bartblaze / disable-intel-amt

Tool to disable Intel AMT on Windows

Hi there 👋

My name is Bart. I work in infosec or information security (cyber security), mainly as a blue teamer.

On my Github, https://github.com/bartblaze, you can find multiple projects I've created.

I write articles on my blog: https://bartblaze.blogspot.com/

You can also find me on Twitter / X: https://twitter.com/bartblaze

Support

Did I help you out with any of the Git projects, tooling, posts, blog articles, ...? Consider buying me a coffee! ☕ Thank you for your support.

disable-intel-amt's Issues

Original bat

Would it be possible to see the original bat file

Problem in source

sc config LMS start=disabled is invalid
the correct command needs a space after the =
C:\Windows\system32>sc config LMS start=disabled
DESCRIPTION:
Modifies a service entry in the registry and Service Database.
USAGE:
sc config [service name] ...

OPTIONS:
NOTE: The option name includes the equal sign.
A space is required between the equal sign and the value.
type= <own|share|interact|kernel|filesys|rec|adapt>
start= <boot|system|auto|demand|disabled|delayed-auto>
error= <normal|severe|critical|ignore>
binPath=
group=
tag= <yes|no>
depend= <Dependencies(separated by / (forward slash))>
obj= <AccountName|ObjectName>
DisplayName=
password=

C:\Windows\system32>sc config LMS start= disabled
[SC] ChangeServiceConfig2 (delayed autostart flag) FAILED 1072:

The specified service has been marked for deletion.

C:\Windows\system32>

Vulnerable Machines

good tool, thank you. two points:

• The attack vector is AMT and AMT does run on non vPro processors, albeit in a reduced functionality mode called standard manageability. For this reason I believe that non vPro machines are also vulnerable. Do you have a resource from Intel specifically stating CVE-2017-5689 is only applicable to vPro processors? They actually state Standard Manageability machines are vulnerable

• Under Is there an easier way to do this? you might consider linking to this guide

sources missing

Of the binaries here published no sources are provided.
For would-be security software this is unacceptable.

Please add sources (and build instructions if necessary) or remove the binaries.

Only software mitigation?

Hi,

So this tool only disables the support for AMT in Windows OS?
Shouldn't be disabling from the BIOS more effective?