{"id":4967,"date":"2021-01-31T22:34:46","date_gmt":"2021-01-31T22:34:46","guid":{"rendered":"https:\/\/pariswells.com\/blog\/?p=4967"},"modified":"2021-03-15T02:22:14","modified_gmt":"2021-03-15T02:22:14","slug":"boothole-patching","status":"publish","type":"post","link":"https:\/\/pariswells.com\/blog\/research\/boothole-patching","title":{"rendered":"Boothole Patching"},"content":{"rendered":"

I did some patching of BootHole over the weekend, and found that the Microsoft article describing the patch installation not only contained errors but also outlined no way of checking patch install success.<\/p>

\u00a0<\/p>

1. Check the system to see if the vulnerable certificate exists, if True then proceed to check for updated certs. From an administrative powershell session:<\/i><\/p>

\u00a0<\/i><\/p>

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match ‘Microsoft Corporation UEFI CA 2011’<\/p>

\u00a0<\/p>

2. Check to see if updated certs are installed. If False, proceed to patch:<\/i><\/p>

\u00a0<\/i><\/p>

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match ‘Canonical Ltd. Master Certificate Authority’<\/p>

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match ‘Debian Secure Boot CA’<\/p>

\u00a0<\/i><\/p>

3. Get the patch to install:<\/i><\/p>

\u00a0<\/i><\/p>

Download the appropriate UEFI Revocation List File (Dbxupdate.bin) for your platform from\u00a0https:\/\/uefi.org\/revocationlistfile<\/a>.<\/p>


4. Enable TLS1.2 for this session, to ensure script downloads successfully (optional, come back to this if install-packageprovider fails). This TLS setting is session only, and will revert at session close.:<\/i><\/p>

\u00a0<\/i><\/p>

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12<\/p>

\u00a0<\/p>

5. Install NUGET:<\/i><\/p>

\u00a0<\/i><\/p>

Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force<\/p>

\u00a0<\/p>

6. Install DBX file splitting SCRIPT:<\/i><\/p>

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/i><\/p>

Install-Script -Name SplitDbxContent<\/p>

\u00a0<\/p>

7. CD to the directory where the revocation list file is located, and run the script to split into BIN and P7 files:<\/i><\/p>

\u00a0<\/i><\/p>

SplitDbxContent.ps1 .\\dbxupdate.bin<\/p>

\u00a0<\/p>

8. Install the new certs:<\/i><\/p>

\u00a0<\/i><\/p>

Set-SecureBootUefi -Name dbx -ContentFilePath .\\content.bin -SignedFilePath .\\signature.p7 -Time 2010-03-06T19:17:21Z -AppendWrite<\/p>

\u00a0<\/p>

9. Reboot and check for updated certs, should return True for both.<\/i><\/p>

\u00a0<\/i><\/p>

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match ‘Canonical Ltd. Master Certificate Authority’<\/p>

[System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI dbx).bytes) -match ‘Debian Secure Boot CA’<\/p>","protected":false},"excerpt":{"rendered":"

I did some patching of BootHole over the weekend, and found that the Microsoft article describing the patch installation not only contained errors but also outlined no […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[3433,3434,3435],"class_list":["post-4967","post","type-post","status-publish","format-standard","hentry","category-research","tag-boothole","tag-get-securebootuefi","tag-microsoft-corporation-uefi-ca-2011"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t