Welcome to a data centre! A place where air conditioning never stops running, and the long line of tiny, red and blue LEDs dance chaotically in tune with endless coolers, sounding at unisone. One thing is for sure, everyone avoids data centres. And, as one of the greatest leaders of our era once said “behind every need, there is a right” (in this case a product) Welcome to the world of the Out of Band Power Management devices, where vendors decide to set an extra microprocessor in the motherhood, so as to allow monitoring temperature, coolers and power, in a remote way. We decided to take a look at these devices and what we found was even worse than expected. Vulnerabilities dating back to the 90s, remote code executions 100% reliable, and the possibility of moving bidirectionally between server and BMC, making it, not only the ideal tool for lateral movement, but also the perfect backdoor.