Extreme Privilege Escalation on Windows 8/UEFI Systems

on YouTube ↗57m

" summary

Claims a userland Windows 8 process can escalate from administrator (ring 3) into platform firmware and SMM by abusing the UEFI variable interface, discloses two Intel UEFI reference-implementation bugs (PEI coalescing “Queen’s Gambit” integer overflow yielding a reliable write primitive; DXE envelope parser “King’s Gambit” causing a 4GB overwrite loop beaten by brute force). Exploit uses set firmware environment variable API and a variable spray to place shellcode at predictable physical addresses, successfully reflashes SPI flash and installs an SMM backdoor The Watcher (demo works but is fragile); Intel patches follow and a free firmware-scanning tool is available.

AI-written summary · about

" chapters (38)

1. 0:00Introduction
2. 0:23Who are we
3. 0:40Outline
4. 1:53Command Prompt
5. 3:11Post exploitation privilege escalation
6. 4:18Post exploitation privilege escalation options
7. 4:44Dark world
8. 5:36Extreme privilege escalation
9. 6:18Target of attack
10. 10:38BIOS
11. 11:54UEFI Audit
12. 13:04UEFI Capsule Update
13. 13:53Firmware Capsule
14. 14:30Capsule Update
15. 14:57Coalescing
16. 15:34Cryptographic Verification
17. 15:46Capsule
18. 17:33Bugs
19. 18:58Open Source
20. 20:00Vulnerabilities
21. 21:32Memory Map
22. 22:11Queens Gambit
23. 22:37Dixie
24. 24:11Whitepaper Summary
25. 30:17Live Demo
26. 32:13Warm Reset
27. 35:37Flash Chip
28. 37:24Vulnerability Disclosure Process
29. 38:52Intels Response
30. 43:22Attacked an HP System
31. 43:55Jim Waldron
32. 48:45System Management Mode
33. 49:09How The Watcher Works
34. 52:12Ultimate Nullifier
35. 52:53Ping packets
36. 53:13Manual configuration
37. 55:37Spoof concept
38. 55:53Reset vector

" related talks

• 47mHow to Hack a Turned-Off Computer, or Running Unsigned Code in Intel Management EngineMaxim Goryachy, Mark Ermolov · Black Hat Europe 2017
• 01h 04mAnalyzing UEFI BIOSes from Attacker & Defender ViewpointsXeno Kovah · Black Hat Europe 2014
• 49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded ControllerAlex Matrosov, Alexandre Gazet · Black Hat USA 2019
• 01h 13mIs there an EFI monster inside your apple?Pedro Vilaça · CODE BLUE 2015
• 27mBreaking the Chain of TrustJesse Michael, Mickey Shkatov, Alex Bazhaniuk · FIRSTCON21 Virtual Edition 2.0
• 34mCore Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous SystemGuanxing Wen · Black Hat USA 2023
• 38mClose Encounters of the Advanced Persistent Kind: Leveraging Rootkits for Post-ExploitationRuben Boonen, Valentina Palmiotti · Black Hat USA 2023
• 01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized PackersAlexandre Borges · HITBSecConf 2019 Amsterdam