Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
9.8
CVSSv3

CVE-2017-5689

Published: 02/05/2017 Updated: 18/02/2020
CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 1000
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Subscribe to Active Management Technology Firmware

Vulnerability Summary

An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (AMT) and Intel Standard Manageability (ISM). An unprivileged local attacker could provision manageability features gaining unprivileged network or local system privileges on Intel manageability SKUs: Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

intel active management technology firmware 6.1

intel active management technology firmware 6.2

intel active management technology firmware 10.0

intel active management technology firmware 11.0

intel active management technology firmware 6.0

intel active management technology firmware 9.0

intel active management technology firmware 9.1

intel active management technology firmware 9.5

intel active management technology firmware 7.0

intel active management technology firmware 7.1

intel active management technology firmware 11.5

intel active management technology firmware 11.6

intel active management technology firmware 8.0

intel active management technology firmware 8.1

Vendor Advisories

Cisco: Intel Active Management Technology Privilege Escalation Vulnerability
On May 1st, 2017, Intel released a security advisory titled Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Escalation of Privilege, also known as INTEL-SA-00075 The advisory details a vulnerability in the Intel Active Management (AMT), Intel Small Business (ISB), and Intel Standard Manageabili ...
HP: SUPPORT COMMUNICATION- SECURITY BULLETIN HPSBHF03557 rev. 1 - Intel Active Management Technology, Intel Small Business Technology, and Intel Standard Manageability Remote Privilege Escalation
A security vulnerability has been discovered in Intel’s manageability firmware that impacts all Intel OEMs This vulnerability is a security flaw that originated in the development and deployment of Intel's Manageability firmware The vulnerability affects some of HP’s commercial PCs, 2 consumer PCs, workstations, thin clients, and retail poin ...

Exploits

Exploit DB: Intel Active Management Technology - System Privileges
#!/usr/bin/python # -*- coding: utf-8 -*- # Author: Nixawk # CVE-2017-5689 = { # dork="Server: Intel(R) Active Management Technology" port:"16992", # ports=[ # 623, # 664, # 16992, # 16993, # 16994, # 16995 # ] # products=[ # Active Management Technolo ...
Exploit DB: Intel AMT Digest Authentication Bypass Scanner
This module scans for Intel Active Management Technology endpoints and attempts to bypass authentication using a blank HTTP digest (CVE-2017-5689) This service can be found on ports 16992, 16993 (tls), 623, and 624 (tls) ...
Exploit DB: Intel AMT Digest Authentication Bypass Scanner
This module scans for Intel Active Management Technology endpoints and attempts to bypass authentication using a blank HTTP digest (CVE-2017-5689) This service can be found on ports 16992, 16993 (tls), 623, and 624 (tls) ...

Nmap Scripts

http-vuln-cve2017-5689

Detects if a system with Intel Active Management Technology is vulnerable to the INTEL-SA-00075 privilege escalation vulnerability (CVE2017-5689).

nmap -p 16992 --script http-vuln-cve2017-5689 <target>

PORT      STATE SERVICE       REASON
16992/tcp open  amt-soap-http syn-ack
| http-vuln-cve2017-5689:
|   VULNERABLE:
|   Intel Active Management Technology INTEL-SA-00075 Authentication Bypass
|     State: VULNERABLE
|     IDs:  CVE:CVE-2017-5689  BID:98269
|     Risk factor: High  CVSSv2: 10.0 (HIGH) (AV:N/AC:L/AU:N/C:C/I:C/A:C)
|       Intel Active Management Technology is vulnerable to an authentication bypass that
|       can be exploited by performing digest authentication and sending a blank response
|       digest parameter.
|
|     Disclosure date: 2017-05-01
|     References:
|       https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5689
|       https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
|       http://www.securityfocus.com/bid/98269
|       https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
|       https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability
|_      https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability

Metasploit Modules

Intel AMT Digest Authentication Bypass Scanner

This module scans for Intel Active Management Technology endpoints and attempts to bypass authentication using a blank HTTP digest (CVE-2017-5689). This service can be found on ports 16992, 16993 (tls), 623, and 624 (tls).

msf > use auxiliary/scanner/http/intel_amt_digest_bypass
msf auxiliary(intel_amt_digest_bypass) > show actions
    ...actions...
msf auxiliary(intel_amt_digest_bypass) > set ACTION < action-name >
msf auxiliary(intel_amt_digest_bypass) > show options
    ...show and set options...
msf auxiliary(intel_amt_digest_bypass) > run
Intel AMT Digest Authentication Bypass Scanner

