MyFavMirrors
/
MeshCentral
mirror of https://github.com/Ylianst/MeshCentral.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added code to create Intel AMT setup.bin file.

This commit is contained in:
Ylian Saint-Hilaire 2020-10-26 20:39:04 -07:00
parent d112e6bf6e
commit 6c4069e635
4 changed files with 366 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
MeshCentralServer.njsproj
View File

@ -97,6 +97,7 @@
<Compile Include="amt\amt-ider-module.js" />
<Compile Include="amt\amt-ider.js" />
<Compile Include="amt\amt-redir-mesh.js" />
<Compile Include="amt\amt-setupbin.js" />
<Compile Include="amt\amt-wsman-comm.js" />
<Compile Include="amt\amt-wsman.js" />
<Compile Include="amt\amt-xml.js" />

302
amt/amt-setupbin.js Normal file
View File

@ -0,0 +1,302 @@
/*
Copyright 2020 Intel Corporation
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
/**
* @description Intel(R) AMT Setup.bin Parser
* @author Ylian Saint-Hilaire
* @version v0.1.0
*/
var CreateAmtSetupBinStack = function () {
var o = {};
// Intel(R) AMT Setup.bin GUID's
var AmtSetupBinSetupGuids = [
'\xb5\x16\xfb\x71\x87\xcb\xf9\x4a\xb4\x41\xca\x7b\x38\x35\x78\xf9', // Version 1
'\x96\xb2\x81\x58\xcf\x6b\x72\x4c\x8b\x91\xa1\x5e\x51\x2e\x99\xc4', // Version 2
'\xa7\xf7\xf6\xc6\x89\xc4\xf6\x47\x93\xed\xe2\xe5\x02\x0d\xa5\x1d', // Version 3
'\xaa\xa9\x34\x52\xe1\x29\xa9\x44\x8d\x4d\x08\x1c\x07\xb9\x63\x53' // Version 4
];
// Notes about version 2 of setup.bin:
// - Default "admin" must be followed by a new MEBx password
// - ME_VARIABLE_IDENTIFIER_MANAGEABILITY_FEATURE_SELECTION may not appear after any CM settings
// - CM_VARIABLE_IDENTIFIER_USER_DEFINED_CERT_ADD must be preceded by setting CM_VARIABLE_IDENTIFIER_USER_DEFINED_CERTS_CONFIG to (TODO!)
// General notes:
// - Setup.bin should always start with "CurrentMEBx Pwd", "newMebx Pwd", "manageability selection" (if present).
// Intel(R) AMT variable identifiers
// Type: 0 = Binar Stringy, 1 = Char, 2 = Short, 3 = Int
var AmtSetupBinVarIds =
{
1: {
1: [0, "Current MEBx Password"],
2: [0, "New MEBx Password"],
3: [1, "Manageability Feature Selection",
{ 0: "None", 1: "Intel AMT" }],
4: [1, "Firmware Local Update", // 0 = Disabled, 1 = Enabled, 2 = Password Protected
{ 0: "Disabled", 1: "Enabled", 2: "Password Protected" }],
5: [1, "Firmware Update Qualifier", // 0 = Always, 1 = Never, 2 = Restricted
{ 0: "Always", 1: "Never", 2: "Restricted" }],
6: [4, "Power Package"] // GUID Length (16 bytes), Intel AMT version 2.1, 3 and 4
},
2: {
1: [0, "Provisioning Preshared Key ID (PID)"],
2: [0, "Provisioning Preshared Key (PPS)"],
3: [0, "PKI DNS Suffix"], // 255 bytes max length
4: [0, "Configuration Server FQDN"], // 255 bytes max length
5: [1, "Remote Configuration Enabled (RCFG)", // 0 = Off, 1 = On
{ 0: "Off", 1: "On" }],
6: [1, "Pre-Installed Certificates Enabled", // 0 = Off, 1 = On
{ 0: "Off", 1: "On" }],
7: [1, "User Defined Certificate Configuration", // 0 = Disabled, 1 = Enabled, 2 = Delete
{ 0: "Disabled", 1: "Enabled", 2: "Delete" }],
8: [0, "User Defined Certificate Addition"], // 1 byte hash algo, 20 to 48 bytes hash, 1 byte name length, up to 32 bytes friendly name, 1 = SHA1 (20 bytes), 2 = SHA256 (32 bytes), 3 = SHA384 (48 bytes). Algo 2 & 3 are for version 3 and up.
