Lenovo ThinkPad – System Management Mode Arbitrary Code Execution

• Exploit Database
• 113 阅读

• 作者： Cr4sh
  日期： 2016-06-29
• 类别：

  • local
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40040/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17

  Source: https://github.com/Cr4sh/ThinkPwn   Lenovo ThinkPad System Management Mode arbitrary code execution exploit   ***************************************************************************   For more information about this project please read the following article:   http://blog.cr4.sh/2016/06/exploring-and-exploiting-lenovo.html     This code exploits 0day privileges escalation vulnerability (or backdoor?) in SystemSmmRuntimeRt UEFI driver (GUID is 7C79AC8C-5E6C-4E3D-BA6F-C260EE7C172E) of Lenovo firmware. Vulnerability is present in all of the ThinkPad series laptops, the oldest one that I have checked is X220 and the neweset one is T450s (with latest firmware versions available at this moment). Running of arbitrary System Management Mode code allows attacker to disable flash write protection and infect platform firmware, disable Secure Boot, bypass Virtual Secure Mode (Credential Guard, etc.) on Windows 10 Enterprise and do others evil things.     Proof of Concept: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/40040.zip