This module scans for Intel Active Management Technology endpoints and attempts to bypass authentication using a blank HTTP digest (CVE-2017-5689). This service can be found on ports 16992, 16993 (tls), 623, and 624 (tls).

msf > use auxiliary/scanner/http/intel_amt_digest_bypass
msf auxiliary(intel_amt_digest_bypass) > show actions
    ...actions...
msf auxiliary(intel_amt_digest_bypass) > set ACTION < action-name >
msf auxiliary(intel_amt_digest_bypass) > show options
    ...show and set options...
msf auxiliary(intel_amt_digest_bypass) > run

Github Repositories

https://github.com/aprendeDELOShackers/Dorking

scheat sheet algunas busqueda o comando avanzada para buscar Dork en Google, Github y Shodan

Dorking scheat sheet algunas busqueda o comando avanzada para buscar Dork en Google, Github y Shodan TOOOOOLS importante dorks_hunterpy hecha en python3 python3 dorks_hunterpy -d vulnwebcom -r 2 -o testtxt REVISAR webarchiveorg/cdx/search/cdx?url=googlecom/api/*&amp;output=text&amp;fl=original&amp;collapse=url

https://github.com/hack-parthsharma/ShodanQueries

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/TheWay-hue/CVE-2017-5689-Checker

CVE-2017-5689-Checker This is an automatic checker-exploit for the CVE-2017-5689 vulnerability The vulnerability is related to bypassing authentication in the Intel AMT panel Article: habrcom/ru/post/328232 Our telegramm =&gt; tme/anarchy_squad Shodan dork: port: "16992" intel PS: {Use Sh0dan-Search to colle

https://github.com/merlinepedra25/AWESOME-SHODAN-QUERIES

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/CerberusSecurity/CVE-2017-5689

Detection Script for CVE-2017-5689 Usage: CVE-2017-5689_detectorpy &lt;IP Addr/range&gt; Example: CVE-2017-5689_detectorpy 1921681253-255 Advisory: security-centerintelcom/advisoryaspx?intelid=INTEL-SA-00075

https://github.com/scriptzteam/Shodan-Dorks

Shodan Dorks Basic Shodan Filters city: Find devices in a particular city city:"Bangalore" country: Find devices in a particular country country:"IN" geo: Find devices by giving geographical coordinates geo:"56913055,118250862" Location country:us country:ru country:de city:chicago hostname: Find devices matching the hostname server: "gw

https://github.com/Mehedi-Babu/Shodan_dork

Shodan Dorks by twittercom/lothos612 Feel free to make suggestions Shodan Dorks Basic Shodan Filters city: Find devices in a particular city city:"Bangalore" country: Find devices in a particular country country:"IN" geo: Find devices by giving geographical coordinates geo:"56913055,118250862" Location country:us country:ru country:de city:ch

https://github.com/SoumyaJas2324/-jakejarvis-awesome-shodan-queries-

https://github.com/jakejarvis/awesome-shodan-queries

jakejarvis (awesome shodan queries) githubcom/jakejarvis/awesome-shodan-queries Readmemd ***Awesome Shodan Search Queries Awesome Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancie

https://github.com/GoaPhuDen/Awesome-honeypots

Awesome Honeypots A curated list of awesome honeypots, plus related components and much more, divided into categories such as Web, services, and others, with a focus on free and open source projects There is no pre-established order of items in each category, the order is for contribution If you want to contribute, please read the guide Discover more awesome lists at sindre

https://github.com/RootUp/AutoSploit

Autosploit = Automating Metasploit Modules.

Autosploit = Automating Metasploit Modules Execute MSF Modules on a target machine MS08_067 MS17_010 MS03_026 MS12_020 MS10_061 MS09_050 MS06_040 MS05_039 MS12_020 OSVDB-73573 CVE-2017-5689 CVE-2012-1823 CVE-2006-2369 CVE-2009-3843 SMB Session Pipe Auditor Gathering GPP Saved Passwords Checks for multiple auxiliary modules Execute MSF Modules on a target machine if applicati

https://github.com/Shirshakhtml/Useful-Dorks

Useful Dorks and improving Search Report Issue &lt;--&gt; Add Dork +-----------------------------------------------------------------------------+ | [!] Legal disclaimer: Usage of these dorks for attacking targets without | | prior mutual consent is illegal | | It is the

https://github.com/AidoWedo/Awesome-Honeypots

Awesome Honeypots A curated list of awesome honeypots, plus related components and much more, divided into categories such as Web, services, and others, with a focus on free and open source projects There is no pre-established order of items in each category, the order is for contribution If you want to contribute, please read the guide Discover more awesome lists at sindre

