Improved Intel AMT automated password testing.
Ylian Saint-Hilaire committed
Oct 21, 2020 at 13:38 UTC
5e9dedccbe8ca9c5aea8c5363045940789cb834b
1 file changed
+18
-8
amtmanager.js
+18
-8
@@ -249,14 +249,15 @@ module.exports.CreateAmtManager = function(parent) {
249
// Fetch Intel AMT setup policy
250
// mesh.amt.type: 0 = No Policy, 1 = Deactivate CCM, 2 = Manage in CCM, 3 = Manage in ACM
251
// mesh.amt.cirasetup: 0 = No Change, 1 = Remove CIRA, 2 = Setup CIRA
252
- var amtPolicy = 0, ciraPolicy = 0, badPass = 0;
252
+ var amtPolicy = 0, ciraPolicy = 0, badPass = 0, password = null;
253
if (mesh.amt != null) {
254
if (mesh.amt.type) { amtPolicy = mesh.amt.type; }
255
if (mesh.amt.cirasetup) { ciraPolicy = mesh.amt.cirasetup; }
256
if (mesh.amt.badpass) { badPass = mesh.amt.badpass; }
257
+ if ((typeof mesh.amt.password == 'string') && (mesh.amt.password != '')) { password = mesh.amt.password; }
258
}
259
if (amtPolicy < 2) { ciraPolicy = 0; }
259
- dev.policy = { amtPolicy: amtPolicy, ciraPolicy: ciraPolicy, badPass: badPass };
260
+ dev.policy = { amtPolicy: amtPolicy, ciraPolicy: ciraPolicy, badPass: badPass, password: password };
261
262
// If there is no Intel AMT policy for this device, stop here.
263
if (amtPolicy == 0) { dev.consoleMsg("Done."); removeAmtDevice(dev); return; }
@@ -320,7 +321,9 @@ module.exports.CreateAmtManager = function(parent) {
321
322
// See what user/pass to try.
323
var user = null, pass = null;
323
- if (dev.acctry == null) { user = dev.intelamt.user; pass = dev.intelamt.pass; } else { user = obj.amtAdminAccounts[dev.domainid][dev.acctry].user; pass = obj.amtAdminAccounts[dev.domainid][dev.acctry].pass; }
324
+ if (dev.acctry == null) { user = dev.intelamt.user; pass = dev.intelamt.pass; }
325
+ else if (dev.acctry == 'policy') { user = 'admin'; pass = dev.policy.password; }
326
+ else if (typeof dev.acctry == 'number') { user = obj.amtAdminAccounts[dev.domainid][dev.acctry].user; pass = obj.amtAdminAccounts[dev.domainid][dev.acctry].pass; }
327
328
// See if we need to perform TLS or not. We prefer not to do TLS within CIRA.
329
var dotls = -1;
@@ -351,7 +354,9 @@ module.exports.CreateAmtManager = function(parent) {
354
355
// See what user/pass to try.
356
var user = null, pass = null;
354
- if (dev.acctry == null) { user = dev.intelamt.user; pass = dev.intelamt.pass; } else { user = obj.amtAdminAccounts[dev.domainid][dev.acctry].user; pass = obj.amtAdminAccounts[dev.domainid][dev.acctry].pass; }
357
+ if (dev.acctry == null) { user = dev.intelamt.user; pass = dev.intelamt.pass; }
358
+ else if (dev.acctry == 'policy') { user = 'admin'; pass = dev.policy.password; }
359
+ else if (typeof dev.acctry == 'number') { user = obj.amtAdminAccounts[dev.domainid][dev.acctry].user; pass = obj.amtAdminAccounts[dev.domainid][dev.acctry].pass; }
360
361
// Connect now
362
var comm;
@@ -381,9 +386,13 @@ module.exports.CreateAmtManager = function(parent) {
386
tryAgainFunc.dev = dev;
387
setTimeout(tryAgainFunc, 5000);
388
} else {
384
- // No active connections, see what user/pass to try.
389
+ // No active connections
390
+
391
+ // See what user/pass to try.
392
var user = null, pass = null;
386
- if (dev.acctry == null) { user = dev.intelamt.user; pass = dev.intelamt.pass; } else { user = obj.amtAdminAccounts[dev.domainid][dev.acctry].user; pass = obj.amtAdminAccounts[dev.domainid][dev.acctry].pass; }
393
+ if (dev.acctry == null) { user = dev.intelamt.user; pass = dev.intelamt.pass; }
394
+ else if (dev.acctry == 'policy') { user = 'admin'; pass = dev.policy.password; }
395
+ else if (typeof dev.acctry == 'number') { user = obj.amtAdminAccounts[dev.domainid][dev.acctry].user; pass = obj.amtAdminAccounts[dev.domainid][dev.acctry].pass; }
396
397
// Connect now
398
var comm;
@@ -475,7 +484,8 @@ module.exports.CreateAmtManager = function(parent) {
484
dev.tlsfail = true; attemptInitialContact(dev); return;
485
} else if (status == 401) {
486
// Authentication error, see if we can use alternative credentials
478
- if ((dev.acctry == null) && (obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > 0)) { dev.acctry = 0; attemptInitialContact(dev); return; }
487
+ if ((dev.acctry == null) && (dev.policy.password != null)) { dev.acctry = 'policy'; attemptInitialContact(dev); return; }
488
+ if ((dev.acctry == null) || (dev.acctry == 'policy') && (obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > 0)) { dev.acctry = 0; attemptInitialContact(dev); return; }
489
if ((dev.acctry != null) && (obj.amtAdminAccounts[dev.domainid] != null) && (obj.amtAdminAccounts[dev.domainid].length > (dev.acctry + 1))) { dev.acctry++; attemptInitialContact(dev); return; }
490
491
// If this devics is in CCM mode and we have a bad password reset policy, do it now.
@@ -1405,7 +1415,7 @@ module.exports.CreateAmtManager = function(parent) {
1415
obj.parent.mpsserver.SendJsonControl(dev.mpsConnection, { action: 'mestate' }); // Request an MEI state refresh
1416
dev.consoleMsg("Succesfully activated in CCM mode, holding 10 seconds...");
1417
1408
- // Wait 8 seconds before attempting to manage this device in CCM
1418
+ // Wait 10 seconds before attempting to manage this device in CCM
1419
var f = function doManage() { if (isAmtDeviceValid(dev)) { attemptInitialContact(doManage.dev); } }
1420
f.dev = dev;
1421
setTimeout(f, 10000);