Let's perform the following steps:

1. We start Metasploit:

2. Search for IPMI-related exploits using the following command:

search ipmi

The output of the preceding command is shown in the following screenshot:

3. Use the IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval
   vulnerability; we choose auxiliary. There are multiple exploits, such as cipher_zero, which can be tried as well:

use auxiliary/scanner/ipmi/ipmi_dumphashes

4. To see options, type the following command:

    show options 

The output of the preceding command is shown in the following screenshot:

Here we see the auxiliary automatically attempts to crack the hashes it retrieves.

5. Set the RHOSTS and run. On successful exploitation, we will see the hashes retrieved and cracked: