Microsoft Windows Secure Boot policy bypass via BCD truncatememory manipulation

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Check-CVE202221894.ps1 - Checks whether the host is protected against CVE-2022-21894 (Baton Drop)
.DESCRIPTION
    Verifies: (1) Secure Boot is enabled, (2) KB5025885 DBX revocation enforcement flags are set,
    (3) The AvailableUpdates registry value indicates revocation has been applied.
    Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'
$result = 'UNKNOWN'
$findings = @()

try {
    # Check 1: Is Secure Boot enabled?
    try {
        $sbState = Confirm-SecureBootUEFI
        if (-not $sbState) {
            $findings += 'Secure Boot is DISABLED - system is inherently unprotected by Secure Boot'
        } else {
            $findings += 'Secure Boot is ENABLED'
        }
    } catch {
        $findings += 'Unable to query Secure Boot state (may not be UEFI system)'
    }

    # Check 2: KB5025885 registry enforcement flag
    $regPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot'
    $regValue = 'AvailableUpdates'
    try {
        $avail = (Get-ItemProperty -Path $regPath -Name $regValue -ErrorAction Stop).$regValue
        if (($avail -band 0x30) -eq 0x30) {
            $findings += "KB5025885 enforcement flags are SET (AvailableUpdates = 0x$($avail.ToString('X')))"
        } else {
            $findings += "KB5025885 enforcement flags NOT fully set (AvailableUpdates = 0x$($avail.ToString('X')), need 0x30)"
        }
    } catch {
        $findings += 'KB5025885 registry key not found - revocation NOT configured'
        $avail = $null
    }

    # Check 3: Check if SVN (Secure Version Number) has been updated (indicates DBX was applied)
    $svnPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Secureboot'
    try {
        $props = Get-ItemProperty -Path $svnPath -ErrorAction Stop
        if ($props.PSObject.Properties.Name -contains 'SetupMode') {
            $findings += "Secure Boot SetupMode = $($props.SetupMode)"
        }
    } catch {
        $findings += 'Unable to read additional Secure Boot registry state'
    }

    # Check 4: Look for the scheduled task that applies DBX
    try {
        $task = Get-ScheduledTask -TaskName 'SecureBootDBXUpdateTask' -ErrorAction Stop
        $taskState = $task.State
        $findings += "SecureBootDBXUpdateTask exists, state: $taskState"
        if ($task.LastRunTime) {
            $findings += "Last DBX update task run: $($task.LastRunTime)"
        }
    } catch {
        $findings += 'SecureBootDBXUpdateTask NOT found - DBX update has not been configured'
    }

    # Check 5: Verify installed KB
    $hotfixes = Get-HotFix -ErrorAction SilentlyContinue | Where-Object { $_.HotFixID -match 'KB5025885|KB5009543|KB5009555|KB5009557|KB5009566' }
    if ($hotfixes) {
        $kbList = ($hotfixes | Select-Object -ExpandProperty HotFixID) -join ', '
        $findings += "Relevant KB(s) installed: $kbList"
    } else {
        $findings += 'No relevant KBs detected via Get-HotFix (may be superseded by later CU)'
    }

    # Determine overall verdict
    $secureBootOn = $false
    try { $secureBootOn = Confirm-SecureBootUEFI } catch { }

    $enforcementSet = ($null -ne $avail) -and (($avail -band 0x30) -eq 0x30)

    if ($secureBootOn -and $enforcementSet) {
        $result = 'PATCHED'
    } elseif (-not $secureBootOn) {
        $result = 'VULNERABLE'
    } elseif (-not $enforcementSet) {
        $result = 'VULNERABLE'
    } else {
        $result = 'UNKNOWN'
    }

} catch {
    $findings += "Error during check: $_"
    $result = 'UNKNOWN'
}

Write-Host ''
Write-Host '=== CVE-2022-21894 (Baton Drop) Assessment ===' -ForegroundColor Cyan
foreach ($f in $findings) {
    Write-Host "  [*] $f"
}
Write-Host ''
switch ($result) {
    'PATCHED'    { Write-Host "RESULT: PATCHED - DBX revocation enforcement is active" -ForegroundColor Green; exit 0 }
    'VULNERABLE' { Write-Host "RESULT: VULNERABLE - DBX revocation NOT enforced, exploit chain viable" -ForegroundColor Red; exit 1 }
    'UNKNOWN'    { Write-Host "RESULT: UNKNOWN - Could not determine protection status" -ForegroundColor Yellow; exit 2 }
}