Fixed MeshCMD audit log and added AmtEventLog command
Ylian Saint-Hilaire committed
Jul 15, 2019 at 15:44 UTC
f4d5d3aba25533869589faeda78a2347f465d9eb
5 files changed
+155
-13
agents/MeshCmd-signed.exe
Binary files a/agents/MeshCmd-signed.exe and b/agents/MeshCmd-signed.exe differ
agents/MeshCmd64-signed.exe
Binary files a/agents/MeshCmd64-signed.exe and b/agents/MeshCmd64-signed.exe differ
agents/meshcmd.js
+77
-6
@@ -114,7 +114,7 @@ function run(argv) {
114
//console.log('addedModules = ' + JSON.stringify(addedModules));
115
var actionpath = 'meshaction.txt';
116
if (args.actionfile != null) { actionpath = args.actionfile; }
117
- var actions = ['HELP', 'ROUTE', 'MICROLMS', 'AMTPOWER', 'AMTFEATURES', 'AMTNETWORK', 'AMTLOADWEBAPP', 'AMTLOADSMALLWEBAPP', 'AMTLOADLARGEWEBAPP', 'AMTCLEARWEBAPP', 'AMTSTORAGESTATE', 'AMTINFO', 'AMTINFODEBUG', 'AMTVERSIONS', 'AMTHASHES', 'AMTSAVESTATE', 'AMTSCRIPT', 'AMTUUID', 'AMTCCM', 'AMTACM', 'AMTDEACTIVATE', 'AMTACMDEACTIVATE', 'SMBIOS', 'RAWSMBIOS', 'MESHCOMMANDER', 'AMTAUDITLOG', 'AMTPRESENCE'];
117
+ var actions = ['HELP', 'ROUTE', 'MICROLMS', 'AMTPOWER', 'AMTFEATURES', 'AMTNETWORK', 'AMTLOADWEBAPP', 'AMTLOADSMALLWEBAPP', 'AMTLOADLARGEWEBAPP', 'AMTCLEARWEBAPP', 'AMTSTORAGESTATE', 'AMTINFO', 'AMTINFODEBUG', 'AMTVERSIONS', 'AMTHASHES', 'AMTSAVESTATE', 'AMTSCRIPT', 'AMTUUID', 'AMTCCM', 'AMTACM', 'AMTDEACTIVATE', 'AMTACMDEACTIVATE', 'SMBIOS', 'RAWSMBIOS', 'MESHCOMMANDER', 'AMTAUDITLOG', 'AMTEVENTLOG', 'AMTPRESENCE'];
118
119
// Load the action file
120
var actionfile = null;
@@ -157,6 +157,7 @@ function run(argv) {
157
if (args.noconsole) { settings.noconsole = true; }
158
if (args.nocommander) { settings.noconsole = true; }
159
if (args.lmsdebug) { settings.lmsdebug = true; }
160
+ if (args.json) { settings.json = true; }
161
if (args.tls) { settings.tls = true; }
162
if ((argv.length > 1) && (actions.indexOf(argv[1].toUpperCase()) >= 0)) { settings.action = argv[1]; }
163
@@ -181,6 +182,7 @@ function run(argv) {
182
console.log('\r\nValid local or remote actions:');
183
console.log(' MeshCommander - Launch a local MeshCommander web server.');
184
console.log(' AmtUUID - Show Intel AMT unique identifier.');
185
+ console.log(' AmtEventLog - Show the Intel AMT event log.');
186
console.log(' AmtAuditLog - Show the Intel AMT audit log.');
187
console.log(' AmtLoadWebApp - Load MeshCommander in Intel AMT 11.6+ firmware.');
188
console.log(' AmtClearWebApp - Clear everything from Intel AMT web storage.');
@@ -342,14 +344,24 @@ function run(argv) {
344
console.log(' --localport [port] Local port used for the web server, 3000 is default.');
345
console.log('\r\nRun as a background service:\r\n');
346
console.log(' meshcommander install/uninstall/start/stop.');
347
+ } else if (action == 'amteventlog') {
348
+ console.log('AmtEventLog action will fetch the local or remote event log. Example usage:\r\n\r\n meshcmd amteventlog --host 1.2.3.4 --user admin --pass mypassword --tls --output events.txt');
349
+ console.log('\r\nPossible arguments:\r\n');
350
+ console.log(' --output [filename] The output file for the Intel AMT event log.');
351
+ console.log(' --host [hostname] The IP address or DNS name of Intel AMT, 127.0.0.1 is default.');
352
+ console.log(' --user [username] The Intel AMT login username, admin is default.');
353
+ console.log(' --pass [password] The Intel AMT login password.');
354
+ console.log(' --tls Specifies that TLS must be used.');
