Audit Secure Boot settings, revoked boot components, and EFI startup files on Linux and Windows. The skill helps identify missing protections and signs of bootkits, malicious software that runs before the operating system.
中文简介正在准备中。当前显示英语简介。
Detect UEFI Secure Boot bypasses and bootkits such as BlackLotus and Bootkitty by verifying Secure Boot state, checking dbx revocation currency, and hashing EFI boot binaries against known-bad sets using mokutil, efi-readvar/dbxtool, CHIPSEC, sbverify/pesign, and Windows Confirm-SecureBootUEFI. Use when auditing fleet dbx rollout after a bootkit advisory or hunting for pre-OS persistence on a suspected-compromised endpoint.
安装前可以查看交给 AI 代理的指令内容。
Legal Notice: Firmware and Secure Boot assessment must only be performed on systems you own or are explicitly authorized to test. CHIPSEC's write/modify modes and EFI variable manipulation can brick hardware. Run destructive checks only in a lab. This skill is for defensive verification and authorized assessment.
UEFI Secure Boot is the firmware-enforced trust chain that only permits boot components signed by keys in the platform's allow-list (db) and not present in the revocation list (dbx). Bootkits defeat this layer to gain pre-OS, persistent, kernel-level control that survives OS reinstalls and disk wipes. BlackLotus (2023) was the first publicly observed UEFI bootkit to bypass Secure Boot on fully patched Windows 11, abusing CVE-2022-21894 ("baton drop") in a vulnerable, signed Windows boot manager to neutralize Secure Boot and disable BitLocker, HVCI, and Defender. Bootkitty (2024) was the first PoC UEFI bootkit targeting Linux. Microsoft's CVE-2023-24932 addressed a related Secure Boot bypass that required a phased dbx (revocation) rollout because revoking the vulnerable boot managers can render systems unbootable if applied carelessly.
The core defensive insight is that patching the OS is not sufficient — the platform remains exploitable until the vulnerable, signed binaries are revoked in dbx. Detection therefore combines: (1) confirming Secure Boot is actually enabled, (2) verifying dbx is current and contains the relevant revocations, (3) checking the integrity and protection of Secure Boot EFI variables with CHIPSEC, (4) hashing on-disk EFI boot binaries and comparing them against the revocation list and known-bad sets, and (5) inspecting firmware/ESP for bootkit artifacts. This skill provides a cross-platform (Linux + Windows) workflow using mokutil, efi-readvar/dbxtool, chipsec, sbverify/pesign, and Windows Confirm-SecureBootUEFI / Get-SecureBootUEFI.
sudo apt install mokutil efitools sbsigntool dbxtool # Debian/Ubuntu
sudo dnf install mokutil efitools sbsigntools dbxtool # Fedora/RHEL
pip install chipsec # or build from https://github.com/chipsec/chipsec
Confirm-SecureBootUEFI, Get-SecureBootUEFI), and optionally the UEFI dbx update package from Microsoft.dbxupdate files from https://uefi.org/revocationlistfile to compare against.| Technique ID | Technique Name | Relevance |
|---|---|---|
| T1542.003 | Pre-OS Boot: Bootkit | Core technique — bootkit subverts the boot chain below the OS. |
| T1542 | Pre-OS Boot | Parent technique covering firmware/boot-component tampering. |
| T1542.001 | Pre-OS Boot: System Firmware | Adjacent: firmware modification used to persist or weaken Secure Boot. |
| T1014 | Rootkit | Bootkits provide rootkit-level concealment and persistence. |
| T1562.001 | Impair Defenses: Disable or Modify Tools | BlackLotus disables BitLocker/HVCI/Defender after bypassing Secure Boot. |
A disabled or setup-mode platform offers no protection.
mokutil --sb-state # "SecureBoot enabled" expected
bootctl status | grep -i "secure boot" # systemd-boot view
# 6 = enabled+user mode on the EFI SecureBoot/SetupMode vars:
od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-8be4df61-93ca-11d2-aa0d-00e098032b8c
Confirm-SecureBootUEFI # $true if enabled
# Inspect the raw dbx variable from Windows:
[System.BitConverter]::ToString((Get-SecureBootUEFI dbx).bytes) | Out-File dbx.hex
List db (allowed), dbx (revoked), KEK, and PK.
