ETS-MSE/secure-boot-cert-servicing

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A PowerShell script that assesses a Windows machine's Secure Boot certificate posture for the 2011 to 2023 rollover (CVE-2023-24932) and optionally opts the machine into the Microsoft KB5025885 servicing pipeline by writing a registry value. The primary operation is assessment and reporting; exploitation is not performed.

Backdoor review

No backdoor observed in reviewed code

The artifact is a PowerShell script and its README documentation for assessing and servicing the Secure Boot 2011 to 2023 certificate rollover (CVE-2023-24932). The script performs local system assessment, prints a report, and optionally writes a single registry value to opt into Microsoft's KB5025885 servicing pipeline. No network access, credential theft, persistence mechanisms, unrelated payloads, or concealed operator-directed harm were observed. The code is transparent, well-commented, and its behavior aligns with the documented purpose.

ClassificationScanner
Model confidence95%
AuthenticationRequired
LanguagesPowerShell
Target softwareMicrosoft WindowsSecure Boot
Attack typesSecurity Feature Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script's primary function is to assess the Secure Boot certificate state and report a verdict. It does not contain code to exploit the CVE-2023-24932 vulnerability. The optional -Apply action writes a documented registry value to opt into Microsoft's official servicing pipeline, which is a configuration change, not an exploitation technique. The script is a scanner/assessment tool.

Invoke-SecureBootCertServicing.ps1:3-10Invoke-SecureBootCertServicing.ps1:18-19Invoke-SecureBootCertServicing.ps1:41-50

Requirements

  • Requires Administrator privileges to read UEFI variables and write the servicing registry value.Invoke-SecureBootCertServicing.ps1:119-120
  • Requires Windows PowerShell 5.1.Invoke-SecureBootCertServicing.ps1:1

Observed behavior

  • Reads Secure Boot UEFI variables (db, kek, dbdefault, dbx, pk) to determine the presence of 2011 and 2023 certificates.Invoke-SecureBootCertServicing.ps1:504-534
  • Checks the Authenticode signature of the boot manager (bootmgfw.efi) to determine if it is signed by a 2023 certificate.Invoke-SecureBootCertServicing.ps1:556-562
  • Reads BitLocker state using three independent methods (Get-BitLockerVolume, manage-bde, WMI) and checks for the presence of a recovery password protector.Invoke-SecureBootCertServicing.ps1:215-378
  • When the -Apply switch is used, writes the DWORD value 0x5944 to HKLM\SYSTEM\CurrentControlSet\Control\Secureboot\AvailableUpdates to opt the machine into the servicing pipeline.Invoke-SecureBootCertServicing.ps1:914
  • Refuses to write the 0x80 DBX revocation bit unless -AllowRevocation is explicitly passed.Invoke-SecureBootCertServicing.ps1:847-850
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Registry Write
HKLM\SYSTEM\CurrentControlSet\Control\Secureboot\AvailableUpdates = 0x5944The only write operation performed by the script when -Apply is used. This is the documented KB5025885 opt-in value.Invoke-SecureBootCertServicing.ps1:914
No Network Access
Script contains no network-related cmdlets (Invoke-WebRequest, etc.) and documentation explicitly states no network access.Confirms the script does not exfiltrate data or contact remote servers.Invoke-SecureBootCertServicing.ps1:1-1014README.md:48
No Persistence
No scheduled tasks, service creation, or startup folder writes.The script does not establish any mechanism to survive reboots or maintain access.Invoke-SecureBootCertServicing.ps1:1-1014
No Credential Access
Script explicitly states it never reads, prints, or transmits BitLocker recovery keys; only checks for protector existence.No credential dumping or key extraction logic present.Invoke-SecureBootCertServicing.ps1:16Invoke-SecureBootCertServicing.ps1:339-359
Review boundaries

What the analysis did not establish

  • Evidence includes only the PowerShell script and README; one file (LICENSE) is omitted as non-text. The analysis is based solely on static review of the provided source code; no dynamic execution or verification was performed.
  • One file (LICENSE) was omitted from the text evidence; it is a standard MIT license file and unlikely to contain executable behavior.
  • Binary files were not present in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1