355
+ console.log(' --json Output as a JSON format.');
356
} else if (action == 'amtauditlog') {
357
console.log('AmtAuditLog action will fetch the local or remote audit log. If used localy, no username/password is required. Example usage:\r\n\r\n meshcmd amtauditlog --host 1.2.3.4 --user admin --pass mypassword --tls --output audit.json');
358
console.log('\r\nPossible arguments:\r\n');
348
- console.log(' --output [filename] The output file for the Intel AMT state in JSON format.');
359
+ console.log(' --output [filename] The output file for the Intel AMT audit log.');
360
console.log(' --host [hostname] The IP address or DNS name of Intel AMT, 127.0.0.1 is default.');
361
console.log(' --user [username] The Intel AMT login username, admin is default.');
362
console.log(' --pass [password] The Intel AMT login password.');
363
console.log(' --tls Specifies that TLS must be used.');
364
+ console.log(' --json Output as a JSON format.');
365
} else if (action == 'amtider') {
366
console.log('AmtIDER will mount a local disk images to a remote Intel AMT computer. Example usage:\r\n\r\n meshcmd amtider --host 1.2.3.4 --user admin --pass mypassword --tls --floppy disk.img --cdrom disk.iso');
367
console.log('\r\nPossible arguments:\r\n');
@@ -605,6 +617,11 @@ function run(argv) {
617
if ((settings.username == null) || (typeof settings.username != 'string') || (settings.username == '')) { settings.username = 'admin'; }
618
} else { settings.hostname = '127.0.0.1'; }
619
readAmtAuditLog();
620
+ } else if (settings.action == 'amteventlog') { // Read the Intel AMT audit log
621
+ if (settings.hostname == null) { settings.hostname = '127.0.0.1'; }
622
+ if ((settings.password == null) || (typeof settings.password != 'string') || (settings.password == '')) { console.log('No or invalid \"password\" specified, use --password [password].'); exit(1); return; }
623
+ if ((settings.username == null) || (typeof settings.username != 'string') || (settings.username == '')) { settings.username = 'admin'; }
624
+ readAmtEventLog();
625
} else if (settings.action == 'amtider') { // Remote mount IDER image
626
if ((settings.hostname == null) || (typeof settings.hostname != 'string') || (settings.hostname == '')) { console.log('No or invalid \"hostname\" specified, use --hostname [password].'); exit(1); return; }
627
if ((settings.password == null) || (typeof settings.password != 'string') || (settings.password == '')) { console.log('No or invalid \"password\" specified, use --password [password].'); exit(1); return; }
@@ -739,6 +756,52 @@ function performAmtAgentPresenceEx5(stack, name, response, status, watchdog) {
756
}
757
}
758
759
+
760
+//
761
+// Intel AMT Event Log
762
+//
763
+
764
+function readAmtEventLog() {
765
+ // See if MicroLMS needs to be started
766
+ if ((settings.hostname == '127.0.0.1') || (settings.hostname.toLowerCase() == 'localhost')) {
767
+ settings.noconsole = true; startLms(readAmtEventLogEx);
768
+ } else {
769
+ readAmtEventLogEx(9999);
770
+ }
771
+}
772
+
773
+function readAmtEventLogEx(x) {
774
+ if (x == 9999) {
775
+ var transport = require('amt-wsman-duk');
776
+ var wsman = require('amt-wsman');
777
+ var amt = require('amt');
778
+ wsstack = new wsman(transport, settings.hostname, settings.tls ? 16993 : 16992, settings.username, settings.password, settings.tls);
779
+ amtstack = new amt(wsstack);
780
+ amtstack.GetMessageLog(readAmtEventLogEx2);
