{"id":532817,"date":"2025-09-26T08:43:53","date_gmt":"2025-09-26T08:43:53","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&p=532817"},"modified":"2025-09-26T08:43:53","modified_gmt":"2025-09-26T08:43:53","slug":"verifier-vulnerabilites-pkfail-avec-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/verifier-vulnerabilites-pkfail-avec-powershell\/","title":{"rendered":"Comment v\u00e9rifier les vuln\u00e9rabilit\u00e9s de PKFail avec PowerShell"},"content":{"rendered":"

Les menaces au niveau des microprogrammes (firmware) attirent de plus en plus l’attention des \u00e9quipes de s\u00e9curit\u00e9 en raison de leur capacit\u00e9 \u00e0 contourner les protections traditionnelles au niveau du syst\u00e8me d’exploitation. L’une de ces vuln\u00e9rabilit\u00e9s \u00e9mergentes est\u00a0PKFail<\/strong>, qui implique des cl\u00e9s de plateforme de d\u00e9marrage s\u00e9curis\u00e9 (PK) compromises ou mal sign\u00e9es. Dans ce contexte, les entreprises doivent s’assurer que leurs syst\u00e8mes ne sont pas expos\u00e9s \u00e0 des configurations de microprogrammes non s\u00e9curis\u00e9es. Pour les professionnels de l’informatique et les fournisseurs de services g\u00e9r\u00e9s (MSP)<\/a>, il est essentiel d’automatiser la d\u00e9tection de ces vuln\u00e9rabilit\u00e9s. Dans cet article, vous apprendrez comment v\u00e9rifier les vuln\u00e9rabilit\u00e9s de PKFail avec PowerShell<\/strong>.<\/p>\n

Contexte<\/h2>\n

La\u00a0vuln\u00e9rabilit\u00e9 PKFail<\/strong>\u00a0est centr\u00e9e sur Secure Boot, une fonction de s\u00e9curit\u00e9 UEFI essentielle qui garantit que seuls les micrologiciels et les chargeurs de syst\u00e8me d’exploitation approuv\u00e9s sont ex\u00e9cut\u00e9s au cours du processus de d\u00e9marrage. Les syst\u00e8mes dont les cl\u00e9s de signature sont \u00e9tiquet\u00e9es avec des marqueurs tels que \u00ab\u00a0DO NOT TRUST\u00a0\u00bb ou \u00ab\u00a0DO NOT SHIP\u00a0\u00bb sont susceptibles de faire l’objet d’attaques dues \u00e0 des cl\u00e9s de signature non autoris\u00e9es ou ne faisant pas partie de la production, qui sont laiss\u00e9es dans des microprogrammes de production.<\/p>\n

Des fournisseurs tels qu’Intel et Supermicro ont reconnu cette vuln\u00e9rabilit\u00e9, et des outils sont apparus pour faciliter la d\u00e9tection. Cependant, pour les \u00e9quipes informatiques qui g\u00e8rent des flottes d’appareils Windows, une solution scriptable et \u00e9volutive est essentielle. Ceci est particuli\u00e8rement vrai pour les fournisseurs de services g\u00e9r\u00e9s (MSP) qui s’appuient sur des plateformes telles que\u00a0NinjaOne<\/strong>\u00a0pour maintenir la conformit\u00e9 et la s\u00e9curit\u00e9 dans les diff\u00e9rents environnements de leurs clients.<\/p>\n

