C.A.S-Exploit

CVE-2017-5689 research and validation toolkit
*Crypto Anarchy Squad (C.A.S) @anarchy_squad

An archived Python/Bash proof of concept for investigating the Intel AMT authentication-bypass issue tracked as CVE-2017-5689. Use only against devices and networks you own or are explicitly authorized to assess.

Overview

C.A.S-Exploit combines Shodan-assisted host discovery with a proof-of-concept validation routine targeting Intel management interfaces. Its primary focus is CVE-2017-5689, a critical authentication-bypass vulnerability in certain versions of Intel Active Management Technology (AMT), Intel Standard Manageability (ISM), and Intel Small Business Technology (SBT).

The project uses Python scripts for discovery and testing, plus a Bash script for sequentially processing a text file of IP addresses. It is not a universal Intel/AMD exploit, a vulnerability scanner for all firmware versions, or a replacement for vendor patch verification.

Features

• Shodan-assisted discovery: Queries Shodan by a user-provided port and saves returned IP addresses to IP.txt.
• AMT interface checks: Looks for Intel management-product identifiers in HTTP Server headers.
• Two validation paths: Attempts its proof-of-concept authentication check against /index.htm and /wsman.
• Batch execution: C-A-S.sh iterates through entries in IP.txt, using TCP port 16992.
• Terminal feedback: Displays success/failure status for each target.
• Result logging: Appends targets classified as successful to VulnIP.txt.

Important: A reported success is an indication from this proof of concept, not independent proof of exploitability. Review firmware versions, configuration, and vendor advisories before drawing conclusions.

Project layout

C.A.S-Exploit/
├── C-A-S.sh               # Batch runner (port 16992)
├── Exploit-Intel-AMD.py   # CVE-2017-5689 validation routines
├── ScanerIP.py            # Shodan-based host discovery
├── Instruction.txt        # Original brief instructions
├── requirements.txt       # Original dependency list
├── IP.txt                 # Input host list (initially empty)
└── VulnIP.txt             # Positive findings (initially empty)

Prerequisites

• Python 3 and pip
• Bash (for the batch runner)
• Python packages: requests, termcolor, and shodan
• A Shodan API key with permission to use its search API only if using the discovery script
• Written authorization for every device that will be tested

The original requirements.txt contains colored, functools, requests, and shodan. However, the scripts import termcolor, not colored, and functools is part of the Python standard library. To prepare an environment that matches the actual imports, install:

python3 -m pip install requests termcolor shodan

Usage (authorized lab environments)

Run commands from the directory containing the scripts.

1. Prepare a lab host list

Create or edit IP.txt, with one permitted test-device IP address per line:

192.0.2.10
192.0.2.11

These are documentation-only placeholder addresses. Replace them with addresses assigned to your authorized lab; a file containing public systems is not evidence of permission to test them.

2. Run the validation script for a lab device

python3 Exploit-Intel-AMD.py 192.0.2.10 16992

The script checks the HTTP management interface and its WS-Management endpoint. It prints [success] or [failed] and may append positive results to VulnIP.txt.

3. Run a batch of lab hosts

bash C-A-S.sh

The batch runner reads IP.txt and invokes the Python test for each line on port 16992. The Bash script currently calls python rather than python3; on systems where python does not point to Python 3, adjust the command locally.

Optional: Shodan discovery

ScanerIP.py prompts for a Shodan API key and a port, then saves addresses from the returned matches in IP.txt:

python3 ScanerIP.py

Do not automatically assess discovered public hosts. Discovery results must be filtered against your authorized scope before any validation or batch-testing step. Running this script also overwrites the current IP.txt file.

Output

• IP.txt — input addresses generated by Shodan discovery or supplied manually.
• VulnIP.txt — append-only log of host:port entries that the tool reports as positive.
• Terminal output — per-target status messages.

Example format (illustrative, not an actual verified finding):

[success] CVE-2017-5689 - 192.0.2.10:16992
[failed]  CVE-2017-5689 - 192.0.2.11:16992

Technical background

CVE-2017-5689 relates to improper authentication handling in affected Intel management firmware. Intel's security advisory INTEL-SA-00075 provides product/version information and remediation guidance. The code in this repository explores the management web interface and WS-Management authentication behavior; it does not patch devices or provide persistent access.

• CVE record: https://nvd.nist.gov/vuln/detail/CVE-2017-5689
• Intel advisory: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00075.html

Known limitations

This repository contains legacy proof-of-concept code. In particular:

1. The original dependency list omits termcolor and includes functools, which is built into Python.
2. The Bash runner invokes python, which may not resolve to Python 3.
3. The batch runner fixes the destination port at 16992, regardless of the port entered in the separate discovery script.
4. The Shodan discovery script does not constrain results to an approved ownership scope and may overwrite a manually prepared IP.txt.
5. The discovery script's start-input condition uses a tuple expression, so the intended Z confirmation check does not behave as written.
6. The validation script suppresses exceptions; network errors and unexpected responses can be indistinguishable from negative results.
7. The authentication test is executed again when writing positive findings, potentially causing duplicate traffic and inconsistent results.
8. No automated tests, current firmware compatibility checks, or evidence of successful execution are included in the provided archive.

Treat any results as preliminary and independently verify them.

Responsible use

This project is provided for security research, defensive validation, and education on systems within an explicitly approved testing scope. Obtain authorization before testing, document your scope and results, avoid unnecessary disruption, and follow coordinated vulnerability disclosure practices.

Credits

Crypto Anarchy Squad (C.A.S) *

Identifiers above are taken from the original source banners. License and repository URL were not specified in the provided archive.