nmap/scripts/http-vuln-cve2017-5689.nse
Script returns that an ssl port for the vulnerability is "NOT VULNERABLE" when it should be VULNERABLE as the bypass can be manually performed using a web browser and burp suite on a test machine.
#Command
nmap -d -p 16993 --script http-vuln-cve2017-5689 --script-args vulns.showall 172.17.56.89
#Results
Discovered open port 16993/tcp on 172.17.56.89
Completed SYN Stealth Scan at 12:48, 0.01s elapsed (1 total ports)
Overall sending rates: 142.86 packets / s, 6285.71 bytes / s.
NSE: Script scanning 172.17.56.89.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 12:48
NSE: Starting http-vuln-cve2017-5689 against 172.17.56.89:16993.
NSE: [http-vuln-cve2017-5689 172.17.56.89:16993] http.request socket error: TIMEOUT
NSE: Finished http-vuln-cve2017-5689 against 172.17.56.89:16993.
Completed NSE at 12:48, 8.01s elapsed
Nmap scan report for testhost (172.17.56.89)
Host is up, received echo-reply ttl 127 (0.00038s latency).
Scanned at 2017-11-13 12:48:43 Eastern Standard Time for 9s
PORT STATE SERVICE REASON
16993/tcp open amt-soap-https syn-ack ttl 63
| http-vuln-cve2017-5689:
| NOT VULNERABLE:
| Intel Active Management Technology INTEL-SA-00075 Authentication Bypass
| State: NOT VULNERABLE
| IDs: BID:98269 CVE:CVE-2017-5689
| References:
| https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5689
| https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
| https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
| http://www.securityfocus.com/bid/98269
|_ https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
Final times for host: srtt: 375 rttvar: 4500 to: 100000
#Notes
Possibly an issue with shortport library needing to know it could possibly be SSL or the http library is not detecting it needs HTTPS support.
Same happens for 664/tcp open secure-aux-bus syn-ack ttl 63
Any assistance would be greatly appreciated.
nmap/scripts/http-vuln-cve2017-5689.nse
Script returns that an ssl port for the vulnerability is "NOT VULNERABLE" when it should be VULNERABLE as the bypass can be manually performed using a web browser and burp suite on a test machine.
#Command
nmap -d -p 16993 --script http-vuln-cve2017-5689 --script-args vulns.showall 172.17.56.89
#Results
Discovered open port 16993/tcp on 172.17.56.89
Completed SYN Stealth Scan at 12:48, 0.01s elapsed (1 total ports)
Overall sending rates: 142.86 packets / s, 6285.71 bytes / s.
NSE: Script scanning 172.17.56.89.
NSE: Starting runlevel 1 (of 1) scan.
Initiating NSE at 12:48
NSE: Starting http-vuln-cve2017-5689 against 172.17.56.89:16993.
NSE: [http-vuln-cve2017-5689 172.17.56.89:16993] http.request socket error: TIMEOUT
NSE: Finished http-vuln-cve2017-5689 against 172.17.56.89:16993.
Completed NSE at 12:48, 8.01s elapsed
Nmap scan report for testhost (172.17.56.89)
Host is up, received echo-reply ttl 127 (0.00038s latency).
Scanned at 2017-11-13 12:48:43 Eastern Standard Time for 9s
PORT STATE SERVICE REASON
16993/tcp open amt-soap-https syn-ack ttl 63
| http-vuln-cve2017-5689:
| NOT VULNERABLE:
| Intel Active Management Technology INTEL-SA-00075 Authentication Bypass
| State: NOT VULNERABLE
| IDs: BID:98269 CVE:CVE-2017-5689
| References:
| https://www.embedi.com/news/what-you-need-know-about-intel-amt-vulnerability
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5689
| https://www.embedi.com/files/white-papers/Silent-Bob-is-Silent.pdf
| https://www.tenable.com/blog/rediscovering-the-intel-amt-vulnerability
| http://www.securityfocus.com/bid/98269
|_ https://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr
Final times for host: srtt: 375 rttvar: 4500 to: 100000
#Notes
Possibly an issue with shortport library needing to know it could possibly be SSL or the http library is not detecting it needs HTTPS support.
Same happens for 664/tcp open secure-aux-bus syn-ack ttl 63
Any assistance would be greatly appreciated.