Improved AmtHashes command in MeshCMD.
Ylian Saint-Hilaire committed
Jun 30, 2022 at 12:46 UTC
81e18fac59c5c2f55ec77b5fcc563c957ab490d1
4 files changed
+141
-20
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/meshcmd.js
+127
-18
@@ -157,6 +157,8 @@ function run(argv) {
157
if ((typeof args.uuidoutput) == 'string' || args.uuidoutput) { settings.uuidoutput = args.uuidoutput; }
158
if ((typeof args.desc) == 'string') { settings.desc = args.desc; }
159
if ((typeof args.dnssuffix) == 'string') { settings.dnssuffix = args.dnssuffix; }
160
+ if ((typeof args.create) == 'string') { settings.create = args.create; }
161
+ if ((typeof args.delete) == 'string') { settings.delete = args.delete; }
162
if (args.bindany) { settings.bindany = true; }
163
if (args.emailtoken) { settings.emailtoken = true; }
164
if (args.smstoken) { settings.smstoken = true; }
@@ -238,8 +240,12 @@ function run(argv) {
240
console.log('\r\nPossible arguments:\r\n');
241
console.log(' --json Display all Intel AMT state in JSON format.');
242
} else if (action == 'amthashes') {
241
- console.log('Amthashes will display all trusted activations hashes for Intel AMT on this computer. The command must be run on a computer with Intel AMT, must run as administrator and the Intel management driver must be installed. These certificates hashes are used by Intel AMT when performing activation into ACM mode. Example usage:\r\n\r\n meshcmd amthashes');
243
+ console.log('Amthashes will display all trusted activations hashes for Intel AMT. If the host is not specified, the hashes are read using the local MEI driver is used. These certificates hashes are used by Intel AMT when performing activation into ACM mode. Example usage:\r\n\r\n meshcmd amthashes');
244
console.log('\r\nPossible arguments:\r\n');
245
+ console.log(' --host [hostname] The IP address or DNS name of Intel AMT, 127.0.0.1 is default.');
246
+ console.log(' --user [username] The Intel AMT login username, admin is default.');
247
+ console.log(' --pass [password] The Intel AMT login password.');
248
+ console.log(' --tls Specifies that TLS must be used.');
249
console.log(' --json Display all Intel AMT hashes in JSON format.');
250
} else if ((action == 'microlms') || (action == 'lms') || (action == 'amtlms')) {
251
console.log('Starts MicroLMS on this computer, allowing local access to Intel AMT on TCP ports 16992 and 16993 when applicable. The command must be run on a computer with Intel AMT, must run as administrator and the Intel management driver must be installed. These certificates hashes are used by Intel AMT when performing activation into ACM mode. Example usage:\r\n\r\n meshcmd microlms');
@@ -528,23 +534,28 @@ function run(argv) {
534
return;
535
});
536
} else if (settings.action == 'amthashes') {
531
- // Display Intel AMT list of trusted hashes
532
- var amtMeiModule, amtMei, amtHashes = [];
533
- try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { console.log(ex); exit(1); return; }
534
- amtMei.on('error', function (e) { console.log('amthashes error: ' + e); exit(1); return; });
535
- amtMei.getHashHandles(function (handles) {
536
- exitOnCount = handles.length;
537
- for (var i = 0; i < handles.length; ++i) {
538
- this.getCertHashEntry(handles[i], function (result) {
539
- var certState = [];
540
- if (result.isDefault) { certState.push('Default'); }
541
- if (result.isActive) { certState.push('Active'); } else { certState.push('Disabled'); }
542
- amtHashes.push(result);
543
- if (!args.json) { console.log(result.name + ', (' + certState.join(', ') + ')\r\n ' + result.hashAlgorithmStr + ': ' + result.certificateHash); }
544
- if (--exitOnCount == 0) { if (args.json) { console.log(JSON.stringify(amtHashes, null, 2)); } exit(0); }
545
- });
546
- }
547
- });
537
+ if (settings.hostname == null) {
538
+ // Display Intel AMT list of trusted hashes from the MEI driver
539
+ var amtMeiModule, amtMei, amtHashes = [];
540
+ try { amtMeiModule = require('amt-mei'); amtMei = new amtMeiModule(); } catch (ex) { console.log(ex); exit(1); return; }
541
+ amtMei.on('error', function (e) { console.log('amthashes error: ' + e); exit(1); return; });
542
+ amtMei.getHashHandles(function (handles) {
543
+ exitOnCount = handles.length;
544
+ for (var i = 0; i < handles.length; ++i) {
545
+ this.getCertHashEntry(handles[i], function (result) {
546
+ var certState = [];
547
+ if (result.isDefault) { certState.push('Default'); }
548
+ if (result.isActive) { certState.push('Active'); } else { certState.push('Disabled'); }
549
+ amtHashes.push(result);
550
