MikroTik

Posted: **Mon Sep 04, 2017 10:14 pm**

Once Intel ME (ISM/AMT) is enabled, then legacy WoL no longer works.
So such machine cannot be WoL powered on, but instead one would go to http(s)://host:16992(3) & power on from the menu.

On Windows there are ie Powershell options, on Linux there is ie amttool
But RouterOS does not seem to have any option

Script would be nice, like explained here: https://software.intel.com/en-us/forums ... nt-1911661

Anybody has any idea how to achieve it with RouterOS?

sebus

Posted: **Mon Sep 04, 2017 11:49 pm**

Isn't the appropriate action when Intel AMT is enabled: disable it as soon as possible?

Posted: **Tue Sep 05, 2017 8:55 am**

Why? Because you read scary stories about a flaw that was fixed months ago?
If thinking in that categories then one has to disconnect from any network, only way to be safe!

Anyway, that was your opinion, not an answer to the question...

Posted: **Tue Sep 05, 2017 7:22 pm**

I don't know how the AMT's web interface is implemented, but there may be a chance you could simply send an HTTP request to it using the fetch command and execute the power on function.

That would require that the web interface uses http basic auth (instead of cookies or sessions) to be able to authenticate.
And then the power on function should be callable by hitting a specific URL with POST method for example. Something/anything that you can replicate with fetch command.

A lot of 'ifs' for sure...

I don't have any Intel device with AMT to check it out if it's even at all possible and with a quick glance at their API it's probably not possible to use it via RouterOS Scripting.

Posted: **Tue Sep 05, 2017 11:57 pm**

As stated in first post linked to the Intel forums:

In a browser I can log in website: 
http://IP:16992/
and I can click Remote Control, mark Turn power on with selection Normal boot, click Send Command and click OK.
It works good, but in only one lab we have 10 computers, so I have script like:
for ip in range(my_lab):
     curl -m 3 --anyauth -u user:password -d amt_html_rc_radio_group=2 -d amt_html_rc_boot_special=1 http://ip:16992/remoteform
I can turn on many computers with one operation.
How it works:
curl simulate web browser and sends -d amt_html_rc_radio_group=2 -d amt_html_rc_boot_special=1 to http://ip:16992/remoteform
In html form is:
<FORM NAME=remoteForm METHOD="POST" ACTION="/remoteform">
<...>
<p class="in"><INPUT TYPE=RADIO CHECKED NAME=amt_html_rc_radio_group VALUE=2 ONCLICK=bootSpecial() >Turn power on<br>
<...>
<p>Select a boot option:
<SELECT NAME=amt_html_rc_boot_special SIZE="4">
<OPTION value=1 SELECTED>Normal boot
<OPTION value=6 >Boot from local CD/DVD drive
<OPTION value=3 >Boot from local hard drive

I can send for example: -d amt_html_rc_radio_group=2 -d amt_html_rc_boot_special=6 to boot from CD,
In this method I can read status with grep, sed, cut etc.

Everything work fine in AMT v5, on v8 I found added input:

<INPUT TYPE=hidden NAME="t" value="YGepoxwcAAABAAAAAAAAAAAAAAAAAP//CpKSA5IDTyC+OX1RnnHBgySl3+bQhK18qBDNtoJk+57q/9Q6elKkAsS6IWk=">

It is a Synchronizer Token - 
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#General_Recommendation:_Synchronizer_Token_Pattern
- So this indeed means that your previous approach won't work with AMT => 8

A possible solution to this problem would be to first make a cURL request to the page containing the form in order retrieve the form's HTML code. Then, parse it and extract the token. Finally, the token should be supplied as part of the input for the POST request.

Would that be possible with any script that would work on RouterOS?

Posted: **Wed Sep 06, 2017 12:28 am**

Ok, I didn't see that thread.

That curl command should (I haven't tried it) translate to the fetch command like this:

/tool fetch user=YourUsername password=YourPassword http-method=post http-data="amt_html_rc_radio_group=2&amt_html_rc_boot_special=1" url=http://ip:16992/remoteform

But as mentioned further down on that thread this method no longer works.

I just got the following information for you regarding the Hidden Field:

It is a Synchronizer Token. So this indeed means that your previous approach won't work with AMT 8.

A possible solution to this problem would be to first make a cURL request to the page containing the form in order retrieve the form's HTML code. Then, parse it and extract the token. Finally, the token should be supplied as part of the input for the POST request.

Theoretically this should be also possible with fetch and some scripting but I haven't tried it since I don't have any AMT enabled device.

MikroTik

Intel AMT/ISM power on script

Intel AMT/ISM power on script

Re: Intel AMT/ISM power on script

Re: Intel AMT/ISM power on script

Re: Intel AMT/ISM power on script

Re: Intel AMT/ISM power on script

Re: Intel AMT/ISM power on script