Received:
    24
    #62
    RageBone likes this.
  3. nerdalertdk

    nerdalertdk Fleet Admiral

    Joined:
    Mar 9, 2017
    Messages:
    98
    Likes Received:
    20

    Any change for an Paint drawing of that pin out :D
     
    #63
  4. hmartin

    hmartin Active Member

    Joined:
    Sep 20, 2017
    Messages:
    108
    Likes Received:
    54
    I would also love a summary of the pinout. From your investigation, it sounds like the following:

    JP17:
    1. N/C
    2. GND
    3. N/C
    4. N/C
    5. 3.3V (Input)
    6. N/C
    JP18:
    1. 5V (Output?)
    2. N/C
    3. N/C
    4. 3.3V (Output?)
    5. N/C
    6. 3.3V (Output?)
    Or does JP18 require those voltages as inputs?

    My board arrived today, packed in peanuts. It seems the seller learned their lesson though, and put a paper in the CPU socket to prevent damage from the peanuts. Still, there is a bent pin :(

    [​IMG]

    [​IMG]

    This board is nasty. I don't mean just dusty, it seems to have some kind of residue on it. It almost seems like it came from an environment with cigarette tar...
     
    #64
  5. RageBone

    RageBone Active Member

    Joined:
    Jul 11, 2017
    Messages:
    229
    Likes Received:
    45
    Decided to put it on github since i can't put pictures up on here. Some error.
    Ragebone/nr64_supermicro_x10sle-f

    @hmartin damn that pin. Looks fixable though.
    But if you don't want to, you can tell the seller and in my own experience, they will send you another one.

    Could send the broken one to me ;D
     
    #65
    Last edited: Sep 19, 2019
    nerdalertdk likes this.
  6. hmartin

    hmartin Active Member

    Joined:
    Sep 20, 2017
    Messages:
    108
    Likes Received:
    54
    I think I managed to bend the pin back. I'll test on the weekend, after I make a power cable for the board. The molex connector is the same as an ATX EPS power, so if you have an EPS extension cable around you can butcher that instead of hacking the cable from the backplane connector.

    If my counting is correct, the bent pin is AU13 which is SA_MA0 (Intel PDF, page 118). I guess I will know pretty quickly if it doesn't recognize memory in channel A that I need to ask the seller for a replacement...
     
    #66
    RageBone likes this.
  7. RageBone

    RageBone Active Member

    Joined:
    Jul 11, 2017
    Messages:
    229
    Likes Received:
    45
    @hmartin Since it was bent upward, pushing it down should fix it. But i digress and you are the one doing it. So good luck and much success!

    I just pushed the 4th 12V pin out of an EPS, put the 5VSB pin there, and added a switch to the PSON line.

    Gona get a hopefully working ddr3 udimm ecc dimm this evening from a friend, so that i can hopefully report success on the hole operation.
     
    #67
    hmartin likes this.
  8. RageBone

    RageBone Active Member

    Joined:
    Jul 11, 2017
    Messages:
    229
    Likes Received:
    45
    So i got the Ram from a friend and i can now happily say and confirm that those boards only work with udimm ecc, and in that pin bridged configuration.

    Well, i just went into the bios and stayed there for a while. U11 didn't get noticeably hot but you should keep an eye on it.
    So i now should actually buy some ram, when my budget refills next month.

    pictures as proof are in the repo.
     
    #68
    hmartin and DanAnd like this.
  9. hmartin

    hmartin Active Member

    Joined:
    Sep 20, 2017
    Messages:
    108
    Likes Received:
    54
    So, my BMC has a static IP address (140.0.33.35) and the ADMIN account is disabled. It's beyond the firmware version where you can extract the admin login by using nc on port 49152. I don't have the Supermicro SUVI cable, so I don't have VGA, and there is no jumper on the motherboard to reset the BMC to defaults.

    Otherwise, the power light is always on green, which is a bit strange. The board does squeal when it's on (even with the NIC installed), so it does seem to have some life, but without iKVM I won't get far.

    Unless someone can crack the hashed password from an IPMI firmware dump, I guess I need to find a SUVI cable...

    Edit: If someone has a SUVI cable and can tell me the pins used for RS-232, that would be super helpful!
     
    #69
    Last edited: Sep 21, 2019
  10. DanAnd

    DanAnd Member

    Joined:
    Jul 25, 2016
    Messages:
    49
    Likes Received:
    24
    I think I can lend you such a cable. I will try to get mine up to running and then I can send it around. Are you based on Europe?
     
    #70
    nerdalertdk likes this.
  11. hmartin

    hmartin Active Member

    Joined:
    Sep 20, 2017
    Messages:
    108
    Likes Received:
    54
    Hey DanAnd, I have some passwords for wsman too in the BMC SPI dump, but I don't think they're hashed?
    Code:
    ADMIN:eCCR81e5DFfg6
    myloc_admin:/g8OFglXcntsY
    Edit: never mind, they're obviously hashed. ADMIN/ADMIN, and the myloc_admin is unknown, currently trying to crack with my 1070 but it will take days at least...

    Edit2: since I have SPI access, I could just change the password for myloc_admin to the hashed password for ADMIN, but I'm not convinced this wsman conf file is also the login for the web admin users. It would be nice to know where the users are dis/enabled and then I could just re-enable the ADMIN account...
     
    #71
    Last edited: Sep 21, 2019
    DanAnd and RageBone like this.
  12. DanAnd

    DanAnd Member

    Joined:
    Jul 25, 2016
    Messages:
    49
    Likes Received:
    24
    mine are:
    ADMIN:eCCR81e5DFfg6
    myloc_admin:110478VFEgq0Q
    ilo_user_I1xsB:I969cX77eN55.
    ilo_user_gY42z:MgRYwofGaV/jk

    The Hash algorythm is RAKP HMAC-SHA1, which could be decyphered with hashcat (Mode 7300). However I gave up trying, after I completed all keys from 1 to 6 characters. I assume it will be easier with local login/bios.
     
    #72
  13. DanAnd

    DanAnd Member

    Joined:
    Jul 25, 2016
    Messages:
    49
    Likes Received:
    24
    I tried @RageBone 's wiring and I see that my board Power-Button lids up. I still don't get any boot up screen. I am really confused what I did differently with my first blown-up board, which at least show me the SUPERMICRO screen.

    I used RAM and a CPU which works fine on my X10SLM+-LN4F , which is standard micro-atx board also based on the Intel C224 as the X10SLE-F.

    I am currently out of ideas.
     
    #73
    Last edited: Sep 21, 2019
  14. pif43

    pif43 New Member

    Joined:
    Jun 30, 2019
    Messages:
    4
    Likes Received:
    2
    I got the same result except the board didn't blew up. First launch got a SUPERMICRO screen, but I was lacking a heatsink. I installed one and after that power button stopped working. Very confusing.
     
    #74
  15. hmartin

    hmartin Active Member

    Joined:
    Sep 20, 2017
    Messages:
    108
    Likes Received:
    54
    What's the behaviour of your power button? Mine is on green all the time, even when the board is off (no heat from the PCH or CPU). Sometimes the BMC randomly stops responding on the network and I have to power cycle the board. It's very strange.

    I'm wondering if the boards are actually working reliably, or if this is the reason they're being sold for so little...
     
    #75
  16. RageBone

    RageBone Active Member

    Joined:
    Jul 11, 2017
    Messages:
    229
    Likes Received:
    45
    I had to resolder the large mio Rom on mine to get the ipmi working.
    Noticed that it didn't enable unless i flexed the board or pushed it down on that mio rom, or near the BMC.

    The joints looked matt and not shiny and had a bit of gunk on them.


    My powerbutton is lit up green all the time.

    The postcode displays FF, unless the system is turned on, then it posts ^^
     
    #76
    Last edited: Sep 22, 2019
  17. ecosse

    ecosse Active Member

    Joined:
    Jul 2, 2013
    Messages:
    342
    Likes Received:
    55
    Got to say I love the dedication you are putting in to try to get these things to work. They'd be chucked into the deepest recesses of my garage by now.
     
    #77
    RageBone likes this.
  18. DanAnd

    DanAnd Member

    Joined:
    Jul 25, 2016
    Messages:
    49
    Likes Received:
    24
    I did a few more investigations.
    My first board must have been used in production and wasn't cleaned up, as I found the mentioned simple_auth passwd file of wsman in the BMC rom.

    My replacement buy does not have users configured. I haven't found anything inside the BMC flash. Except: ipmi user list just includes the empty user '' (anonymous user) with the password "admin" (in low case instead of the usual supermicro uppercase ipmi passwords).
    The empty user does not have administrator rights, so I didn't got forward on that.

    I inspected the blown-up board again and figured out that my bmc flash chip does is shorted between +3V and GND. I don't know if this is the effect of the blown up U11 or if the flash chip had a shortened circuit which blown up the power stage (U11).

