search

kkamagui / napper-for-tpm

TPM vulnerability checking tool for CVE-2018-6622. This tool will be published at Black Hat Asia 2019 and Black Hat Europe 2019
Other
100 stars 20 forks source link

Stucks at "Reading PCR values" #3

Open bypass1 opened 4 years ago

bypass1 commented 4 years ago

i created a usb boot stick, confirmed TPM v2.0 is enabled in BIOS and followed the instructions to use your script.

it stucks at "Reading PCR values of TPM......", i waited for 1 hour and tried two different systems. does it takes longer than this or is it a bug or some other error?

additional infos: i tried the "tpm2_getinfo" executable and it throws an error too: "Resource Mgr, resMgr, failed to initialization: 0x1. Exiting"

kkamagui commented 4 years ago

Hello @bypass1 , Thank you for your notification.

Would you tell me about your system information? If so, I can help you.

Best regards,

Seunghun

bypass1 commented 4 years ago

Hey Seunghun, first of all thanks for reply.

Tested systems were: FUJITSU LIFEBOOK U748 FJNB2B4 TPM2.0 DELL Latitude 7400

Let me know if you need more information.

kkamagui commented 4 years ago

Hi @bypass1 ,

Thank you for your information. As I know, your systems have TPM 2.0 and should have no problem with the Napper v1.3.

Would you test your machine according to the sequence below? 1) Boot your system with the Napper v1.3. 2) Open terminal and type "sudo resourcemgr". The password is napper as you know. 3) Open another terminal and type tpm2_listpcrs and check the error code.

If you do so, I can help you. :)

Best regards,

Seunghun

bypass1 commented 4 years ago

I tested 3 devices again. Dell E5470 script works well.

Fujitsu U728 sudo resourcemgr: Initializing device TCTI Interface Resource Mgr, device TCTI, failed initialization: 0x000a. Exiting... tpm2_listpcrs: Resource Mgr, resMgr, failed initializatin: 0x1. Exiting.... (i think this is the same error like the previous tested devices)

Dell Latitude 5500 script works well.

kkamagui commented 4 years ago

Hi @bypass1 ,

According to your test results, Fujitsu U728 may not have TPM 2.0. Other systems have TPM 2.0. :)

Best regards,

Seunghun

bypass1 commented 4 years ago

Thanks for your support. I double checked if the TPM2.0 is available and active in Fujitsu U728. It is. I cleared the TPM via BIOS option, but the output is still the same.

Do you know if i can assume that the device isnt vulnerable for this behavior?

kkamagui commented 4 years ago

Hi @bypass1 ,

I'm sorry. I'm not sure that your system has no vulnerability. The result just showed that Linux OS doesn't support your TPM device. For ensuring your system is safe, you should check the history of the BIOS update page and update it with the latest version of BIOS firmware.

If you have any further questions, feel free to ask me. :)

Best regards,

Seunghun