Information about a signed UEFI Shell that can be used when Secure Boot is enabled.

Overview

SignedUEFIShell

During our research of the BootHole vulnerability last year, we tried to find as many signed bootloaders as we could. We searched all across the internet and we found these bootloaders were part of rescue CDs, firmware update tools, drive encryption utilities and more. One of these was a bootable usb image that was part of the Seagate utility suite called “SeaChest”.

From http://support.seagate.com/seachest/SeaChest_Combo_UserGuides.html) “SeaChest is a comprehensive, easy-to-use command line diagnostic tool that helps you quickly determine the health and status of your Seagate storage product. It includes several tests that will examine the physical media on your Seagate, Samsung or Maxtor disk drive.“

This particular bootloader has been added to the revoked bootloader list by Microsoft as a response to last year's BootHole vulnerability, meaning that any computer with the latest DBX updates in their UEFI Firmware will not be able to run this tool. Caveat: In most platforms, restoring factory default settings for Secure Boot will revert back to a previous version of DBX.

Within the bootable image included within this set of tool there are UEFI Shell binaries, these binaries are signed by Seagate and are loaded by this now revoked bootloader, which essentially means that because Secure Boot is still on while a UEFI Shell is running, only SeaGate signed binaries can run.

However, since a UEFI shell is a command line interface that presents the user with a shell to manually type and run commands and scripts like simple commands that include the basic change directory, list directory, copy, move and delete files. And automatic script execution using a similar mechanism to batch files in Windows (Instead of .bat it uses .nsh, more in the specification). Some of these built in commands allow reading and writing from memory, which can be useful in several ways.

In an excellent talk by Alex Ionesu at Syscan 2012, he describes how the ACPI Specification has a definition for a Windows Platform Binary Table (WPBT) which Microsoft describes: “The primary purpose of WPBT is to allow critical software to persist even when the operating system has changed or been reinstalled in a “clean” configuration.”

And so, as an experiment we will use the built in memory reading/writing utility in the UEFI Shell to overwrite an existing table with our own WPBT and load a binary to memory allowing for Windows to automatically download and execute it for us. (For simplicity's sake, we will avoid adding a new table to the existing ones, we will just overwrite the DBG2 table which happens to be the exact size we need for a basic WPBT entry.)

Before we begin, a big caveat here is that the binary the WPBT points to has to be signed with a valid code signing certificate, so for this proof-of-concept we’ll just place a file in memory and see if it gets saved to disk by Windows, since Windows will not run it but it will save it ¯_(ツ)_/¯

The python script we have published alongside this post will help you do what we just described by building an .nsh script file for you. This script uses the UEFI Shell “mm” command for replacing the content of an ACPI table it is pointed at.

Hint: you can use the memmap command in the UEFI shell to get the ACPI location in memory along with other mapped locations you might place data that will persist when windows boot (post ExitBootServices).

References: https://web.archive.org/web/20180101001804/https://infocon.hackingand.coffee/SyScan/SyScan%202012%20Singapore/SyScan%202012%20Singapore%20presentations/Day2-6Alex%20Ionescu/AlexSyScan12.pdf https://web.archive.org/web/20210309140158/https://download.microsoft.com/download/8/A/2/8A2FB72D-9B96-4E2D-A559-4A27CF905A80/windows-platform-binary-table.docx https://web.archive.org/web/20210310034802/http://www.uefi.org/sites/default/files/resources/UEFI_Shell_2_2.pdf https://web.archive.org/web/20200807013341/https://www.seagate.com/support/kb/using-seachest-bootable-to-blockerase-ssd/ https://web.archive.org/web/20201202151645/http://support.seagate.com/seachest/SeaChestUtilities.zip https://web.archive.org/web/20210221001814/https://github.com/Jamesits/dropWPBT https://web.archive.org/web/20210319021620/http://support.seagate.com/seachest/SeaChest_Combo_UserGuides.html

Owner
Mickey
Mickey
GEGVL: Google Earth Based Geoscience Video Library

Google Earth Based Geoscience Video Library is transforming to Server Based. The

3 Feb 11, 2022
A python package that computes an optimal motion plan for approaching a red light

redlight_approach redlight_approach is a Python package that computes an optimal motion plan during traffic light approach. RLA_demo.mov Given the par

Jonathan Roy 4 Oct 27, 2022
Python script to automate the change of desktop background

wallomator Python script to automate the change of desktop background A python script that automates the process of changing the desktop background. I

Mohammed Haaris Javed 10 Jun 16, 2022
Add your recently blog and douban states in your GitHub Profile

Add your recently blog and douban states in your GitHub Profile

Bingjie Yan 4 Dec 12, 2022
Strong Typing in Python with Decorators

typy Strong Typing in Python with Decorators Description This light-weight library provides decorators that can be used to implement strongly-typed be

Ekin 0 Feb 06, 2022
News-app - This is a news web app for reading news from different sources and topics

News-app - This is a news web app for reading news from different sources and topics

1 Feb 02, 2022
Semester Project on Signal Processing @CS UCU 2021

Blur Detection with Haar Wavelet Transform Requirements Python3 opencv-python PyWavelets Install these using the following command: $ pip install -r r

ButynetsD 2 Oct 15, 2022
A (hopefully) considerably copious collection of classical cipher crackers

ClassicalCipherCracker A (hopefully) considerably copious collection of classical cipher crackers Written in Python3 (and run with PyPy) TODOs Write a

Stanley Zhong 2 Feb 22, 2022
A code base for python programs the goal is to integrate all the useful and essential functions

Base Dev EN This GitHub will be available in French and English FR Ce GitHub sera disponible en français et en anglais Author License Screen EN 🇬🇧 D

Pikatsuto 1 Mar 07, 2022
Get information about what a Python frame is currently doing, particularly the AST node being executed

executing This mini-package lets you get information about what a frame is currently doing, particularly the AST node being executed. Usage Getting th

Alex Hall 211 Jan 01, 2023
Grail(TM) is a web browser written in Python

Grail is distributed in source form. It requires that you have a Python interpreter and a Tcl/Tk installation, with the Python interpreter configured for Tcl/Tk support.

22 Oct 18, 2022
this is a basic python project that I made using python

this is a basic python project that I made using python. This project is only for practice because my python skills are still newbie.

Elvira Firmansyah 2 Dec 14, 2022
Monitor the New World login queue and notify when it is about to finish

nwwatch - Monitor the New World queue and notify when it is about to finish Getting Started install python 3.7+ navigate to the directory where you un

14 Jan 10, 2022
Installer, package manager, build wrapper and version manager for Piccolo

Piccl Installer, package manager, build wrapper and version manager for Piccolo

1 Dec 19, 2021
An upgraded version of extractJS

extractJS_2.0 An enhanced version of extractJS with even more functionality Features Discover JavaScript files directly from the webpage Customizable

Ali 4 Dec 21, 2022
my own python useful functions

PythonToolKit Motivation This Repo should help save time for data scientists' daily work regarding the Time Series regression task by providing functi

Kai 2 Oct 01, 2022
Supercharge your NFTs with new behaviours and superpowers!

WrapX Supercharge your NFTs with new behaviours and superpowers! WrapX is a collection of Wrappers (currently one - WrapXSet) to decorate your NTFs ad

Emiliano Bonassi 9 Jun 13, 2022
SuperMario - Python programming class ending assignment SuperMario, using pygame

SuperMario - Python programming class ending assignment SuperMario, using pygame

mars 2 Jan 04, 2022
This is the improvised version of Dobot Magician which can be implemented for Dobot M1

pydobotM1 This is the edited driver for Dobot M1 version of the original pydobot library intended for use with the Dobot Magician. Here's what you nee

Shaik Abdullah 2 Jul 11, 2022
tetrados is a tool to generate a density of states using the linear tetrahedron method from a band structure.

tetrados tetrados is a tool to generate a density of states using the linear tetrahedron method from a band structure. Currently, only VASP calculatio

Alex Ganose 1 Dec 21, 2021