    U11 is at least responsible for the 3V power of the BMC flash (and more components, I assume).

    A nicer shot of the working board U11.

    2019-09-22-155419.jpg
     
    #78
  19. hmartin

    hmartin Active Member

    Joined:
    Sep 20, 2017
    Messages:
    108
    Likes Received:
    54
    Could anyone send me a dump of their BMC ROM with known admin credentials? :)

    Is the simple_auth.passwd config file the credentials for the WebUI? If so, I don't understand how users are disabled.

    Otherwise, I was able to find a mirror of older Supermicro BMC firmwares for the X10 series. If I can't get a dump from someone else, I'm going to try the following:
    1. Editing the username/passwords in the JFFS2 partition of the BMC firmware and reflashing that (probably using devicenull/ipmi_firmware_tools )
    2. Flashing an older X10 BMC firmware release and trying some known exploits (here is a mirror of older BMC firmware releases: ftp://ftp.abacus.cz/support/FW/MB/SUPERMICRO/IPMI/A1/STARSI/ )
    3. Oscilloscope on the JKVM1 connector to try and locate the RS-232 pins

    The ETA on brute forcing an 8 character password on my 1070 is 127 days, so I'm going the physical access route now.

    Edit: Well, #1 is out:

    Code:
    $ python read_header.py --extract ../x10sle-f_bmc.bin
    Read 33554432 bytes
    Warning: bootloader (first 64040 bytes of file) md5 doesn't match.  This parser may not work with a different bootloader
    Expected 166162c6c9f21d7a710dfd62a3452684, got c72bf051f0569a6ca809eb7750364562
    Dumping bootloader to data/bootloader.bin
    Error: Unable to determine what type of IPMI firmware this is!
     
    #79
    Last edited: Sep 22, 2019
  20. hmartin

    hmartin Active Member

    Joined:
    Sep 20, 2017
    Messages:
    108
    Likes Received:
    54
    So, I managed to reset the BMC back to factory defaults and login. I took a dump of the 32MB SPI for the BMC firmware, extracted the JFFS2 region, mounted it (in Linux) and then deleted the files listed in the environment variables rm_files (found in the cramfs rootfs in bin/define_var.sh )
    Code:
    export rm_files="lighthttpd.conf OEMPSBlock service.conf bmc_hostname ddns PSBlock FWBlock SDRBlock network ntp/ntp.conf SELBlock server.pem timezone vm_image.conf wsman enSSL.config sysmacaddr.conf wsman/simple_auth.passwd wsman/openwsman.conf ipctrl/rultbl.sav snmpd.conf ddns/DDNS_CONFIG ddns/ddns.key ddns/ddns.private IKVMViewerLang stunnel.conf redfish/event.ini"
    Unmount the JFFS2 after deleting the above files and use dd to replace the JFFS2 region in the BMC dump with the modified filesystem. Reflash. Boot, and the BMC will be reset to factory defaults (DHCP, ADMIN/ADMIN). :) You will however, lose any installed licenses.

    Unfortunately now that the BMC and remote console are working, I find that my board is dead. It does not pass POST. I'm using a CPU and RAM from another server which I know work.

    I have the POST codes 15 3B 32 4F on the remote console and then the board resets. I've contacted the vendor to replace the board and I'll update when I have something more to share.

    [​IMG]

    BTW, PSBlock seems to be the file of interest for the web admin authentication. It was the file that on older BMC firmwares could be gotten with a simple nc on port 49152, which Supermicro patched. The new file seem to be in some kind of binary format, file claims it's a dbView III file, but dbview cannot read it.

    Removing the PSBlock file from the JFFS2 filesystem will result in /lib/libipmi.so recreating the file with the default ADMIN/ADMIN login.
     
    #80
    Last edited: Sep 23, 2019
    RageBone likes this.
Similar Threads: ebay Supermicro
Forum Title Date
Great Deals Ebay - Supermicro 4U CSE-417 72 Bay 599.00 OBO YMMV Sep 11, 2019
Great Deals eBay: Full 4U Supermicro System - $350 + Ship Aug 23, 2019
Great Deals eBay Supermicro X9, E3 V2, 16/32GB, SSD or 2TB - Many combinations Jun 1, 2017
Great Deals eBay SuperMicro 2U: 12-disk, 2x L5630, $290 Jun 16, 2016
Great Deals Mellanox ConnectX-3 on ebay look strange Today at 5:33 AM

Share This Page