781
+ } else {
782
+ osamtstack.GetMessageLog(readAmtEventLogEx2);
783
+ }
784
+}
785
+
786
+function readAmtEventLogEx2(stack, messages) {
787
+ if (messages == null) {
788
+ console.log('Unable to get event log.');
789
+ } else {
790
+ var out = '';
791
+ if (settings.json) {
792
+ out = JSON.stringify(messages, 4, ' ');
793
+ } else {
794
+ for (var i in messages) { out += messages[i].Time + ', ' + messages[i].EntityStr + ', ' + messages[i].Desc + '\r\n'; }
795
+ }
796
+ if (settings.output == null) { console.log(out); } else {
797
+ var file = fs.openSync(settings.output, 'w');
798
+ fs.writeSync(file, Buffer.from(out));
799
+ fs.closeSync(file);
800
+ }
801
+ }
802
+ exit(1);
803
+}
804
+
805
//
806
// Intel AMT Audit Log
807
//
@@ -770,11 +833,19 @@ function readAmtAuditLogEx2(stack, response, status) {
833
console.log('Unable to get audit log, status = ' + status + '.');
834
} else {
835
var out = '';
773
- for (var i in response) {
774
- var name = ((response[i].Initiator != '') ? (response[i].Initiator + ': ') : '')
775
- out += (response[i].Time + ' - ' + name + response[i].Event + '\r\n');
836
+ if (settings.json) {
837
+ out = JSON.stringify(response, 4, ' ');
838
+ } else {
839
+ for (var i in response) {
840
+ var name = ((response[i].Initiator != '') ? (response[i].Initiator + ': ') : '')
841
+ out += (response[i].Time + ' - ' + name + response[i].Event + '\r\n');
842
+ }
843
+ }
844
+ if (settings.output == null) { console.log(out); } else {
845
+ var file = fs.openSync(settings.output, 'w');
846
+ fs.writeSync(file, Buffer.from(out));
847
+ fs.closeSync(file);
848
}
777
- if (settings.output == null) { console.log(out); } else { var file = fs.openSync(settings.output, 'w'); fs.writeSync(file, Buffer.from(out, 'utf8')); fs.closeSync(file); }
849
}
850
exit(1);
851
}
agents/meshcmd.min.js
+77
-6
@@ -114,7 +114,7 @@ function run(argv) {
114
//console.log('addedModules = ' + JSON.stringify(addedModules));
115
var actionpath = 'meshaction.txt';
116
if (args.actionfile != null) { actionpath = args.actionfile; }
117
- var actions = ['HELP', 'ROUTE', 'MICROLMS', 'AMTPOWER', 'AMTFEATURES', 'AMTNETWORK', 'AMTLOADWEBAPP', 'AMTLOADSMALLWEBAPP', 'AMTLOADLARGEWEBAPP', 'AMTCLEARWEBAPP', 'AMTSTORAGESTATE', 'AMTINFO', 'AMTINFODEBUG', 'AMTVERSIONS', 'AMTHASHES', 'AMTSAVESTATE', 'AMTSCRIPT', 'AMTUUID', 'AMTCCM', 'AMTACM', 'AMTDEACTIVATE', 'AMTACMDEACTIVATE', 'SMBIOS', 'RAWSMBIOS', 'MESHCOMMANDER', 'AMTAUDITLOG', 'AMTPRESENCE'];
117
+ var actions = ['HELP', 'ROUTE', 'MICROLMS', 'AMTPOWER', 'AMTFEATURES', 'AMTNETWORK', 'AMTLOADWEBAPP', 'AMTLOADSMALLWEBAPP', 'AMTLOADLARGEWEBAPP', 'AMTCLEARWEBAPP', 'AMTSTORAGESTATE', 'AMTINFO', 'AMTINFODEBUG', 'AMTVERSIONS', 'AMTHASHES', 'AMTSAVESTATE', 'AMTSCRIPT', 'AMTUUID', 'AMTCCM', 'AMTACM', 'AMTDEACTIVATE', 'AMTACMDEACTIVATE', 'SMBIOS', 'RAWSMBIOS', 'MESHCOMMANDER', 'AMTAUDITLOG', 'AMTEVENTLOG', 'AMTPRESENCE'];
118
119
// Load the action file
120
var actionfile = null;
@@ -157,6 +157,7 @@ function run(argv) {
157
if (args.noconsole) { settings.noconsole = true; }
158
if (args.nocommander) { settings.noconsole = true; }
159
if (args.lmsdebug) { settings.lmsdebug = true; }
160
+ if (args.json) { settings.json = true; }
161
if (args.tls) { settings.tls = true; }
162
if ((argv.length > 1) && (actions.indexOf(argv[1].toUpperCase()) >= 0)) { settings.action = argv[1]; }
163
@@ -181,6 +182,7 @@ function run(argv) {
182
