Skip to content
Red team & penetration testing tools to exploit the capabilities of Intel AMT
Branch: master
Clone or download
Latest commit d982c5b Apr 9, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
bin ider can now boot computer into ubuntu Mar 29, 2019
charles import Mar 7, 2019
examples/pickles import Mar 7, 2019
LICENSE Updated license to prohibit commercial use Apr 9, 2019
TODO.txt import Mar 7, 2019


"We are here to make coffee APT metal. We will make everything metal. Blacker than the blackest black times infinity."

DeathMetal is a suite of tools that interact with Intel AMT. Its kind of a foray into a world filled with intrigue and reversing puzzles with useful results.

Since this is super serious, tools are named after Metalocalypse characters.

Tools are prefixed with "dm_" to help with tab-completion and recognition.

  • dm_pickles - Duckyscript interpreter that communicates over AMT KVM (vnc) and injects keystrokes.
  • dm_toki - IDE-R implementation - lets you attach floopy and CD images remotely to the target computer.
  • dm_nathan - Is a cli that allows for configuring AMT via authenticated channel
  • dm_rockso - Presence and version scanner, can help you find AMT capable systems regardless of provisioning status. (works even if explicitly not-enabled)

Code that is common to more than one tool lives in a library called 'Charles', at the moment it can pretty much just help set up Redirection service stuff.

Getting Started

You may want to run in a virtual env and install any dependencies that come up - the code is in python3.


Python3 and pip



First, I would make a virtual python3 environment and activate it.
pip install git+

Built With

  • Python3 default libs
  • hexdump for debugging
  • requests for http.


Submit a pull request, or talk to me or something.


See also the list of contributors who participated in this project.


This project is licensed under a modified MIT License - see the LICENSE file for details


  • Jimmy Twotimes for pointing me at the scanning capabilities - this became rockso, thanks man!
  • Clutchisback for the beef hooks and help with the blog post - greatly appreciated.
  • Soen knows what he did.
  • Coalfire for the opportunity
You can’t perform that action at this time.