1.\SplitDbxContent.ps1 <path to downloaded dbxupdate.bin>

1Set-SecureBootUefi -Name dbx -ContentFilePath "content.bin" -SignedFilePath "signature.p7" -Time "2010-03-06T19:17:21Z" -AppendWrite

1Get-UEFIDatabaseSignatures.ps1 "content.bin"

1[System.Convert]::ToBase64String((Get-Content -Path ".\signature.p7" -Encoding byte)) | clip
2[System.Convert]::ToBase64String((Get-Content -Path ".\content.p7" -Encoding byte)) | clip

1.\Fix-BootHole.ps1

  1<#
  2.SYNOPSIS
  3Applies UEFI dbx updates to fix BootHole vulnerability.
  4
  5.DESCRIPTION
  6Applies the UEFI dbxupdates to fix the BootHole vulnerability. Prior to running,
  7edit this script to choose between Embedded files or link to a file share.
  8See https://www.rufflabs.com/post/nessus-plugin-139239-remediating-boothole-windows/
  9
 10.EXAMPLE
 11Run the script after making required modifications as mentioned in the descriptions.
 12PS C:\>.\Fix-BootHole.ps1
 13
 14#>
 15
 16# Set this to false if you want to load the .p7 and .bin files from a file share
 17# instead of having them embedded within this script as base64 encoded data.
 18#$EmbeddedFiles = $False
 19$EmbeddedFiles = $True
 20
 21# If using a file share instead of embedding files, update these file paths to point
 22# to the .p7 and .bin files for each respective update. You can only specify those that
 23# will be used (such as, if not using arm, ignore the arm ones.)
 24$DbxUpdatePaths = @{
 25    "x64" = @{
 26        "April 2021" = @{
 27            "signature" = "\\sampleserver\sampleshare\dbxupdates\april2021_x64\signature.p7"
 28            "content" = "\\sampleserver\sampleshare\dbxupdates\april2021_x64\content.bin"
 29        }
 30        "October 2020" = @{
 31            "signature" = "\\sampleserver\sampleshare\dbxupdates\october2020_x64\signature.p7"
 32            "content" = "\\sampleserver\sampleshare\dbxupdates\october2020_x64\content.bin"
 33        }
 34        "July 2020" = @{
 35            "signature" = "\\sampleserver\sampleshare\dbxupdates\july2020_x64\signature.p7"
 36            "content" = "\\sampleserver\sampleshare\dbxupdates\july2020_x64\content.bin"
 37        }
 38    }
 39    "x86" = @{
 40        "April 2021" = @{
 41            "signature" = "\\sampleserver\sampleshare\dbxupdates\april2021_x86\signature.p7"
 42            "content" = "\\sampleserver\sampleshare\dbxupdates\april2021_x86\content.bin"
 43        }
 44        "July 2020" = @{
 45            "signature" = "\\sampleserver\sampleshare\dbxupdates\july2020_x86\signature.p7"
 46            "content" = "\\sampleserver\sampleshare\dbxupdates\july2020_x86\content.bin"
 47        }
 48    }
 49    "arm" = @{
 50        "April 2021" = @{
 51            "signature" = "\\sampleserver\sampleshare\dbxupdates\april2021_arm64\signature.p7"
 52            "content" = "\\sampleserver\sampleshare\dbxupdates\april2021_arm64\content.bin"
 53        }
 54        "July 2020" = @{
 55            "signature" = "\\sampleserver\sampleshare\dbxupdates\july2020_arm64\signature.p7"
 56            "content" = "\\sampleserver\sampleshare\dbxupdates\july2020_arm64\content.bin"
 57        }
 58    }
 59}
 60
 61# Paste in Base64 encoded files below, both signature.p7 and content.bin
 62# for each update and architecture as needed. Any left blank will not be applied.
 63$DbxUpdateFiles =  @{
 64    "x64" = @{
 65        "April 2021" = @{
 66            "signature" = ""
 67            "content" = ""
 68        }
 69        "October 2020" = @{
 70            "signature" = ""
 71            "content" = ""
 72        }
 73        "July 2020" = @{
 74            "signature" = ""
 75            "content" = ""
 76        }
 77    }
 78    "x86" = @{
 79        "April 2021" = @{
 80            "signature" = ""
 81            "content" = ""
 82        }
 83        "July 2020" = @{
 84            "signature" = ""
 85            "content" = ""
 86        }
 87    }
 88    "arm" = @{
 89        "April 2021" = @{
 90            "signature" = ""
 91            "content" = ""
 92        }
 93        "July 2020" = @{
