Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New test: T1542.001 - 'UEFI Persistence via Wpbbin.exe File Creation' #2714

Merged
merged 3 commits into from
Mar 1, 2024

Conversation

jandress
Copy link
Contributor

@jandress jandress commented Mar 1, 2024

Details:
Created an atomic for adding wpbbin.exe in %systemroot%\System32. This technique can be used for UEFI-based pre-OS boot persistence. Note that the command presently only creates an empty file.

- https://grzegorztworek.medium.com/using-uefi-to-inject-executable-files-into-bitlocker-protected-drives-8ff4ca59c94c
- http://download.microsoft.com/download/8/a/2/8a2fb72d-9b96-4e2d-a559-4a27cf905a80/windows-platform-binary-table.docx
- https://github.com/tandasat/WPBT-Builder

Testing:
Tested the command and cleanup locally on Windows Server 2022.

Associated Issues:

@clr2of8
Copy link
Collaborator

clr2of8 commented Mar 1, 2024

Hey, this sounds really cool! But it looks like your additions didn't quite make it into your PR. There is a video here that might help you and some more notes on contributing here.

@jandress
Copy link
Contributor Author

jandress commented Mar 1, 2024

Hey, this sounds really cool! But it looks like your additions didn't quite make it into your PR. There is a video here that might help you and some more notes on contributing here.

Hmmm weird. It should be in there now.

Copy link
Collaborator

@clr2of8 clr2of8 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome! Thank you for your first-time contribution. Keep it up! Don't forget to claim your free Atomic Red Team t-shirt

@clr2of8 clr2of8 merged commit 498aecd into redcanaryco:master Mar 1, 2024
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants