By simply having Ring 0(kernel mode) one can place EFI variables into NVRAM via EFI runtime services. If one of these variables is scanned as a valid FFV, that gives execute at level of Ring-1, from there modifying the SPI contents of the flash chip to re-write the Intel ME / Intel Gigabit Ethernet is possible. By flashing an old version of the Intel ME(or better the Intel AMT) one can take advantage of known CVEs in the Intel ME giving Ring-3. From here one can inject any SMBios of their choosing and maintain Ring-2 every boot. This allows for a evil actor to run their own stack during any OS load or reinstall. By using AMT ramdisks, EFI drivers, and modifying the ACPI tables they can then live in Ring 0 cooperatively with any OS that is installed.
Booting Into a Decent Shell
After some working around various issues I finally got into a decent EFI v2.2 shell. The first five entries in the handle table were what are known as“FFV” or flash-firmware-volume entries. This implies that the lion share of this is happening one of two ways: the flash chip has been somehow updated to a version of EFI that it should not contain, or two that something is persisting to disk and performing a restore in a way that it is not possible to reset with only pulling the power cable out of the device. It is clearly running vPro and the AMT stack, and has created an entry of a ramdisk entry(shows in the table) as well as loading a number of drivers and Dxe’s that are to say the least, unexpected.
Speculation on How EFI was Modified:
Booting Into a Decent Shell