efi-readvar # dumps PK, KEK, db, dbx
efi-readvar -v dbx -o dbx.esl # export dbx to a file for offline analysis
mokutil --list-enrolled # MOK (shim) enrolled keys
mokutil --db # platform db entries via shim
Compare on-system dbx to the current official UEFI revocation list.
dbxtool --list # current dbx entries + count
# Download latest dbxupdate from uefi.org/revocationlistfile, then:
dbxtool --dbx ./DBXUpdate.bin --apply --dry-run # show what WOULD be added (no write)
A low dbx entry count or absence of recent revocations indicates the platform is behind and likely still vulnerable to known bypasses.
Verify the SB key variables are authenticated and not freely writable.
# Verify Secure Boot is enabled and the SB variables are properly protected:
sudo chipsec_main -m common.secureboot.variables
# Check S3 resume boot-script protections (an SMM/firmware bypass vector):
sudo chipsec_main -m common.uefi.s3bootscript
# Dump SPI flash for offline firmware diffing:
sudo chipsec_util spi dump rom.bin
Verify bootloaders are signed and not present in dbx.
# Locate and hash EFI boot binaries
find /boot/efi -iname '*.efi' -exec sha256sum {} \;
# Validate a binary's signature against the platform db
sbverify --list /boot/efi/EFI/BOOT/bootx64.efi
sbverify --cert /etc/secureboot/db.crt /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi
# pesign equivalent on RHEL-family:
pesign -S -i /boot/efi/EFI/BOOT/bootx64.efi
Compare collected hashes to revocation/known-bad sets (e.g., LoFP / vendor advisories).
# Example: confirm a binary's SHA-256 is NOT one of the revoked CVE-2022-21894 boot managers
sha256sum /boot/efi/EFI/Microsoft/Boot/bootmgfw.efi
# Compare against the hash list extracted from the latest dbxupdate / advisory.
Look for unauthorized ESP modifications and self-deployment markers.
# Unexpected files / recently modified binaries on the ESP
ls -laR /boot/efi/EFI/
find /boot/efi -newermt "-30 days" -iname '*.efi'
# On Windows, examine the EFI partition for rogue \EFI\Microsoft\Boot entries.
If a TPM is present, current PCR[7] reflects Secure Boot policy; deviations corroborate tampering.
tpm2_pcrread sha256:7 # Secure Boot policy PCR
agent.py collects SB state, dbx counts, ESP binary hashes, and CHIPSEC results into one report.
sudo python scripts/agent.py --check-chipsec --output secureboot_report.json
| Tool | Purpose | Source |
|---|---|---|
| mokutil | Secure Boot state and enrolled keys (Linux) | https://github.com/lcp/mokutil |
| efitools (efi-readvar) | Dump PK/KEK/db/dbx | https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git |
| dbxtool | Inspect and apply dbx updates | https://github.com/rhboot/dbxtool |
| CHIPSEC | Firmware / Secure Boot variable assessment | https://github.com/chipsec/chipsec |
| sbsigntool / pesign | EFI binary signature verification | https://github.com/jejb/sbsigntools |
| UEFI Revocation List | Official dbx update files | https://uefi.org/revocationlistfile |
| Microsoft KB CVE-2023-24932 | Secure Boot bypass guidance | https://support.microsoft.com/topic/kb5025885 |
| ESET BlackLotus analysis | Bootkit technical writeup | https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/ |
secureboot.variables and s3bootscript modules run.还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.
中文简介正在准备中。当前显示英语简介。
Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.
中文简介正在准备中。当前显示英语简介。
Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.
中文简介正在准备中。当前显示英语简介。
Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.
中文简介正在准备中。当前显示英语简介。
Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.
中文简介正在准备中。当前显示英语简介。