Preuve de concept (POC)

CVE-2024-23443

hp_bios_osquery

Ajouter l'extension osqery HP BIOS WMI à Elastic Agent

Dépendances

• pip install pywin32
• pip install osquery
• pip install pyinstaller

Compilation

pyinstaller --onefile hp_bios_enumeration.py

Installation

1. Copier l'extension vers l'emplacement de l'agent Elastic

   copy .\hp_bios_enumeration.exe "C:\Program Files\Elastic\Agent\data\elastic-agent-XXXXXX\components\"

2. Mettre à jour le fichier auto_load d'osquery d'Elastic

   "C:\Program Files\Elastic\Agent\data\elastic-agent-XXXXXX\components\hp_bios_enumeration.exe" | Out-File "C:\Program Files\Elastic\Agent\data\elastic-agent-XXXXXX\run\osquery-default\osquery\osquery.autoload" -Append

3. Redémarrer l'agent

4. Confirmer que l'extension est chargée

   osqueryi

   osquery> SELECT * FROM hp_bios_enum;

   name	possible_values	current_value
   System Management Command	Disable, Enable	Enable
   Fast Boot	Disable, Enable	Enable
   BIOS Rollback Policy	Unrestricted Rollback to older BIOS, Restricted Rollback to older BIOS	Unrestricted Rollback to older BIOS
   Audio Alerts During Boot	Disable, Enable	Enable