+ if (!args.json) { console.log(result.name + ', (' + certState.join(', ') + ')\r\n ' + result.hashAlgorithmStr + ': ' + result.certificateHash); }
551
+ if (--exitOnCount == 0) { if (args.json) { console.log(JSON.stringify(amtHashes, null, 2)); } exit(0); }
552
+ });
553
+ }
554
+ });
555
+ } else {
556
+ // We are going to use WSMAN to perform hash operations
557
+ performAmtTrustedHashes();
558
+ }
559
} else if (settings.action == 'netinfo') {
560
// Display network information
561
var interfaces = require('os').networkInterfaces();
@@ -872,6 +883,104 @@ function run(argv) {
883
}
884
}
885
886
+
887
+//
888
+// Intel AMT Trusted Hashes
889
+//
890
+
891
+function performAmtTrustedHashes() {
892
+ // Check the settings
893
+ if ((settings.password == null) || (typeof settings.password != 'string') || (settings.password == '')) { console.log('No or invalid \"password\" specified, use --password [password].'); exit(1); return; }
894
+ if ((settings.hostname == null) || (typeof settings.hostname != 'string') || (settings.hostname == '')) { settings.hostname = '127.0.0.1'; }
895
+ if ((settings.username == null) || (typeof settings.username != 'string') || (settings.username == '')) { settings.username = 'admin'; }
896
+ if ((typeof settings.create == 'string')) {
897
+ if ((settings.name == null) || (typeof settings.name != 'string') || (settings.name == '')) { console.log('No or invalid \"name\" specified, use --name [name].'); exit(1); return; }
898
+ if ((settings.create.length != 32) && (settings.create.length != 40) && (settings.create.length != 64) && (settings.create.length != 96)) { console.log('No or invalid \"create\" hash, must be in HEX format of length 30, 40, 64, 96.'); exit(1); return; }
899
+ if (Buffer.from(settings.create, 'hex').toString('hex') != settings.create.toUpperCase()) { console.log('No or invalid \"create\" specified, must be in HEX format.'); exit(1); return; }
900
+ settings.create = Buffer.from(settings.create, 'hex').toString('hex');
901
+ }
902
+ if ((typeof settings.delete == 'string')) {
903
+ if ((settings.delete.length != 32) && (settings.delete.length != 40) && (settings.delete.length != 64) && (settings.delete.length != 96)) { console.log('No or invalid \"delete\" hash, must be in HEX format of length 30, 40, 64, 96.'); exit(1); return; }
904
+ if (Buffer.from(settings.delete, 'hex').toString('hex') != settings.delete.toUpperCase()) { console.log('No or invalid \"delete\" specified, must be in HEX format.'); exit(1); return; }
905
+ settings.delete = Buffer.from(settings.delete, 'hex').toString('hex');
906
+ }
907
+
908
+ // See if MicroLMS needs to be started
909
+ if ((settings.hostname == '127.0.0.1') || (settings.hostname.toLowerCase() == 'localhost')) {
910
+ settings.noconsole = true; startLms(performAmtTrustedHashesEx);
911
+ } else {
912
+ performAmtTrustedHashesEx();
913
+ }
914
+}
915
+
916
+function performAmtTrustedHashesEx(x) {
917
+ var transport = require('amt-wsman-duk');
918
+ var wsman = require('amt-wsman');
919
+ var amt = require('amt');
920
+ wsstack = new wsman(transport, settings.hostname, settings.tls ? 16993 : 16992, settings.username, settings.password, settings.tls);
921
+ amtstack = new amt(wsstack);
922
+ amtstack.BatchEnum(null, ['AMT_ProvisioningCertificateHash'], performAmtTrustedHashesEx2);
923
+}
924
+
925
+function performAmtTrustedHashesEx2(stack, name, responses, status) {
926
+ if (status != 200) {
927
+ console.log('Unable to get trusted hashes, status = ' + status + '.');
928
+ } else {
929
+ var r = responses['AMT_ProvisioningCertificateHash'].responses;
930
+ if (settings.create) {
931
+ // Create a new hash entry
932
+ var instanceId = null;
933
+ for (var i in r) { if (Buffer.from(r[i]['HashData'], 'base64').toString('hex') == settings.create) { instanceId = r[i]['InstanceID']; } }
934
+ if (instanceId != null) { console.log('This trusted hash is already present.'); exit(1); return; }
935
+
936
+ // Setup hash type
937
+ var hashtype = -1;
938
+ var hash = Buffer.from(settings.create, 'hex');
939
+ if (hash.length == 16) { hashtype = 0; } // MD5
940
+ if (hash.length == 20) { hashtype = 1; } // SHA1
941
+ if (hash.length == 32) { hashtype = 2; } // SHA256
942
+ if (hash.length == 48) { hashtype = 3; } // SHA384
943
+ if (hashtype == -1) { console.log('Invalid hash type', hash.length); exit(1); return; }
944
+
945
+ // Setup object instance
946
+ var instance = { "Description": settings.name, "Enabled": true, "HashData": hash.toString('base64'), "HashType": hashtype, "IsDefault": false, "InstanceID": '' };
947
+
948
+ // Perform WSMAN "CREATE" operation.