console.log('\r\nValid local or remote actions:');
183
console.log(' MeshCommander - Launch a local MeshCommander web server.');
184
console.log(' AmtUUID - Show Intel AMT unique identifier.');
185
+ console.log(' AmtEventLog - Show the Intel AMT event log.');
186
console.log(' AmtAuditLog - Show the Intel AMT audit log.');
187
console.log(' AmtLoadWebApp - Load MeshCommander in Intel AMT 11.6+ firmware.');
188
console.log(' AmtClearWebApp - Clear everything from Intel AMT web storage.');
@@ -342,14 +344,24 @@ function run(argv) {
344
console.log(' --localport [port] Local port used for the web server, 3000 is default.');
345
console.log('\r\nRun as a background service:\r\n');
346
console.log(' meshcommander install/uninstall/start/stop.');
347
+ } else if (action == 'amteventlog') {
348
+ console.log('AmtEventLog action will fetch the local or remote event log. Example usage:\r\n\r\n meshcmd amteventlog --host 1.2.3.4 --user admin --pass mypassword --tls --output events.txt');
349
+ console.log('\r\nPossible arguments:\r\n');
350
+ console.log(' --output [filename] The output file for the Intel AMT event log.');
351
+ console.log(' --host [hostname] The IP address or DNS name of Intel AMT, 127.0.0.1 is default.');
352
+ console.log(' --user [username] The Intel AMT login username, admin is default.');
353
+ console.log(' --pass [password] The Intel AMT login password.');
354
+ console.log(' --tls Specifies that TLS must be used.');
355
+ console.log(' --json Output as a JSON format.');
356
} else if (action == 'amtauditlog') {
357
console.log('AmtAuditLog action will fetch the local or remote audit log. If used localy, no username/password is required. Example usage:\r\n\r\n meshcmd amtauditlog --host 1.2.3.4 --user admin --pass mypassword --tls --output audit.json');
358
console.log('\r\nPossible arguments:\r\n');
348
- console.log(' --output [filename] The output file for the Intel AMT state in JSON format.');
359
+ console.log(' --output [filename] The output file for the Intel AMT audit log.');
360
console.log(' --host [hostname] The IP address or DNS name of Intel AMT, 127.0.0.1 is default.');
361
console.log(' --user [username] The Intel AMT login username, admin is default.');
362
console.log(' --pass [password] The Intel AMT login password.');
363
console.log(' --tls Specifies that TLS must be used.');
364
+ console.log(' --json Output as a JSON format.');
365
} else if (action == 'amtider') {
366
console.log('AmtIDER will mount a local disk images to a remote Intel AMT computer. Example usage:\r\n\r\n meshcmd amtider --host 1.2.3.4 --user admin --pass mypassword --tls --floppy disk.img --cdrom disk.iso');
367
console.log('\r\nPossible arguments:\r\n');
@@ -605,6 +617,11 @@ function run(argv) {
617
if ((settings.username == null) || (typeof settings.username != 'string') || (settings.username == '')) { settings.username = 'admin'; }
618
} else { settings.hostname = '127.0.0.1'; }
619
readAmtAuditLog();
620
+ } else if (settings.action == 'amteventlog') { // Read the Intel AMT audit log
621
+ if (settings.hostname == null) { settings.hostname = '127.0.0.1'; }
622
+ if ((settings.password == null) || (typeof settings.password != 'string') || (settings.password == '')) { console.log('No or invalid \"password\" specified, use --password [password].'); exit(1); return; }
623
+ if ((settings.username == null) || (typeof settings.username != 'string') || (settings.username == '')) { settings.username = 'admin'; }
624
+ readAmtEventLog();
625
} else if (settings.action == 'amtider') { // Remote mount IDER image
626
if ((settings.hostname == null) || (typeof settings.hostname != 'string') || (settings.hostname == '')) { console.log('No or invalid \"hostname\" specified, use --hostname [password].'); exit(1); return; }
627
if ((settings.password == null) || (typeof settings.password != 'string') || (settings.password == '')) { console.log('No or invalid \"password\" specified, use --password [password].'); exit(1); return; }
@@ -739,6 +756,52 @@ function performAmtAgentPresenceEx5(stack, name, response, status, watchdog) {
756
}
757
}
758
759
+
760
+//
761
+// Intel AMT Event Log
762
+//
763
+
764
+function readAmtEventLog() {
765
+ // See if MicroLMS needs to be started
766
+ if ((settings.hostname == '127.0.0.1') || (settings.hostname.toLowerCase() == 'localhost')) {
767
+ settings.noconsole = true; startLms(readAmtEventLogEx);
768
+ } else {
769
+ readAmtEventLogEx(9999);
770
+ }
771
+}
772
+
773
+function readAmtEventLogEx(x) {
774
+ if (x == 9999) {
775
+ var transport = require('amt-wsman-duk');
776
+ var wsman = require('amt-wsman');
777
+ var amt = require('amt');
778
+ wsstack = new wsman(transport, settings.hostname, settings.tls ? 16993 : 16992, settings.username, settings.password, settings.tls);
779
+ amtstack = new amt(wsstack);
780
+ amtstack.GetMessageLog(readAmtEventLogEx2);
781
+ } else {
782
+ osamtstack.GetMessageLog(readAmtEventLogEx2);
783
+ }
784
+}
785
+
786
+function readAmtEventLogEx2(stack, messages) {
787
+ if (messages == null) {
788
+ console.log('Unable to get event log.');
789
+ } else {
790
+ var out = '';
791
+ if (settings.json) {
792
+ out = JSON.stringify(messages, 4, ' ');
793
+ } else {
794
+ for (var i in messages) { out += messages[i].Time + ', ' + messages[i].EntityStr + ', ' + messages[i].Desc + '\r\n'; }
795
+ }
796
+ if (settings.output == null) { console.log(out); } else {
797
+ var file = fs.openSync(settings.output, 'w');
798
+ fs.writeSync(file, Buffer.from(out));
799
+ fs.closeSync(file);
800
+ }
801
+ }
802
+ exit(1);
803
+}
804
+
805
//
806
// Intel AMT Audit Log
807
//
@@ -770,11 +833,19 @@ function readAmtAuditLogEx2(stack, response, status) {
833
console.log('Unable to get audit log, status = ' + status + '.');
834
} else {
835
var out = '';
773
- for (var i in response) {
774
- var name = ((response[i].Initiator != '') ? (response[i].Initiator + ': ') : '')
775
- out += (response[i].Time + ' - ' + name + response[i].Event + '\r\n');
836
+ if (settings.json) {
837
+ out = JSON.stringify(response, 4, ' ');
838
+ } else {
839
+ for (var i in response) {
840
+ var name = ((response[i].Initiator != '') ? (response[i].Initiator + ': ') : '')
841
+ out += (response[i].Time + ' - ' + name + response[i].Event + '\r\n');
842
+ }
843
+ }
844
+ if (settings.output == null) { console.log(out); } else {
845
+ var file = fs.openSync(settings.output, 'w');
846
+ fs.writeSync(file, Buffer.from(out));
847
+ fs.closeSync(file);
848
}
777
- if (settings.output == null) { console.log(out); } else { var file = fs.openSync(settings.output, 'w'); fs.writeSync(file, Buffer.from(out, 'utf8')); fs.closeSync(file); }
849
}
850
exit(1);
851
}
package.json
+1
-1
@@ -1,6 +1,6 @@
1
{
2
"name": "meshcentral",
3
- "version": "0.3.7-u",
3
+ "version": "0.3.7-v",
4
"keywords": [
5
"Remote Management",
6
"Intel AMT",