@david_chisnall @whitequark @elly On my supermicro BMC there isn't even an intentional way to get a real shell. It has SSH but it's using some weird thing called SMASH that appears to be entirely useless (it has no documented functionality for doing anything other than listing its own commands, which all do nothing)
In order to get a proper shell I dumped the firmware, booted it in QEMU (to avoid having to solder to tiny contacts on the board to get a serial console), figured out a way to get it to execute my code on boot (it has a read-only cramfs root partition and a read/write /nv partition, and /nv/network/netconfig1 gets sourced as root at boot) and bind-mount a script that runs /bin/sh over /SMASH/msh, and reflashed the firmware with a modified /nv partition.
The SSH server is a proprietary modified version of dropbear that seems to be hardcoded to use /SMASH/msh and uses some different user database from /etc/passwd (so I needed to ssh to ADMIN rather than root). Later I replaced it with my own more normal and up-to-date build of dropbear.