Le script<\/h2>\n
<#\r\n.SYNOPSIS\r\n    Checks for the PKFail vulnerability.\r\n.DESCRIPTION\r\n    Checks the PK(Platform Key) variable for 'DO NOT TRUST' or 'DO NOT SHIP'.\r\n    Can save a result of 'Trusted' or 'Not Trusted' to a custom field.\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n\r\n.EXAMPLE\r\n    (No Parameters)\r\n\r\n    Secure Boot is Trusted\r\n\r\n.EXAMPLE\r\n    (No Parameters)\r\n\r\n    Secure Boot is Not Trusted\r\n\r\nPARAMETER: -CustomField \"ReplaceMeWithAnyMultilineCustomField\"\r\n    Name of a custom field to save the PKFail status to with either Trusted or Not Trusted.\r\n.EXAMPLE\r\n    -CustomField \"SecureBootPK\"\r\n\r\n    Attempting to set Custom Field 'SecureBootPK'.\r\n    Successfully set Custom Field 'SecureBootPK'!\r\n    Secure Boot is Trusted\r\n\r\n.NOTES\r\n    Minimum OS Supported: Windows 10, Windows Server 2016\r\n\r\n.LINK\r\n    https:\/\/github.com\/binarly-io\/Vulnerability-REsearch\/blob\/main\/PKfail\/BRLY-2024-005.md\r\n    https:\/\/www.intel.com\/content\/www\/us\/en\/security-center\/announcement\/intel-security-announcement-2024-07-25-001.html\r\n    https:\/\/www.supermicro.com\/en\/support\/security_PKFAIL_Jul_2024\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$CustomField\r\n)\r\n\r\nbegin {\r\n    function Set-NinjaProperty {\r\n        [CmdletBinding()]\r\n        Param(\r\n            [Parameter(Mandatory = $True)]\r\n            [String]$Name,\r\n            [Parameter()]\r\n            [String]$Type,\r\n            [Parameter(Mandatory = $True, ValueFromPipeline = $True)]\r\n            $Value,\r\n            [Parameter()]\r\n            [String]$DocumentName\r\n        )\r\n        \r\n        $Characters = $Value | Out-String | Measure-Object -Character | Select-Object -ExpandProperty Characters\r\n        if ($Characters -ge 200000) {\r\n            throw [System.ArgumentOutOfRangeException]::New(\"Character limit exceeded: the value is greater than or equal to 200,000 characters.\")\r\n        }\r\n            \r\n        # If requested to set the field value for a Ninja document, specify it here.\r\n        $DocumentationParams = @{}\r\n        if ($DocumentName) { $DocumentationParams[\"DocumentName\"] = $DocumentName }\r\n            \r\n        # This is a list of valid fields that can be set. If no type is specified, assume that the input does not need to be changed.\r\n        $ValidFields = \"Attachment\", \"Checkbox\", \"Date\", \"Date or Date Time\", \"Decimal\", \"Dropdown\", \"Email\", \"Integer\", \"IP Address\", \"MultiLine\", \"MultiSelect\", \"Phone\", \"Secure\", \"Text\", \"Time\", \"URL\", \"WYSIWYG\"\r\n        if ($Type -and $ValidFields -notcontains $Type) { Write-Warning \"$Type is an invalid type. Please check here for valid types: https:\/\/ninjarmm.zendesk.com\/hc\/en-us\/articles\/16973443979789-Command-Line-Interface-CLI-Supported-Fields-and-Functionality\" }\r\n            \r\n        # The field below requires additional information to set.\r\n        $NeedsOptions = \"Dropdown\"\r\n        if ($DocumentName) {\r\n            if ($NeedsOptions -contains $Type) {\r\n                # Redirect error output to the success stream to handle errors more easily if nothing is found or something else goes wrong.\r\n                $NinjaPropertyOptions = Ninja-Property-Docs-Options -AttributeName $Name @DocumentationParams 2>&1\r\n            }\r\n        }\r\n        else {\r\n            if ($NeedsOptions -contains $Type) {\r\n                $NinjaPropertyOptions = Ninja-Property-Options -Name $Name 2>&1\r\n            }\r\n        }\r\n            \r\n        # If an error is received with an exception property, exit the function with that error information.\r\n        if ($NinjaPropertyOptions.Exception) { throw $NinjaPropertyOptions }\r\n            \r\n        # The types below require values not typically given to be set. The code below will convert whatever we're given into a format ninjarmm-cli supports.\r\n        switch ($Type) {\r\n            \"Checkbox\" {\r\n                # Although it's highly likely we were given a value like \"True\" or a boolean data type, it's better to be safe than sorry.