Borrowing a Microsoft-signed shim to abuse Secure Boot on corporate hardware

The piece explains a way to boot a custom Linux environment on some corporate computers without disabling Secure Boot or knowing the firmware password. Its central point is that Secure Boot verifies signatures in a boot chain; it does not necessarily restrict a computer to one operating system. Many systems trust Microsoft’s third-party UEFI certificate, which allows signed Linux boot components to run. Linux distributions use a shim - a Microsoft-signed intermediary - to support changing bootloaders and kernels, with Machine Owner Key (MOK) enrollment allowing users to add their own signing key.

The demonstrated approach reuses a Microsoft-signed shim, pairs it with a custom-signed bootloader and kernel, and uses the shim’s enrollment utility to add the custom key. If a target machine trusts the relevant certificate, permits booting from external media, and someone can physically access it, they can select the external drive and approve enrollment at the firmware screen, then boot the prepared system. The author presents this as a practical limitation in Secure Boot’s protection against EFI-level malware, not as a universal bypass: certificate availability varies by hardware and configuration, and the method depends on an enrollment prompt being accepted. The technique is also being incorporated into p3ng0s, the author’s Linux-based toolkit for physical security engagements and red-team work.