1

I have a 845 g7 with a bios 1.06, which has a load of CVEs which allow SMM and DXE exploits:

https://support.hp.com/ca-en/drivers/selfservice/hp-elitebook-845-g7-notebook-pc/37506818 (under the UEFI bios versions > 1.06).

However, I have no real idea how to exploit these. I'm a programmer (C++), however mostly just corporate applications and data management. It would be great if someone could forward me to how to initiate SWSMI for example and how to actually push arbitrary code execution in the SMM, etc.

I think I understand on a very high level what needs to be done:

I think I'd have to start with a kernel level driver which writes to an io port to initiate an SMI, particularly SWSMI (0xb2) to initiate SMM? Which would also read from "shell code" which is written to registers that are inside the SWRAM.

However, I'm trying to figure out even where to start. At the moment I'm looking into writing to ioports as a starter, which need to be kernel level drivers, such as here for example: https://github.com/tandasat/SmmExploit.

There is the BRLY stuff which shows something that could be useful to someone who could understand it:

https://www.binarly.io/advisories/BRLY-2021-003/index.html

Ideas on some fun stuff like changing the motherboard serial number, etc.? The exploits give all the way down to -2 ring access.

Thanks

1 Answer 1

1

OST has a couple of courses that should give you all the background information you need:

https://opensecuritytraining.info/IntroBIOS.html

Now that Xeno has relaunched OST as OST2 there is also this one, but I'm not sure how much overlap/rebranding is in it:

https://p.ost2.fyi/courses/course-v1:OpenSecurityTraining2+Arch4001_x86-64_RVF+2021_v1/about

N.B. I haven't taken either of these courses myself, but I've been through several others on OST and they were excellent, these are on my todo list

1
  • Amazing thank you so much! I can't upvote you as I don't have enough reputation. But it's truly appreciated.
    – s33ds
    Jul 11 at 17:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.