https://github.com/lothos612/shodan

Shodan Dorks

Shodan Dorks by twittercom/lothos612 Feel free to make suggestions Shodan Dorks Basic Shodan Filters city: Find devices in a particular city city:"Bangalore" country: Find devices in a particular country country:"IN" geo: Find devices by giving geographical coordinates geo:"56913055,118250862" Location country:us country:ru country:de city:ch

https://github.com/blackunixteam/awesome-shodan-queries

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/packetflare/amthoneypot

Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689

Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689 Webserver that listens on TCP port 16992 Replicates the behaviour of Intel's AMT management service If successfully exploited, content pulled from a HP machine is served to the attacker Building - # go build Running - # /amthoneypot [logfiletxt] Persistent Execution - # nohup /amthoneypot logfiletxt

https://github.com/ChoKyuWon/amt_auth_bypass

CVE-2017-5689(aka AMT-AUTHBYPASS) checker

https://github.com/Bijaye/intel_amt_bypass

simple python poc for CVE-2017-5689

intel_amt_bypass simple POC for CVE-2017-5689 usage: python amibypasspy xxxx

https://github.com/embedi/amt_auth_bypass_poc

CVE-2017-5689 Proof-of-Concept exploit

Intel AMT authentication bypass example This is a Proof-of-Concept code that demonstrates the exploitation of the CVE-2017-5689 vulnerability It is essentialy a mitmproxy script that simply blanks an Authorization header "response" field Example usage: mitmdump -p 8080 -dd --no-http2 -s blank_auth_responsepy

https://github.com/krishpranav/autosploit

A simple ruby tool to automate metasploit modules

autosploit A simple ruby tool to automate metasploit modules Installation git clone githubcom/krishpranav/autosploit cd autosploit bash autosploitsh Execute MSF Modules on a target machine MS08_067 MS17_010 MS03_026 MS12_020 MS10_061 MS09_050 MS06_040 MS05_039 MS12_020 OSVDB-73573 CVE-2017-5689 CVE-2012-1823 CVE-2006-2369 CVE-

https://github.com/nullfuzz-pentest/shodan-dorks

Shodan Dorks

Shodan dorks Description: This GitHub repository provides a range of search queries, known as "dorks," for Shodan, a powerful tool used to search for Internet-connected devices The dorks are designed to help security researchers discover potential vulnerabilities and configuration issues in various types of devices such as webcams, routers, and servers This resou

https://github.com/intel/INTEL-SA-00075-Linux-Detection-And-Mitigation-Tools

DISCONTINUATION OF PROJECT This project will no longer be maintained by Intel Intel has ceased development and contributions including, but not limited to, maintenance, bug fixes, new releases, or updates, to this project Intel no longer accepts patches to this project If you have an ongoing need to use this project, are interested in independently developing it, or would l

https://github.com/merlinepedra/AWESOME-SHODA-QUERIES

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/baonq-me/cve2017-5689

cve2017-5689 This script scan host that have CVE-2017-5689 Ref: How to check whether AMT is enabled and provisioned under Linux (method #2)

https://github.com/jakejarvis/awesome-shodan-queries

🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/referefref/referefref

Cyber Threat Intelligence Threat Feed Endpoint - Updated Daily Daily STIX2 Reports - Updated Every Day STIX2 Validator - An online STIX2 JSON validator Anonymous Proxies - Daily List Forum Spam - Daily List Phishing Domains - Daily List PulseDive Feed Alienvault OTX Feed MISP Default Feed All CTI Deception Tech modpot - A modular web-application honeypot platform built with

https://github.com/mjg59/mei-amt-check

Check whether AMT is enabled and provisioned under Linux

AMT status checker for Linux A simple tool that tells you whether AMT is enabled and provisioned on Linux systems Requires that the mei_me driver (part of the upstream kernel) be loaded Building Run make Running sudo /mei-amt-check If run on a system with no AMT, output will look like: Intel AMT: DISABLED

https://github.com/tristisranae/shodan_queries

shodan querie examples

Table of Contents Industrial Control Systems Remote Desktop Network Infrastructure Network Attached Storage (NAS) Webcams Printers &amp; Copiers Home Devices Random Stuff Industrial Control Systems Samsung Electronic Billboards 🔎 → "Server: Prismview Player" Gas Station Pump Controllers 🔎 → "in-tank

https://github.com/scriptzteam/Awesome-Shodan-Queries

🔍 A collection of interesting, funny, and depressing search queries to plug into shodan.io 👩‍💻

Awesome Shodan Search Queries Over time, we've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/bartblaze/Disable-Intel-AMT

Tool to disable Intel AMT on Windows

Disable Intel AMT Tool to disable Intel AMT on Windows Runs on both x86 and x64 Windows operating systems Download: DisableAMTexe DisableAMTzip What? On 02 May 2017, Embedi discovered "an escalation of privilege vulnerability in Intel® Active Management Technology (AMT), Intel® Standard Manageability (ISM), and Intel® Small Business Technology versions firm

https://github.com/flyingfishfuse/Intel_IME_WebUI_bypass

does this even work?

