diff --git a/README.md b/README.md index f4812af..22adae4 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,7 @@ which was followed up by two blog posts: This repository reproduces the original research performed by Thomas based on his talk and blog posts. The used Linux kernel exploit ([blog](https://pwning.tech/nftables/), -[PoC](https://github.com/Notselwyn/CVE-2024-1086])) for CVE-2024-1086 was +[PoC](https://github.com/Notselwyn/CVE-2024-1086)) for CVE-2024-1086 was written by [@notselwyn](https://twitter.com/notselwyn). Parallel to this work [Andreas Grasser](https://github.com/andigandhi/bitpixie) also @@ -204,6 +204,10 @@ exploit && ./mount.sh /dev/XYZ && ls mnt ### WinPE-based Exploitation +> [!warning] +> The WinPE-based approach seems to be less reliable than its Linux-based +> counterpart. + For the WinPE-based exploitation strategy, two BCD files will be needed. ``` @@ -261,8 +265,8 @@ which initiates the loading of WinPE from a ramdisk. > ``` > [!note] -> I automated these steps using a GDB script. However, the resulting setup was somehow -> less reliable than performing the changes manually. +> I automated these steps using a GDB script in [`start-pxe-winpe.sh`](./pxe/start-pxe-winpe.sh). +> However, this might be less reliable than performing the changes manually. ### Boot into WinPE @@ -332,8 +336,9 @@ manage-bde -unlock B: -RecoveryPassword 123456-789012-345678-901234-567890-12345 > [!warning] > Unfortunately, the running WinPE instance does not have a working -> BitLocker setup. I built my own, but then the key would no longer -> be in memory. Needs more investigation. +> BitLocker setup. It is [possible to use a customized version](./winpe/Customize-WinPE.ps1), +> but this is currently not integrated in the automated build process and +> successful exploitation sofar used the default image. > > At this point I would suggest to once more boot into the native recovery > environment where you should be able to unlock the disk. diff --git a/pxe/start-pxe-winpe.sh b/pxe/start-pxe-winpe.sh index f1f8f0d..482f519 100755 --- a/pxe/start-pxe-winpe.sh +++ b/pxe/start-pxe-winpe.sh @@ -5,7 +5,7 @@ scriptpath="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )" interface=$1 -#sudo ip a add 10.13.37.100/24 dev $interface +sudo ip a add 10.13.37.100/24 dev $interface cat <<'EOF' > "$scriptpath/dnsmasq.winpe.gdb" set breakpoint pending on diff --git a/winpe/Customize-WinPE.ps1 b/winpe/Customize-WinPE.ps1 new file mode 100644 index 0000000..6dfe603 --- /dev/null +++ b/winpe/Customize-WinPE.ps1 @@ -0,0 +1,93 @@ +<# +.SYNOPSIS + Customizes a Windows Preinstallation Environment (WinPE) boot image to add BitLocker support. + +.DESCRIPTION + This function automates the process of mounting, modifying, and optimizing a WinPE boot image. + It adds necessary components for BitLocker, performs cleanup, and reduces image size for deployment. + It follows the steps described in the official documentation: + + https://learn.microsoft.com/en-us/windows/deployment/customize-boot-image + +.PARAMETER WinPEMountPoint + Specifies the (temporary) directory where the WinPE image will be mounted. This parameter is required. + +.PARAMETER BasePath + Specifies the base directory of the Windows Assessment and Deployment Kit (ADK) installation. + Default: "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64". + +.PARAMETER DismExe + Specifies the path to the Deployment Image Servicing and Management (DISM) executable. + Default: "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\dism.exe". + +.EXAMPLE + Customize-WinPE -WinPEMountPoint "C:\winpe-bitpixie" + +#> +function Customize-WinPE { + param ( + [Parameter(Mandatory = $true)] + [string]$WinPEMountPoint, + [string]$BasePath = "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Windows Preinstallation Environment\amd64", + [string]$DismExe = "C:\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\amd64\DISM\dism.exe" + ) + + # Ensure the WinPE mount point directory exists + if (-Not (Test-Path $WinPEMountPoint)) { + New-Item -ItemType Directory -Path $WinPEMountPoint -Force | Out-Null + } + + $WimImage = "$BasePath\en-us\winpe.wim" + + # Step 1: Skip download and install ADK + # Step 2: Skip download of cumulative update + + # Step 3: Backup existing image + if (-Not (Test-Path "$WimImage.backup")) { + Copy-Item -Path $WimImage -Destination "$WimImage.backup" + } + + # Step 4: Mount boot image to mount folder + Mount-WindowsImage -Path $WinPEMountPoint -ImagePath $WimImage -Index 1 + + # Step 5: Skip add drivers to boot image, unless needed for specific hardware + + # Step 6: Add optional components to boot image + $PackagePath = "$BasePath\WinPE_OCs" + $Packages = @( + "WinPE-WMI.cab", + "WinPE-SecureStartup.cab", + "WinPE-NetFX.cab", + "WinPE-Scripting.cab", + "WinPE-PowerShell.cab", + "WinPE-FMAPI.cab", + "WinPE-SecureBootCmdlets.cab", + "WinPE-EnhancedStorage.cab" + ) + + foreach ($Package in $Packages) { + Add-WindowsPackage -PackagePath "$PackagePath\$Package" -Path $WinPEMountPoint + $EnUSPackage = "$PackagePath\en-us\$($Package -replace '\.cab$', '_en-us.cab')" + if (Test-Path $EnUSPackage) { + Add-WindowsPackage -PackagePath $EnUSPackage -Path $WinPEMountPoint + } + } + + # Step 7: Skip add cumulative update (CU) to boot image + + # Step 8: Skip Copy boot files from mounted boot image to ADK installation path + + # Step 9: Perform component cleanup + Start-Process "$DismExe" -ArgumentList " /Image:`"$WinPEMountPoint`" /Cleanup-image /StartComponentCleanup /Resetbase /Defer" -Wait -LoadUserProfile + Start-Process "$DismExe" -ArgumentList " /Image:`"$WinPEMountPoint`" /Cleanup-image /StartComponentCleanup /Resetbase" -Wait -LoadUserProfile + + # Step 10: Verify all desired packages have been added to boot image + Get-WindowsPackage -Path $WinPEMountPoint + + # Step 11: Unmount boot image and save changes + Dismount-WindowsImage -Path $WinPEMountPoint -Save -Verbose + + # Step 12: Export boot image to reduce size + Export-WindowsImage -SourceImagePath $WimImage -SourceIndex 1 -DestinationImagePath "$WimImage.export" -CompressionType max -Verbose + Move-Item -Path "$WimImage.export" -Destination $WimImage -Force +} diff --git a/winpe/README.md b/winpe/README.md new file mode 100644 index 0000000..42a48ad --- /dev/null +++ b/winpe/README.md @@ -0,0 +1,34 @@ +This directory contains build and helper scripts for WinPE based attack strategies. + +The shell scripts are executed within an Alpine Linux container started +from the top-level Makefile when invoking `make winpe`: + + - `download-winpe.sh` downloads a Windows 11 ISO and extracts the WinPE image and ramdisk + - `build-search-vmk.sh` builds the generic [`search-vmk` utility](../search-vmk/) for Windows + - `build-dislocker-metadata.sh` builds the minimal Windows port of + [disklocker-metadata](https://github.com/martanne/dislocker-metadata-win32) to recover the + human readable BitLocker recovery password given the VMK + +The [`Customize-WinPE.ps1` PowerShell] script is intended to create a customized +WinPE environment with BitLocker support by automating the steps outlined in the +[official Microsoft documentation](https://learn.microsoft.com/en-us/windows/deployment/customize-boot-image). + +It requires that the [Windows ADK](https://learn.microsoft.com/en-us/windows-hardware/get-started/adk-install) +(`adksetup.exe`) as well as the [Windows PE add-on for the Windows ADK](https://go.microsoft.com/fwlink/?linkid=2289981) +(`adkwinpesetup.exe`) have already been installed. + +Assuming default installation location of these, a customized WinPE environment +with all required components for BitLocker support can be built with: + +``` +PS C:\> Customize-WinPE -WinPEMountPoint "C:\winpe-bitlocker" +``` + +The above procedure updated the default `winpe.wim` image from the ADK, based on +which the necessary files can be extracted: + + 1. Start elevated instance of *Deployment and Imaging Tools Environment* + 2. Create WinPE environment `copype amd64 c:\winpe-bitpixie` + 3. Copy the required files to the `Boot` directory of your TFTP server: + - `C:\winpe-bitpixie\media\boot\boot.sdi` + - `C:\winpe-bitpixie\media\sources\boot.wim