 94            "signature" = ""
 95            "content" = ""
 96        }
 97    }
 98}
 99
100# CA Check adapted from https://github.com/synackcyber/BootHole_Fix/blob/main/boothole.ps1
101Write-Output "Checking for matching UEFI CA"
102$CAMatch = [System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI db).bytes) -match 'Microsoft Corporation UEFI CA 2011'
103if(-not $CAMatch){
104    Write-Output "Microsoft Corporation UEFI CA 2011 was not found. Updates are not required on this system."
105    exit
106}
107Write-Output "Certificate found, continuing."
108
109# Check architecture
110$ArchitectureOptions = @{
111    0 = "x86"
112    1 = "MIPS"
113    2 = "Alpha"
114    3 = "PowerPC"
115    5 = "ARM"
116    6 = "IA64"
117    9 = "x64"
118}
119
120$Architecture = $ArchitectureOptions[[int](Get-WmiObject -Class Win32_Processor).Architecture]
121$SupportedArchitectures = @("x86", "x64", "arm")
122
123if($SupportedArchitectures -notcontains $Architecture) {
124    Write-Output "This script does not support $($Architecture) based PC's, and no dbx updates are available for this architecture."
125    exit
126}
127
128function Update-DbxVariable {
129    param(
130        $SignaturePath,
131        $ContentPath
132    )
133    Set-SecureBootUefi -Name dbx -SignedFilePath $SignaturePath -ContentFilePath $ContentPath -Time "2010-03-06T19:17:21Z" -AppendWrite
134}
135
136Write-Output "Updating UEFI dbx variable for $($Architecture) architecture."
137
138$UpdateFiles = @{}
139
140if($EmbeddedFiles) {
141    # Use the embedded files in this script
142
143    Write-Output "Using embedded update files, creating files on disk."
144    try {
145    
146        $DbxUpdateFiles.$Architecture.GetEnumerator() | ForEach-Object {
147            $Release = $_.Name
148            $Content = $_.Value.Content
149            $Signature = $_.Value.Signature
150            $TempSigFile = "$($env:temp)\$($Release)_$($Architecture)_signature.p7"
151            $TempContentFile = "$($env:temp)\$($Release)_$($Architecture)_content.bin"
152
153            # Only copy data if signature and content are not null. 
154            if($null -ne $Signature -and $null -ne $Content) {
155                $UpdateFiles.Add($Release, @{"Signature" = $TempSigFile; "Content" = $TempContentFile})
156                
157                Set-Content -Path $TempSigFile -Value ([System.Convert]::FromBase64String($Signature)) -Encoding Byte -ErrorAction Stop
158                Write-Output "Created $($TempSigFile)"
159                
160                Set-Content -Path $TempContentFile -Value ([System.Convert]::FromBase64String($Content)) -Encoding Byte -ErrorAction Stop
161                Write-Output "Created $($TempContentFile)"
162            }
163        }
164    } catch {
165        Write-Output "Error creating temporary files. Check permissions to $($env:temp)."
166        exit
167    }
168}else{
169    # Use the files from a file share location
170
171    Write-Output "Using update files from file share."
172    
173    $DbxUpdatePaths.$Architecture.GetEnumerator() | ForEach-Object {
174        $Release = $_.Name
175        $ContentPath = $_.Value.Content
176        $SignaturePath = $_.Value.Signature
177        
178        # Only add to the queue if both signature and content files are accessible
179        if((Test-Path -Path $ContentPath) -and (Test-Path -Path $SignaturePath)) {
180            Write-Output "`nPreparing: $($Release)`nSignature: $($SignaturePath)`nContent: $($ContentPath)"
181            $UpdateFiles.Add($Release, @{"Signature" = $SignaturePath; "Content" = $ContentPath})
182        }
183    }
184}
185
186$UpdateFiles.GetEnumerator() | ForEach-Object {
187    Write-Output "Applying $($_.Name) update..."
188    Update-DbxVariable -SignaturePath $_.Value.Signature -ContentPath $_.Value.Content
189}   
190
191if($EmbeddedFiles) {
192    $UpdateFiles.Values.Values | ForEach-Object {
193        # Delete file from disk
194        Write-Output "Deleting on disk $($_)"
195        Remove-Item -Path $_ -ErrorAction SilentlyContinue
196    }
197}