I have a 845 g7 with a bios 1.06, which has a load of CVEs which allow SMM and DXE exploits:
https://support.hp.com/ca-en/drivers/selfservice/hp-elitebook-845-g7-notebook-pc/37506818 (under the UEFI bios versions > 1.06).
However, I have no real idea how to exploit these. I'm a programmer (C++), however mostly just corporate applications and data management. It would be great if someone could forward me to how to initiate SWSMI for example and how to actually push arbitrary code execution in the SMM, etc.
I think I understand on a very high level what needs to be done:
I think I'd have to start with a kernel level driver which writes to an io port to initiate an SMI, particularly SWSMI (0xb2) to initiate SMM? Which would also read from "shell code" which is written to registers that are inside the SWRAM.
However, I'm trying to figure out even where to start. At the moment I'm looking into writing to ioports as a starter, which need to be kernel level drivers, such as here for example: https://github.com/tandasat/SmmExploit.
There is the BRLY stuff which shows something that could be useful to someone who could understand it:
Ideas on some fun stuff like changing the motherboard serial number, etc.? The exploits give all the way down to -2 ring access.