Get Intel AMT admin password , if AMT-Device is offline

[SysArch]

If a Intel AMT device is configured in admin mode by Intel RCS (in database mode) but is unreachable (in case of misconfiguration or network problem) , it is not possible to show the admin password in the GUI (Random Admin Password). How I get the random admin password in this situation (e.g. for manuel unconfiguration if a misconfiguration exist). Best regards fabian

[SergioS_Intel]

Hello SysArch,

Let us investigate your question and we will get back to you.

Best regards,

Sergio S.

Intel Customer Support Technician

A Contingent Worker at Intel

[SergioS_Intel]

Hello SysArch,

Based on the information provided, since you provisioned using RCS in database mode. If you used a randomized password, that will be stored in the database and you can extract the password from there.

Best regards,

Sergio S.

Intel Customer Support Technician

A Contingent Worker at Intel

[SysArch]

Sorry for my late response (I was on holiday). I extracted the password from database table "amt" column "curr_admin_password". Is this right? But it looks encrypted or encoded. How I can convert it to plain text?

Best regards, fabian

[JoseH_Intel]

Hello SysArch,

In order to extract the current password try the following:

The system has to be connected via AMT in order to get the password using the method below.

* Within the SCS Console, click on “Monitoring”

* Either search for machine or view filter

* Right click on system

* Get Configured Password.

Decryption of the password from the database may take some doing as there is no easy method.

Let me know if this workd

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[SysArch]

Hi Jose

As you can read in my initial post i'm looking for a solution if the amt device is unreachable (in case of misconfiguration or network problem). So it's not possible to show the admin password in the GUI. Can you explain me the "non easy method" to decrypt the password from the database?

Best regards

[JoseH_Intel]

Hello SysArch,

The non easy method should be brute force. But I will doublecheck this and your original question with our engineering team.

Will let you know ones I have updates.

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[SysArch]

For the discussion with your engineer, maybe our actual use case can help to understand my question:

Bacause of a unknown reason the amt device was in a fault state. AMT was not accessible and a reconfiguration was impossible by ACUConfig on the amt device or by job on rcs server. So I wanted to unconfigure and configure it again. To unconfigure by ACUConfig the admin password was required. But the GUI couldn't display the password because no connection to the device was possible.

[JoseH_Intel]

Hello SysArch,

Could you please tell how many systems are affected by this behavior?

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[JoseH_Intel]

Hello SysArch,

I am just following up to double check if you were able to gather the requested information about how many systems are affected by this issue in total. Otherwise let us know if you require more time to accomplish this.

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[SysArch]

Hello Jose

Sorry, I was a bit busy. At the moment just a couple of systems are affected. It happens during the following circumstance:

A allready configured AMT-Device using TLS has been reconfigured by ACUconfig via RCS where Port 16992 was blocked (16993 was allowed) by network firewall between RCS-Server and AMT-Device. The reconfiguration failed and the AMT-Device was in a fault state. A unconfiguration was not possible due the missing password. Flash the Intel ME Firmware was the only working option.

As an additional information: First I didn't allow Port 16992 for HTTP because I use TLS, so only 16993 was allowed. This behaviour looks like a bug of the RCS, and is discussed here https://forums.intel.com/s/question/0D50P00004YciCmSAJ/intel-amt-reconfigure-fails

Best regards, fabian

[JoseH_Intel]

Hello SysArch,

Thanks for the updates. Will pass this on to our engineering team and will let you know when we have a reply from them.

Regards

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[JoseH_Intel]

Hello SysArch,

We received the following info from our engineering team:

"We’ve confirmed that yes, port 16992 is utilized upon a reconfiguration and causing the issue that the customer is seeing. We’ve also confirmed that in an initial configuration, because the traffic is encapsulated within the remote configuration certificate and therefore, the traffic is encrypted and does not use 16992.

When performing a reconfiguration, the remote configuration certificate is not used and the traffic goes over port 16992. We are unclear as to whether or not this is a bug or something intended or if it can be updated to only use TLS if that is what is set as in the profile. For now, yes, in order to perform a reconfiguration, port 16992 must be allowed.

With regard to getting password (and assuming that RCS is been used to provision the system), one way to get the password is to

1. open the SCS Console and click on monitoring

2. double-click on “All Systems”

3. right click on a system and get configured password"

Hope this helps

Regards

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[SysArch]

Hell Jose

With regard to getting password (and assuming that RCS is been used to provision the system), one way to get the password is to

1. open the SCS Console and click on monitoring

2. double-click on “All Systems”

3. right click on a system and get configured password"

This doesn't solve my problem. It doesn't work if the AMT device is offline. A need a solution to get the password if the device is offline but previously configured by RCS using random password.

Bes regards fabian

[JoseH_Intel]

Hello SysArch,

I know your original question has not been answered yet. I will keep asking if a possible way to extract a password for an offline system exists. We appreciate your patience.

Regards

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[JoseH_Intel]

Hello SysArch,

Can you tell what do you refer as “offline”? Does it mean powered off or does it mean disconnected, like the network cable is unplugged. If it is unplugged, then there is no way to get the password. AMT needs to be able to communicate with the RCS.

Regards

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[SysArch]

Hi Jose

As mentioned in my first post, offline means "unreachable (in case of misconfiguration or network problem) ".

"If it is unplugged, then there is no way to get the password"

This is very bad, because it's not possible to unconfigure a device if it's offline and not possible to get in online anymore.

"AMT needs to be able to communicate with the RCS."

Why? The password is in the database not on the AMT Device. There is no reason that the RCS must verify the password on the AMT device.

Best regards, fabian

[JoseH_Intel]

Hello SysArch,

Thanks for the update. This is the way AMT works when configured through a RCS server. What is the OEM for the system that usually go "unreachable"?

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[SysArch]

"Thanks for the update. This is the way AMT works when configured through a RCS server."

should be changed in a feature request

What is the OEM for the system that usually go "unreachable"

The Manufacturer is 4POS, but it doesn't matter. Because they are only a few incidents, through the concatenation of unfortunate coincidences. Nevertheless, it can happen and there should be a better solution to unconfigure AMT instead of reflashing the firmware.

[JoseH_Intel]

Hello SysArch,

There is a way to unconfigure AMT in a system through an RCS command, but I think your issue is with the missing password and not with the unconfiguration procedure.

Jose A.

Intel Customer Support Technician

A Contingent Worker at Intel

[SysArch]

"There is a way to unconfigure AMT in a system through an RCS command"

Unconfigure through RCS doesn't work in this case, because the AMT device is offline....