Intel_IME_WebUI_bypass does this even work? This has some new things I have never done before and I am still testing it haven't even run the darn thing yet but it looks like it works I guess ################################################################################ This is a tool to persist an Intel IME admin session by modifying the GET request to have the "

https://github.com/haxrob/amthoneypot

Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689

Honeypot for Intel's AMT Firmware Vulnerability CVE-2017-5689 Webserver that listens on TCP port 16992 Replicates the behaviour of Intel's AMT management service If successfully exploited, content pulled from a HP machine is served to the attacker Building - # go build Running - # /amthoneypot [logfiletxt] Persistent Execution - # nohup /amthoneypot logfiletxt

https://github.com/Mrnmap/SHODAN

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/noname1007/awesome-shodan-queries

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/AllSafeCyberSecur1ty/SHODAN

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

https://github.com/H4CK3RT3CH/shodan-queries

Awesome Shodan Search Queries Over time, I've collected an assortment of interesting, funny, and depressing search queries to plug into Shodan, the (literal) internet search engine Some return facepalm-inducing results, while others return serious and/or ancient vulnerabilities in the wild Most search filters require a Shodan account You can assume these queries

Recent Articles

Dell to patch AMT-vulnerable systems
The Register • Richard Chirgwin • 07 May 2017

BIOS fixes for most boxen promised Friday

Dell, which last week was scrambling to work out which of its systems are affected by the Intel AMT vulnerability, is scrambling to catch up with peers HP Inc, Lenovo and Fujitsu. In a note published on Friday, the company said it would publish firmware fixes for most vulnerable kit. As readers should already know, Intel introduced the bug in 2010, and it turned out that an attacker need only offer an empty login string to Chipzilla's VPro AMT remote management firmware to access vulnerable syst...

Read more...
How to remote hijack computers using Intel's insecure chips: Just use an empty login string
The Register • Chris Williams, Editor in Chief • 05 May 2017

Exploit to pwn systems using vPro and AMT

Code dive You can remotely commandeer and control computers that use vulnerable Intel chipsets by sending them empty authentication strings. You read that right. When you're expected to send a password hash, you send zero bytes. Nothing. Nada. And you'll be rewarded with powerful low-level access to a vulnerable box's hardware from across the network – or across the internet if the management interface faces the public web. Remember that the next time Intel, a $180bn international semiconducto...

Read more...
Red alert! Intel patches remote execution hole that's been hidden in chips since 2010
The Register • Chris Williams, Editor in Chief • 01 May 2017

Vuln reported in March, now fix is coming...

Updated For the past seven years, millions of Intel chips have harbored a security flaw that can be potentially exploited to remotely control and infect systems with spyware. Specifically, the bug is in Intel's Active Management Technology (AMT), Standard Manageability (ISM) and Small Business Technology (SBT) firmware versions 6 to 11.6. According to Chipzilla, the security hole allows "an unprivileged attacker to gain control of the manageability features provided by these products." That mean...

Read more...

References

NVD-CWE-noinfohttps://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-frhttp://www.securityfocus.com/bid/98269https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerabilityhttps://www.embedi.com/news/mythbusters-cve-2017-5689https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdfhttps://downloadmirror.intel.com/26754/eng/INTEL-SA-00075%20Mitigation%20Guide-Rev%201.1.pdfhttps://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03754en_ushttp://www.securitytracker.com/id/1038385http://www.oracle.com/technetwork/security-advisory/cpujul2017-3236622.htmlhttps://security.netapp.com/advisory/ntap-20170509-0001/https://cert-portal.siemens.com/productcert/pdf/ssa-874235.pdfhttps://nvd.nist.govhttps://www.exploit-db.com/exploits/43385/https://www.kb.cert.org/vuls/id/491375
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-30924CVE-2024-3400overflowCVE-2024-23528CVE-2024-21338CVE-2024-3818CVE-2024-23535NULL pointer dereferenceelevation of privilege
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook