winpe: add customization script and some more debugging notes

Also add a warning that the WinPE-based exploitation strategy might
be less reliable than its Linux-based counterpart.

README.md

@@ -13,7 +13,7 @@ which was followed up by two blog posts:
 
 This repository reproduces the original research performed by Thomas based on his talk and blog posts.
 The used Linux kernel exploit ([blog](https://pwning.tech/nftables/),
-[PoC](https://github.com/Notselwyn/CVE-2024-1086])) for CVE-2024-1086 was 
+[PoC](https://github.com/Notselwyn/CVE-2024-1086)) for CVE-2024-1086 was
 written by [@notselwyn](https://twitter.com/notselwyn).
 
 Parallel to this work [Andreas Grasser](https://github.com/andigandhi/bitpixie) also 
@@ -204,6 +204,10 @@ exploit && ./mount.sh /dev/XYZ && ls mnt
 
 ### WinPE-based Exploitation
 
+> [!warning]
+> The WinPE-based approach seems to be less reliable than its Linux-based
+> counterpart.
+
 For the WinPE-based exploitation strategy, two BCD files will be needed.
 
 ```
@@ -261,8 +265,8 @@ which initiates the loading of WinPE from a ramdisk.
 > ```
 
 > [!note]
-> I automated these steps using a GDB script. However, the resulting setup was somehow
-> less reliable than performing the changes manually.
+> I automated these steps using a GDB script in [`start-pxe-winpe.sh`](./pxe/start-pxe-winpe.sh).
+> However, this might be less reliable than performing the changes manually.
 
 ### Boot into WinPE
 
@@ -332,8 +336,9 @@ manage-bde -unlock B: -RecoveryPassword 123456-789012-345678-901234-567890-12345
 
 > [!warning]
 > Unfortunately, the running WinPE instance does not have a working
-> BitLocker setup. I built my own, but then the key would no longer
-> be in memory. Needs more investigation.
+> BitLocker setup. It is [possible to use a customized version](./winpe/Customize-WinPE.ps1),
+> but this is currently not integrated in the automated build process and
+> successful exploitation sofar used the default image.
 >
 > At this point I would suggest to once more boot into the native recovery
 > environment where you should be able to unlock the disk.

pxe/start-pxe-winpe.sh

@@ -5,7 +5,7 @@
 scriptpath="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
 interface=$1
 
-#sudo ip a add 10.13.37.100/24 dev $interface
+sudo ip a add 10.13.37.100/24 dev $interface
 
 cat <<'EOF' > "$scriptpath/dnsmasq.winpe.gdb"
 set breakpoint pending on

winpe/Customize-WinPE.ps1

@@ -0,0 +1,93 @@
+<#
+.SYNOPSIS
+	Customizes a Windows Preinstallation Environment (WinPE) boot image to add BitLocker support.
+
+.DESCRIPTION
+	This function automates the process of mounting, modifying, and optimizing a WinPE boot image.
+	It adds necessary components for BitLocker, performs cleanup, and reduces image size for deployment.
+	It follows the steps described in the official documentation:
+	
+	  https://learn.microsoft.com/en-us/windows/deployment/customize-boot-image
+
+.PARAMETER WinPEMountPoint
+	Specifies the (temporary) directory where the WinPE image will be mounted. This parameter is required.
+
+.PARAMETER BasePath
+	Specifies the base directory of the Windows Assessment and Deployment Kit (ADK) installation.
+	Default: "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64".
+
+.PARAMETER DismExe
+	Specifies the path to the Deployment Image Servicing and Management (DISM) executable.
+	Default: "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\dism.exe".
+
+.EXAMPLE
+	Customize-WinPE -WinPEMountPoint "C:\winpe-bitpixie"
+
+#>
+function Customize-WinPE {
+	param (
+		[Parameter(Mandatory = $true)]
+		[string]$WinPEMountPoint,
+		[string]$BasePath = "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64",
+		[string]$DismExe = "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\dism.exe"
+	)
+
+	# Ensure the WinPE mount point directory exists
+	if (-Not (Test-Path $WinPEMountPoint)) {
+		New-Item -ItemType Directory -Path $WinPEMountPoint -Force | Out-Null
+	}
+
+	$WimImage = "$BasePath\en-us\winpe.wim"
+	
+	# Step 1: Skip download and install ADK
+	# Step 2: Skip download of cumulative update
+
+	# Step 3: Backup existing image
+	if (-Not (Test-Path "$WimImage.backup")) {
+		Copy-Item -Path $WimImage -Destination "$WimImage.backup"
+	}
+	
+	# Step 4: Mount boot image to mount folder
+	Mount-WindowsImage -Path $WinPEMountPoint -ImagePath $WimImage -Index 1
+	
+	# Step 5: Skip add drivers to boot image, unless needed for specific hardware
+	
+	# Step 6: Add optional components to boot image
+	$PackagePath = "$BasePath\WinPE_OCs"
+	$Packages = @(
+		"WinPE-WMI.cab",
+		"WinPE-SecureStartup.cab",
+		"WinPE-NetFX.cab",
+		"WinPE-Scripting.cab",
+		"WinPE-PowerShell.cab",
+		"WinPE-FMAPI.cab",
+		"WinPE-SecureBootCmdlets.cab",
+		"WinPE-EnhancedStorage.cab"
+	)
+	
+	foreach ($Package in $Packages) {
+		Add-WindowsPackage -PackagePath "$PackagePath\$Package" -Path $WinPEMountPoint
+		$EnUSPackage = "$PackagePath\en-us\$($Package -replace '\.cab$', '_en-us.cab')"
+		if (Test-Path $EnUSPackage) {
+			Add-WindowsPackage -PackagePath $EnUSPackage -Path $WinPEMountPoint
+		}
+	}
+	
+	# Step 7: Skip add cumulative update (CU) to boot image
+
+	# Step 8: Skip Copy boot files from mounted boot image to ADK installation path
+
+	# Step 9: Perform component cleanup
+	Start-Process "$DismExe" -ArgumentList " /Image:`"$WinPEMountPoint`" /Cleanup-image /StartComponentCleanup /Resetbase /Defer" -Wait -LoadUserProfile
+	Start-Process "$DismExe" -ArgumentList " /Image:`"$WinPEMountPoint`" /Cleanup-image /StartComponentCleanup /Resetbase" -Wait -LoadUserProfile
+	
+	# Step 10: Verify all desired packages have been added to boot image
+	Get-WindowsPackage -Path $WinPEMountPoint
+	
+	# Step 11: Unmount boot image and save changes
+	Dismount-WindowsImage -Path $WinPEMountPoint -Save -Verbose
+	
+	# Step 12: Export boot image to reduce size
+	Export-WindowsImage -SourceImagePath $WimImage -SourceIndex 1 -DestinationImagePath "$WimImage.export" -CompressionType max -Verbose
+	Move-Item -Path "$WimImage.export" -Destination $WimImage -Force
+}

winpe/README.md

@@ -0,0 +1,34 @@
+This directory contains build and helper scripts for WinPE based attack strategies.
+
+The shell scripts are executed within an Alpine Linux container started
+from the top-level Makefile when invoking `make winpe`:
+
+ - `download-winpe.sh` downloads a Windows 11 ISO and extracts the WinPE image and ramdisk
+ - `build-search-vmk.sh` builds the generic [`search-vmk` utility](../search-vmk/) for Windows
+ - `build-dislocker-metadata.sh` builds the minimal Windows port of
+   [disklocker-metadata](https://github.com/martanne/dislocker-metadata-win32) to recover the
+   human readable BitLocker recovery password given the VMK
+
+The [`Customize-WinPE.ps1` PowerShell] script is intended to create a customized
+WinPE environment with BitLocker support by automating the steps outlined in the
+[official Microsoft documentation](https://learn.microsoft.com/en-us/windows/deployment/customize-boot-image).
+
+It requires that the [Windows ADK](https://learn.microsoft.com/en-us/windows-hardware/get-started/adk-install)
+(`adksetup.exe`) as well as the [Windows PE add-on for the Windows ADK](https://go.microsoft.com/fwlink/?linkid=2289981)
+(`adkwinpesetup.exe`) have already been installed.
+
+Assuming default installation location of these, a customized WinPE environment
+with all required components for BitLocker support can be built with:
+
+```
+PS C:\> Customize-WinPE -WinPEMountPoint "C:\winpe-bitlocker"
+```
+
+The above procedure updated the default `winpe.wim` image from the ADK, based on
+which the necessary files can be extracted:
+
+ 1. Start elevated instance of *Deployment and Imaging Tools Environment*
+ 2. Create WinPE environment `copype amd64 c:\winpe-bitpixie`
+ 3. Copy the required files to the `Boot` directory of your TFTP server:
+     - `C:\winpe-bitpixie\media\boot\boot.sdi`
+     - `C:\winpe-bitpixie\media\sources\boot.wim