-
Notifications
You must be signed in to change notification settings - Fork 45
/
README.TXT
73 lines (37 loc) · 1.83 KB
/
README.TXT
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
CHIPSEC module that exploits UEFI boot script table vulnerability.
This vulnerability was discovered by Rafal Wojtczuk and Corey Kallenberg, check
original white paper:
https://frab.cccv.de/system/attachments/2566/original/venamis_whitepaper.pdf
More detailed exploit description:
http://blog.cr4.sh/2015/02/exploiting-uefi-boot-script-table.html
USAGE:
1) Download and install CHIPSEC (https://github.com/chipsec/chipsec).
2) Download and install Capstone engine incl. Python bindings (http://www.capstone-engine.org).
3) Install nasm (apt-get install nasm).
4) Copy boot_script_table.py into the chipsec/source/tool/chipsec/modules.
5) Run module:
# cd chipsec/source/tool/chipsec
# python chipsec_main.py --module boot_script_table
ADDITIONAL TOOLS:
* dma_expl.py is a proof of concept code for Linux operating system that uses software
DMA attack to read or write SMRAM contents.
* patch_smi_entry.py program uses DMA attack to defeat BIOS_CNTL flash write protection
with SMI entries patching.
To learn more about these two programs please read my other blog post:
http://blog.cr4.sh/2015/09/breaking-uefi-security-with-software.html
WARNING:
Exploitation of this vulnerability is very hardware-specific because it depends on
boot script table format and location.
Exploit was tested with following hardware:
* Intel DQ77KB motherboard (Q77 chipset)
* Apple MacBook Pro 10,2 (late 2012, QM77 chipset)
* Lenovo ThinkPad laptops (tested on x220, x230 and others)
Running this code on any other hardware may lead to unexpected problems.
TODO:
* Windows support (current implementation uses rtcwake Linux shell command).
* More decent boot script table decoding and dumping (incl. vendor-specific opcodes).
* SPI protected ranges dumping and checking.
Written by:
Dmytro Oleksiuk (aka Cr4sh)
http://blog.cr4.sh