949
+ amtstack.Create('AMT_ProvisioningCertificateHash', instance, function (stack, name, response, status) {
950
+ if (status != 200) { console.log('ERROR: Failed to create trusted hash.', status, JSON.stringify(response, null, 2)); } else { console.log('Done.'); }
951
+ exit(0);
952
+ });
953
+ return;
954
+ } else if (settings.delete) {
955
+ // Delete a hash entry
956
+ var instance = null;
957
+ for (var i in r) { if (Buffer.from(r[i]['HashData'], 'base64').toString('hex') == settings.delete) { instance = r[i]; } }
958
+ if (instance == null) { console.log('This trusted hash not present.'); exit(1); return; }
959
+
960
+ // Perform WSMAN "DELETE" operation.
961
+ amtstack.Delete('AMT_ProvisioningCertificateHash', instance, function (stack, name, response, status) {
962
+ if (status != 200) { console.log('ERROR: Failed to delete trusted hash.', status, JSON.stringify(response, null, 2)); } else { console.log('Done.'); }
963
+ exit(0);
964
+ });
965
+ return;
966
+ } else if (settings.json) {
967
+ // List the hashes in JSON format
968
+ console.log(JSON.stringify(r, null, 2));
969
+ } else {
970
+ // List the hashes
971
+ for (var i in r) {
972
+ var certState = [];
973
+ var hashTypes = ['MD5', 'SHA1', 'SHA256', 'SHA384'];
974
+ if (r[i]['IsDefault']) { certState.push('Default'); }
975
+ if (r[i]['Enabled']) { certState.push('Active'); } else { certState.push('Disabled'); }
976
+ console.log(r[i]['Description'] + ', (' + certState.join(', ') + ')\r\n ' + hashTypes[r[i]['HashType']] + ': ' + Buffer.from(r[i]['HashData'], 'base64').toString('hex'));
977
+ }
978
+ }
979
+ exit(0);
980
+ }
981
+}
982
+
983
+
984
//
985
// Intel AMT Agent Presence
986
//
package.json
+14
-2
@@ -37,21 +37,33 @@
37
"sample-config-advanced.json"
38
],
39
"dependencies": {
40
+ "@yetzt/nedb": "^1.8.0",
41
"archiver": "^5.3.1",
42
"body-parser": "^1.19.0",
43
"cbor": "~5.2.0",
44
"compression": "^1.7.4",
45
"cookie-session": "^1.4.0",
46
+ "esprima": "^4.0.1",
47
"express": "^4.17.0",
48
"express-handlebars": "^5.3.5",
49
"express-ws": "^4.0.0",
50
+ "html-minifier": "^4.0.0",
51
+ "image-size": "^1.0.1",
52
"ipcheck": "^0.1.0",
53
+ "jsdom": "^20.0.0",
54
+ "loadavg-windows": "^1.1.1",
55
+ "minify-js": "0.0.4",
56
"minimist": "^1.2.5",
57
"multiparty": "^4.2.1",
51
- "@yetzt/nedb": "^1.8.0",
58
"node-forge": "^1.0.0",
59
+ "node-windows": "^0.1.4",
60
+ "otplib": "^10.2.3",
61
+ "pg": "^8.7.1",
62
+ "pgtools": "^0.3.2",
63
+ "web-push": "^3.5.0",
64
"ws": "^5.2.3",
54
- "yauzl": "^2.10.0"
65
+ "yauzl": "^2.10.0",
66
+ "yubikeyotp": "^0.2.0"
67
},
68
"engines": {
69
"node": ">=10.0.0"