\r\n                $NinjaValue = [System.Convert]::ToBoolean($Value)\r\n            }\r\n            \"Date or Date Time\" {\r\n                # Ninjarmm-cli expects the GUID of the option to be selected. Therefore, match the given value with a GUID.\r\n                $Date = (Get-Date $Value).ToUniversalTime()\r\n                $TimeSpan = New-TimeSpan (Get-Date \"1970-01-01 00:00:00\") $Date\r\n                $NinjaValue = $TimeSpan.TotalSeconds\r\n            }\r\n            \"Dropdown\" {\r\n                # Ninjarmm-cli expects the GUID of the option we're trying to select, so match the value we were given with a GUID.\r\n                $Options = $NinjaPropertyOptions -replace '=', ',' | ConvertFrom-Csv -Header \"GUID\", \"Name\"\r\n                $Selection = $Options | Where-Object { $_.Name -eq $Value } | Select-Object -ExpandProperty GUID\r\n            \r\n                if (-not $Selection) {\r\n                    throw [System.ArgumentOutOfRangeException]::New(\"Value is not present in dropdown options.\")\r\n                }\r\n            \r\n                $NinjaValue = $Selection\r\n            }\r\n            default {\r\n                # All the other types shouldn't require additional work on the input.\r\n                $NinjaValue = $Value\r\n            }\r\n        }\r\n            \r\n        # Set the field differently depending on whether it's a field in a Ninja Document or not.\r\n        if ($DocumentName) {\r\n            $CustomField = Ninja-Property-Docs-Set -AttributeName $Name -AttributeValue $NinjaValue @DocumentationParams 2>&1\r\n        }\r\n        else {\r\n            $CustomField = $NinjaValue | Ninja-Property-Set-Piped -Name $Name 2>&1\r\n        }\r\n            \r\n        if ($CustomField.Exception) {\r\n            throw $CustomField\r\n        }\r\n    }\r\n\r\n    if ($env:customFieldName -and $env:customFieldName -notlike \"null\") {\r\n        $CustomField = $env:customFieldName\r\n    }\r\n\r\n    # Check if Secure Boot is supported on the system\r\n    try {\r\n        Get-SecureBootUEFI -Name PK -ErrorAction Stop | Out-Null\r\n    }\r\n    catch {\r\n        if ($_.Exception.Message -like \"*Cmdlet not supported on this platform*\") {\r\n            Write-Host \"[Error] System does not support Secure Boot or is a BIOS (Non-UEFI) system.\"\r\n            exit 1\r\n        }\r\n        elseif ($_.Exception.Message -like \"*Variable is currently undefined*\") {\r\n            Write-Host \"[Error] PK variable is not defined.\"\r\n            exit 1\r\n        }\r\n    }\r\n\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Host \"[Error] Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n}\r\nprocess {\r\n\r\n    # Secure Boot PK cert status\r\n    try {\r\n        if ([System.Text.Encoding]::ASCII.GetString((Get-SecureBootUEFI -Name PK).bytes) -match \"DO NOT TRUST|DO NOT SHIP\") {\r\n            $SecureBootPK = \"Not Trusted\"\r\n            Write-Host \"[Alert] Secure Boot is $SecureBootPK\"\r\n        }\r\n        else {\r\n            $SecureBootPK = \"Trusted\"\r\n            Write-Host \"[Info] Secure Boot is $SecureBootPK\"\r\n        }\r\n    }\r\n    catch {\r\n        Write-Host \"[Error] Get-SecureBootUEFI return error: $($_.Exception.Message)\"\r\n        exit 1\r\n    }\r\n\r\n    if ($CustomField) {\r\n        try {\r\n            Write-Host \"[Info] Attempting to set Custom Field '$CustomField'.\"\r\n            Set-NinjaProperty -Name $CustomField -Value $SecureBootPK\r\n            Write-Host \"[Info] Successfully set Custom Field '$CustomField'!\"\r\n        }\r\n        catch {\r\n            Write-Host \"[Warn] Failed to set Custom Field '$CustomField'.\"\r\n            Write-Host \"[Warn] $($_.Exception.Message)\"\r\n        }\r\n    }\r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}<\/pre>\n
 <\/p>\n\n
Description d\u00e9taill\u00e9e<\/h2>\n
Ce script PowerShell<\/a> automatise la d\u00e9tection de la vuln\u00e9rabilit\u00e9 PKFail et enregistre \u00e9ventuellement le r\u00e9sultat dans un champ personnalis\u00e9 NinjaOne. Voici comment\u00a0:<\/p>\n
    \n
  1. Initialisation et param\u00e8tres<\/strong>\n