Ramleak Secure Boot

[chickenjudo68]

Ramleak works when I disable Secure Boot and then Bitlocker the device. However, I can not get Win PE to boot with the modified BCD file if Secure Boot is already enabled.

[Wack0]

what error do you get? you might need to use the bootmgfw.efi file from the device, the PoC provides the latest version of bootmgfw_ex.

[chickenjudo68]

Actually, I should make a correction. I got past Secure Boot but then I get the Windows Bitlocker pre-boot screen. However, it's not the typical display and looks more like what you see below.

I only got to this point by doing the following:

• Obtained from the Windows debugging tools the files symchk.exe, symsrv.dll, symsrv.yes, symstore.exe and copied those into my Windows\System32 folder (because I was receiving an error about missing symbols)
• Installed Microsoft Visual C++ 2015-2022 Redistributable
• Replaced in iso\EFI\boot the bootx64.efi with one that worked with Secure Boot
• Ran the scripts, rebuilt the ISO file, and copied everything to my USB flash drive

Thanks.

[Wack0]

you might need to use the exact bootmgfw.efi from your target system here, it depends how bitlocker was set up.

[Quaelopec]

I was able to get this working with Secure Boot BitLocker validation, but had the same results described with BitLocker without Secure Boot. I haven't had much success yet playing around with this PoC or trying other methods (PXE soft reboot), but I'm guessing the issue is that legacy integrity validation doesn't work with the PoC even when using the target bootmgfw.efi. Do correct me if I'm wrong, though. I am very much interested in seeing if this vulnerability works consistently under legacy validation.

[Wack0]

For legacy integrity validation, you have to use the exact same bootmgfw.efi from your target system's EFIESP, as the hash of that gets extended into a PCR used for unsealing the VMK from TPM in that scenario.

The rest of the legacy validation checks are effectively skipped, as they're only performed after successful boot application load. The code flow is as follows:

• default boot application launch, VMK is derived at this point
  • it tries to load "\" as a file, this fails and returns failure with VMK derived
• recovery boot application launch, ramdisks are created which reads the file to leak into memory
  • second stage boot application is loaded, validation checks are performed which wipes the derived VMK from memory and caps PCR11 to lock out VMK unsealing until reset
  • second stage boot application loads with leaked file in memory.

For pre-UEFI legacy BIOS boot (including CSM), you need to boot from a drive where the MBR and NTFS partition boot sector and bootmgr file is identical to your target system's, as the code flow here is: BIOS extends hash of MBR sector into TPM PCR, MBR extends hash of NTFS partition boot sector into TPM PCR, NTFS partition boot sector extends hash of bootmgr into TPM PCR, that TPM PCR is used as part of VMK unsealing from TPM. The PoC doesn't do this and supports only EFI boot.

[Quaelopec]

Sticking strictly with the PoC, I made sure I was on legacy integrity validation with TPM only, used the appropriate rawdevice GUIDs from the original BCD as instructed in the readme, successfully created the new BCD with no errors from the .bat, copied all the files from \ramleak\iso to a USB with the target system's original bootmgfw.efi and tried booting from the USB, but I still get the same error screen shown earlier. For bootmgfw.efi, I tried renamed it to bootx64.efi and replacing that with the one in the USB's \EFI\boot, as well as just using bootmgfw.efi and editing the new BCD's {bootmgr} path parameter to use it at \EFI\Microsoft\Boot\bootmgfw.efi like normal, both both produced the same error.

BitLocker with Secure Boot validation works without issue using the PoC as instructed on the same VM I am testing with if I switch back to enabling Secure Boot and using 7 and 11 protectors.

[Wack0]

so you still get an error when copying target system EFIESP \EFI\Microsoft\Boot\bootmgfw.efi to USB \efi\boot\bootx64.efi ?

Does EFIESP \efi\boot\bootx64.efi exist? If so, and it's different from EFIESP \EFI\Microsoft\Boot\bootmgfw.efi, try using that.

If that doesn't work, then try copying the PoC data (move BCD out of the way, copy BCD, copy everything that isn't the \EFI\ directory) directly to EFIESP and booting from EFIESP. The PoC data is ~40MB so should fit on EFIESP partition.