So, I managed to reset the BMC back to factory defaults and login. I took a dump of the 32MB SPI for the BMC firmware, extracted the JFFS2 region, mounted it (in Linux) and then deleted the files listed in the environment variables
rm_files (found in the cramfs rootfs in
bin/define_var.sh )
Code:
export rm_files="lighthttpd.conf OEMPSBlock service.conf bmc_hostname ddns PSBlock FWBlock SDRBlock network ntp/ntp.conf SELBlock server.pem timezone vm_image.conf wsman enSSL.config sysmacaddr.conf wsman/simple_auth.passwd wsman/openwsman.conf ipctrl/rultbl.sav snmpd.conf ddns/DDNS_CONFIG ddns/ddns.key ddns/ddns.private IKVMViewerLang stunnel.conf redfish/event.ini"
Unmount the JFFS2 after deleting the above files and use dd to replace the JFFS2 region in the BMC dump with the modified filesystem. Reflash. Boot, and the BMC will be reset to factory defaults (DHCP, ADMIN/ADMIN).
![Smile :) :)](data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7)
You will however, lose any installed licenses.
Unfortunately now that the BMC and remote console are working, I find that my board is dead. It does not pass POST. I'm using a CPU and RAM from another server which I know work.
I have the POST codes 15 3B 32 4F on the remote console and then the board resets. I've contacted the vendor to replace the board and I'll update when I have something more to share.
BTW, PSBlock seems to be the file of interest for the web admin authentication. It was the file that on older BMC firmwares could be gotten with a simple nc on port 49152, which Supermicro patched. The new file seem to be in some kind of binary format,
file claims it's a dbView III file, but dbview cannot read it.
Removing the PSBlock file from the JFFS2 filesystem will result in /lib/libipmi.so recreating the file with the default ADMIN/ADMIN login.