DeathMetal: Red team & penetration testing tools to exploit the capabilities of Intel AMT
DeathMetal is a suite of tools that interact with Intel AMT. It’s kind of a foray into a world filled with intrigue and reversing puzzles with useful results.
Since this is super serious, tools are named after Metalocalypse characters.
Tools are prefixed with “dm_” to help with tab-completion and recognition.
- dm_pickles – Duckyscript interpreter that communicates over AMT KVM (vnc) and injects keystrokes.
- dm_toki – IDE-R implementation – lets you attach floopy and CD images remotely to the target computer.
- dm_nathan – Is a cli that allows for configuring AMT via authenticated channel
- dm_rockso – Presence and version scanner, can help you find AMT capable systems regardless of provisioning status. (works even if explicitly not-enabled)
Code that is common to more than one tool lives in a library called ‘Charles’, at the moment it can pretty much just help set up Redirection service stuff.
git clone https://github.com/Coalfire-Research/DeathMetal.git
Copyright 2018 Victor Teissler