10: [1, "SOL/IDER Redirection Configuration", {
0: "None", 1: "SOL only - User/Pass Disabled", 2: "IDER only - User/Pass Disabled", 3: "SOL+IDER - User/Pass Disabled",
4: "None - User/Pass Enabled", 5: "SOL only - User/Pass Enabled", 6: "IDER only - User/Pass Enabled", 7: "SOL+IDER - User/Pass Enabled"
}],
11: [0, "Hostname"], // 63 bytes max length
12: [0, "Domain Name"], // 255 bytes max length
13: [1, "DHCP", { 1: "Disabled", 2: "Enabled" }],
14: [1, "Secure Firmware Update (SFWU)", // 0 = Disabled, 1 = Enabled
{ 0: "Disabled", 1: "Enabled" }],
15: [0, "ITO"],
16: [1, "Provisioning Mode (PM)", // 1 = Enterprise, 2 = Small Buisness (SMB)
{ 0: "Enterprise", 1: "Small Buisness" }],
17: [0, "Provisioning Server Address"],
18: [2, "Provision Server Port Number (PSPO)"],
19: [0, "Static IPv4 Parameters"],
20: [0, "VLAN"],
21: [0, "PASS Policy Flag"],
22: [0, "IPv6"], // Length is 204 bytes old format, 84 bytes new format, Version 3+ only
23: [1, "Shared/Dedicated FQDN", // 0 = Dedicated, 1 = Shared. This option is valid only if configuring the hostname as well
{ 0: "Dedicated", 1: "Shared" }],
24: [1, "Dynamic DNS Update", // 0 = Disabled, 1 = Enabled
{ 0: "Disabled", 1: "Enabled" }],
25: [1, "Remote Desktop (KVM) State", // 0 = Disabled, 1 = Enabled
{ 0: "Disabled", 1: "Enabled" }],
26: [1, "Opt-in User Consent Option", // 0 = Disabled, 1 = KVM, 0xFF = ALL
{ 0: "Disabled", 1: "KVM", 255: "All" }],
27: [1, "Opt-in Remote IT Consent Policy", // 0 = Disabled, 1 = Enabled. Allows user consent to be configured remotely.
{ 0: "Disabled", 1: "Enabled" }],
28: [1, "ME Provision Halt Active", // 0 = Stop, 1 = Start. The "ME provisioning Halt/Activate" command must appear in the file only after "PKIDNSSuffix", "ConfigServerFQDN" and "Provisioning Server Address"
{ 0: "Stop", 1: "Start" }],
29: [1, "Manual Setup and Configuration", // 0 = Automated, 1 = Manual
{ 0: "Automated", 1: "Manual" }],
30: [3, "Support Channel Identifier"], // 4 bytes length. Support channel identifier (valid values: 1-65535)
31: [0, "Support Channel Description"], // 60 bytes max. Friendly name used to describe the party representedby the support channel identifier.
32: [0, "Service Account Number"], // 32 bytes max. Unique string identifier given to the end user by the service provider.
33: [0, "Enrollement Passcode"], // 32 bytes max
34: [3, "Service Type"], // 4 bytes length. 1 = Reactive, 2 = Proactive, 4 = One Time Session
35: [0, "Service Provider Identifier"] // GUID Length (16 bytes)
}
}
// Parse the Setup.bin file
o.AmtSetupBinCreate = function (version, flags) {
var obj = {};
obj.fileType = version;
obj.recordChunkCount = 1; // TODO
obj.recordHeaderByteCount = 46;
obj.recordNumber = 0;
obj.majorVersion = version;
obj.minorVersion = 0;
obj.flags = flags;
obj.dataRecordsConsumed = 0;
obj.dataRecordChunkCount = 1; // TODO
obj.records = [];
return obj;
}
// Parse the Setup.bin file
o.AmtSetupBinDecode = function (file) {
// Format of the setup file header:
// FileTypeUUID(16) - uniquely identifies the file type. This identifier will remain valid and constant across all versions of the file type.
// RecordChunkCount(2) - indicates the number of 512-byte chunks occupied by this record, including all header, body, and reserved fields.
// RecordHeaderBytes(2) - indicates the length of the record header in bytes.
// RecordNumber(4) - uniquely identifies the record among all records in the file. The field contains a non-negative ordinal value. The value of this field is always zero in the Local Provisioning File Header Record.
// MajorVersion(1) - identifies the major version of the file format specification. This is a positive integer that is greater than or equal to 1. The Major Version number is incremented to indicate that changes have been introduced that will cause code written against a lower Major Version number to fail.
// MinorVersion(1) - identifies the minor version of the file format specification. This is an integer that is greater than or equal to 0. The Minor Version number is incremented to indicate that changes have been introduced that will not cause code written against the same Major Version and a lower Minor Version number to fail. The purpose of this behavior is to allow a single local provisioning file to be used for multiple generations of Intel® AMT platform.
// DataRecordCount(4) - indicates the total number of data records written in the file when it was created.
// DataRecordsConsumed(4) - is a counter value that begins at 0 and is incremented by 1 by each platform BIOS when it consumes a data record from the file. This value is used to determine the offset of the next data record in the file.
// DataRecordChunkCount(2) - contains the number of 512-byte chunks in each data record. All data records are the same length.
// ModuleList - contains a list of module identifiers. A module’s identifier appears in the list if and only if the data records contain entries for that module. Each module identifier is two bytes in length. The list is terminated by an identifier value of 0.
var obj = {}, UUID = file.substring(0, 16);
obj.fileType = 0;
for (var i in AmtSetupBinSetupGuids) { if (UUID == AmtSetupBinSetupGuids[i]) obj.fileType = (+i + 1); }
if (obj.fileType == 0) return; // Bad header
obj.recordChunkCount = ReadShortX(file, 16);
obj.recordHeaderByteCount = ReadShortX(file, 18);
obj.recordNumber = ReadIntX(file, 20);
obj.majorVersion = file.charCodeAt(24);
obj.minorVersion = file.charCodeAt(25);
obj.flags = ReadShortX(file, 26); // Flags: 1 = Do not consume records
var dataRecordCount = ReadIntX(file, 28);
obj.dataRecordsConsumed = ReadIntX(file, 32);
obj.dataRecordChunkCount = ReadShortX(file, 36);
obj.records = [];
var ptr = 512;
while (ptr + 512 <= file.length) {
// Format of a data record header:
// RecordTypeIdentifier(4) - identifies the type of record (in this case a data record). Record Identifiers: Invalid - 0, Data Record - 1
// RecordFlags(4) - contains a set of bit flags that characterize the record.
// RecordChunkCount(2) - contains the number of 512-byte chunks occupied by the record including all header, body, and reserved fields.
// RecordHeaderByteCount(2) - indicates the length of the record header in bytes.
// RecordNumber(4) - uniquely identifies the record among all records in the file, including invalid as well as valid records. The identifier is a non-negative integer.
var r = {};
r.typeIdentifier = ReadIntX(file, ptr);
r.flags = ReadIntX(file, ptr + 4); // Flags: 1 = Valid, 2 = Scrambled
r.chunkCount = ReadShortX(file, ptr + 8);
r.headerByteCount = ReadShortX(file, ptr + 10);
r.number = ReadIntX(file, ptr + 12);
r.variables = [];
var ptr2 = 0, recbin = file.substring(ptr + 24, ptr + 512);
if ((r.flags & 2) != 0) { recbin = AmtSetupBinDescrambleRecordData(recbin); } // De-Scramble the record
while (1) {
// Format of a data record entry:
// ModuleIdentifier(2) - identifies the target ME module for the entry.
// VariableIdentifier(2) - an enumeration value that identifies the variable. Variable identifiers are unique to each ModuleIdentifier.
// VariableLength(2) - is the length of the variable value in bytes.
// VariableValue - is the value to be assigned to the variable.
var v = {};
v.moduleid = ReadShortX(recbin, ptr2);
v.varid = ReadShortX(recbin, ptr2 + 2);
if (v.moduleid == 0 || v.varid == 0) break;
if (AmtSetupBinVarIds[v.moduleid][v.varid]) {
v.length = ReadShortX(recbin, ptr2 + 4);
v.type = AmtSetupBinVarIds[v.moduleid][v.varid][0];
v.desc = AmtSetupBinVarIds[v.moduleid][v.varid][1];
v.value = recbin.substring(ptr2 + 8, ptr2 + 8 + v.length);
if (v.type == 1 && v.length == 1) v.value = v.value.charCodeAt(0); // 1 byte number
else if (v.type == 2 && v.length == 2) v.value = ReadShortX(v.value, 0); // 2 byte number
else if (v.type == 3 && v.length == 4) v.value = ReadIntX(v.value, 0); // 4 byte number
else if (v.type == 4) v.value = guidToStr(rstr2hex(v.value)); // GUID
r.variables.push(v);
}
ptr2 += (8 + (Math.floor((v.length + 3) / 4) * 4));
}
// Sort the variables
r.variables.sort(AmtSetupBinVariableCompare);
obj.records.push(r);
ptr += 512;
}
if (dataRecordCount != obj.records.length) return; // Mismatch record count
return obj;
}
// Construct a Setup.bin file
o.AmtSetupBinEncode = function (obj) {
if (obj.fileType < 1 && obj.fileType > AmtSetupBinSetupGuids.length) return null;
var out = [], r = AmtSetupBinSetupGuids[obj.fileType - 1], reccount = 0;
r += ShortToStrX(obj.recordChunkCount);
r += ShortToStrX(obj.recordHeaderByteCount);
r += IntToStrX(obj.recordNumber);
r += String.fromCharCode(obj.majorVersion, obj.minorVersion);
r += ShortToStrX(obj.flags); // Flags: 1 = Do not consume records
r += IntToStrX(obj.records.length);
r += IntToStrX(obj.dataRecordsConsumed);
r += ShortToStrX(obj.dataRecordChunkCount);
while (r.length < 512) { r += '\0'; } // Pad the header
out.push(r);
// Write each record
for (var i in obj.records) {
var r2 = '', rec = obj.records[i];
r2 += IntToStrX(rec.typeIdentifier);
r2 += IntToStrX(rec.flags);
r2 += IntToStrX(0); // Reserved
r2 += IntToStrX(0); // Reserved
r2 += ShortToStrX(1); // rec.chunkCount
r2 += ShortToStrX(24); // rec.headerByteCount
r2 += IntToStrX(++reccount);
// Sort the variables
rec.variables.sort(AmtSetupBinVariableCompare);
/*
// Change variable priority
AmtSetupBinMoveToTop(r.variables, 1, 3); // Manageability Feature Selection
AmtSetupBinMoveToTop(r.variables, 1, 2); // New MEBx password
AmtSetupBinMoveToTop(r.variables, 1, 1); // Current MEBx password
*/
// Write each variable
for (var j in rec.variables) {
var r3 = '', v = rec.variables[j], data = v.value;
v.type = AmtSetupBinVarIds[v.moduleid][v.varid][0]; // Set the correct type if not alreay connect
if ((v.type > 0) && (v.type < 4)) { // If this is a numeric value, encode it correctly
data = parseInt(data);
if (v.type == 1) data = String.fromCharCode(data);
if (v.type == 2) data = ShortToStrX(data);
if (v.type == 3) data = IntToStrX(data);
}
if (v.type == 4) { data = hex2rstr(guidToStr(data.split('-').join('')).split('-').join('')); }
r3 += ShortToStrX(v.moduleid); // Module Identifier
r3 += ShortToStrX(v.varid); // Variable Identifier
r3 += ShortToStrX(data.length); // Variable Length
r3 += ShortToStrX(0); // Reserved
r3 += data; // Variable Data
while (r3.length % 4 != 0) { r3 += '\0'; } // Pad the variable
r2 += r3;
}
while (r2.length < 512) { r2 += '\0'; } // Pad the record
if ((rec.flags & 2) != 0) { r2 = r2.substring(0, 24) + AmtSetupBinScrambleRecordData(r2.substring(24)); } // Scramble the record starting at byte 24, after the header
out.push(r2);
}
return out.join('');
}
// Used to sort variables
function AmtSetupBinVariableCompare(a, b) {
if (a.moduleid > b.moduleid) return 1;
if (a.moduleid < b.moduleid) return -1;
if (a.varid > b.varid) return 1;
if (a.varid < b.varid) return -1;
return 0;
}
// Scramble and un-scramble records
function AmtSetupBinScrambleRecordData(data) { var out = ''; for (var i = 0; i < data.length; i++) { out += String.fromCharCode((data.charCodeAt(i) + 17) & 0xFF); } return out; }
function AmtSetupBinDescrambleRecordData(data) { var out = ''; for (var i = 0; i < data.length; i++) { out += String.fromCharCode((data.charCodeAt(i) + 0xEF) & 0xFF); } return out; }
// Find a moduleid/varid in the variable list, if found, move it to the top
//function AmtSetupBinMoveToTop(variables, moduleid, varid) { var i = -1; for (var j in variables) { if ((variables[j].moduleid == moduleid) && (variables[j].varid == varid)) { i = j; } } if (i > 1) { ArrayElementMove(variables, i, 0); } }
function ShortToStrX(v) { return String.fromCharCode(v & 0xFF, (v >> 8) & 0xFF); };
function IntToStrX(v) { return String.fromCharCode(v & 0xFF, (v >> 8) & 0xFF, (v >> 16) & 0xFF, (v >> 24) & 0xFF); };
function ReadShortX(v, p) { return (v.charCodeAt(p + 1) << 8) + v.charCodeAt(p); };
function ReadIntX(v, p) { return (v.charCodeAt(p + 3) * 0x1000000) + (v.charCodeAt(p + 2) << 16) + (v.charCodeAt(p + 1) << 8) + v.charCodeAt(p); };
return o;
};
module.exports = CreateAmtSetupBinStack;

64
certoperations.js
View File

@ -164,7 +164,7 @@ module.exports.CertificateOperations = function (parent) {
acmconfig.certs = orderedCerts;
acmconfig.key = obj.pki.privateKeyToPem(r.keys[0]);
acmCerts.push(acmconfig);
acmmatch.push({ 'sha256': acmconfig.sha256, 'sha1': acmconfig.sha1, 'cn': acmconfig.cn });
acmmatch.push({ sha256: acmconfig.sha256, sha1: acmconfig.sha1, cn: acmconfig.cn });
}
}
amtacmactivation.acmmatch = acmmatch;
@ -180,8 +180,68 @@ module.exports.CertificateOperations = function (parent) {
amtacmactivation.acmmatch.push({ 'sha256': sha256, 'sha1': sha1, 'cn': '*' });
}
}
}
//console.log(amtacmactivation);
// Get the setup.bin file
obj.GetSetupBinFile = function (amtacmactivation, oldmebxpass, newmebxpass) {
// Create a setup.bin file for our own root cert
// Get the wiadcard certificate hash
var wildcardCertSha256 = null;
for (var i = 0; i < amtacmactivation.acmmatch.length; i++) { if (amtacmactivation.acmmatch[i].cn == '*') { wildcardCertSha256 = amtacmactivation.acmmatch[i].sha256; } }
// Create the Setup.bin stack
const AmtSetupBinStack = require('./amt/amt-setupbin')();
var setupbin = AmtSetupBinStack.AmtSetupBinCreate(3, 1); // Version 3, 1 = Records will not be consumed.
var certRootName = 'MeshCentral';
// Create a new record
var r = {};
r.typeIdentifier = 1;
r.flags = 1; // Valid, unscrambled record.
r.chunkCount = 0;
r.headerByteCount = 0;
r.number = 0;
r.variables = [];
setupbin.records.push(r);
// Create "Current MEBx Password" variable
var v = {};
v.moduleid = 1;
v.varid = 1;
v.length = -1;
v.value = oldmebxpass;
setupbin.records[0].variables.push(v);
// Create "New MEBx Password" variable
v = {};
v.moduleid = 1;
v.varid = 2;
v.length = -1;
v.value = newmebxpass;
setupbin.records[0].variables.push(v);
// Create "User Defined Certificate Addition" variable
v = {};
v.moduleid = 2;
v.varid = 8;
v.length = -1;
v.value = String.fromCharCode(2) + Buffer.from(wildcardCertSha256, 'hex').toString('binary') + String.fromCharCode(certRootName.length) + certRootName; // 2 = SHA256 hash type
setupbin.records[0].variables.push(v);
// Create "PKI DNS Suffix" variable
v = {};
v.moduleid = 2;
v.varid = 3;
v.length = -1;
v.value = 'meshcentral.com';
setupbin.records[0].variables.push(v);
return AmtSetupBinStack.AmtSetupBinEncode(setupbin);
// Write the setup.bin file
//var bin = AmtSetupBinStack.AmtSetupBinEncode(setupbin);
//obj.fs.writeFileSync('c:\\temp\\setup.bin', bin, 'binary');
}
// Return the certificate of the remote HTTPS server

2
views/default.handlebars
View File

@ -8570,7 +8570,7 @@
if (node.intelamt != null) {
var x = '';
x += addDetailItem("Version", (node.intelamt.ver)?('v' + EscapeHtml(node.intelamt.ver)):('<i>' + "Unknown" + '</i>'), s);
var provisioningStates = { 0: nobreak("Not Activated (Pre)"), 1: nobreak("Not Activated (In)"), 2: nobreak("Activated") };
var provisioningStates = { 0: nobreak("Not Activated"), 1: nobreak("Pre-activation"), 2: nobreak("Activated") };
var provisioningMode = '';
if ((node.intelamt.state == 2) && node.intelamt.flags) { if (node.intelamt.flags & 2) { provisioningMode = (', ' + "Client Control Mode (CCM)"); } else if (node.intelamt.flags & 4) { provisioningMode = (', ' + "Admin Control Mode (ACM)"); } }
x += addDetailItem("Provisioning State", ((node.intelamt.state)?(provisioningStates[node.intelamt.state]):('<i>' + "Unknown" + '</i>')) + provisioningMode, s);