33 Commits

Author SHA1 Message Date
Marc André Tanner 519d6f74d7 Fix smb script to work with distribution packaged impacket version 2025-10-28 17:17:31 +01:00
Marc André Tanner 5fa1bca754 Reference alternative ways to enter WinRE 2025-10-20 20:29:12 +02:00
DanieledG a545bfcc28 update latest windows version 2025-10-07 09:14:44 +02:00
Marc André Tanner d358c0a817 Add reference to Compass Security blog post 2025-07-21 07:53:11 +02:00
Marc André Tanner 1a3fcbd144 Update documentation
Include video demonstrations in README, reference relevant WinPE
related issue discussion and wiki page.
2025-07-07 22:42:50 +02:00
kmille 3069e81565 Add some debugging hints in the docs 2025-07-06 12:22:21 +02:00
Marc André Tanner 13cb63e400 winpe: update drive letter in documentation
Should have been part of eb2c61558f.
2025-06-27 21:57:12 +02:00
Skyler Brivic f1f7e7de07 Changed PWD to CURDIR in Makefile to improve Linux compatibility 2025-06-25 19:49:48 -07:00
Marc André Tanner ffef2635a6 winpe: compile dislocker-metadata.exe with 64-bit off_t type
This might fix support for partitions starting after 2^31-1 bytes.
2025-06-24 21:07:02 +02:00
Marc André Tanner eb2c61558f winpe: remove drive letter assignment from documentation
This is not necessary because a drive letter is usually auto assigned
and this might just cause more confusion.
2025-06-24 21:06:14 +02:00
Marc André Tanner 9014aa2815 winpe: fix typos in documentation 2025-06-04 21:23:47 +02:00
Marc André Tanner 7590d72d64 winpe: improve compatibility of GDB automation
Previously it would fail if no symbol table for libc was available,
because the named first argument used in the break point condition
would not be found. Instead, use registers according to the calling
convention for x86_64 and aarch64 and fall back to the named argument
(relying on symbols) for other architectures.
2025-05-21 22:01:00 +02:00
Marc André Tanner 4f4da6c196 winpe: make sure second stage boot manager actually exists
The same boot manager is used for both stages. A dfferent file name
is only used to detect the loading of the second stage to swap out
the served BCD.

This should have been part of 28bfedb610
where the instructions were changed from the manual to the GDB based
method.
2025-05-18 21:23:36 +02:00
Marc André Tanner 5671032707 Add a few more device models to the success stories 2025-05-15 10:11:21 +02:00
Marc André Tanner 58c15c6cda linux: synchronize used Alpine version
At the moment individual components are built using a specific Alpine
version (3.20.3) as specifed on the command line for the various docker
commands.

However, alpine-make-rootfs(1) was called with ALPINE_BRANCH=edge,
resulting in a newer initramfs than expected by indvividual packages
such as dislocker. This version mismatch caused runtime errors because
shared libraries were not found.

A fixed Alpine version was initially chosen in hope to get a more
stable/reproducable setup, but maybe it would make more sense to just
always use the latest stable version.

Should hopefully fix #6.
2025-05-15 08:57:02 +02:00
Marc André Tanner 28bfedb610 winpe: enable/recommend GDB automation
It is unlikely that the GDB automation is the reason for the flakiness.
2025-03-28 21:48:15 +01:00
Marc André Tanner 137174e45d winpe: Update README with new instructions 2025-03-18 21:26:08 +01:00
Marc André Tanner 66b9fa2a3c winpe: use modified version of WinPmem instead of DumpIt
This does not perform a full memory dump, but instead searches
incrementally and stops after the first match.
2025-03-18 21:25:28 +01:00
Marc André Tanner 1148128d17 winpe: add customization script and some more debugging notes
Also add a warning that the WinPE-based exploitation strategy might
be less reliable than its Linux-based counterpart.
2025-03-18 07:13:23 +01:00
Marc André Tanner d200843737 winpe: improve second stage exploitation script
Abort in case VMK is not found. Include diskpart documentation as wimc
is not available, fix typo and provide more specific example command.
2025-03-12 18:13:35 +01:00
Marc André Tanner f323724392 winpe: use 7zip to extract files instead of mounting the iso
This should hopefully avoid problems with mounting the ISO in certain
setups and avoid the need for a privileged container.
2025-03-12 06:38:31 +01:00
Sylvain Heiniger 364ce66645 Update README.md 2025-02-26 14:25:56 +01:00
Marc André Tanner 403459e155 Update README with WinPE exploitation 2025-02-26 11:56:56 +01:00
Marc André Tanner 5995eff4a5 Add high-level wrapper scripts for exploitation convenience 2025-02-26 11:29:15 +01:00
Marc André Tanner e1332680d6 Add WinPE based exploitation environment 2025-02-26 10:42:14 +01:00
Marc André Tanner 487efc201b Implement generic VMK search tool
Given a raw memory dump, search for a VMK and optionally store it
in a file.
2025-02-26 10:42:14 +01:00
Marc André Tanner 3f841cbbcd Move initramfs generation into subfolder 2025-02-26 10:42:14 +01:00
Marc André Tanner 7b5545c64e Rename Linux related artifact download scripts 2025-02-26 09:54:30 +01:00
Marc André Tanner 57611da4ca Rename BCD generation script and resulting configuration file 2025-02-26 09:54:30 +01:00
Marc André Tanner 9c84a43741 Update README
Fix typos, add section about working devices, provide additional
information regarding the source of `bootmgfw.efi`.
2025-02-06 10:37:29 +01:00
Marc André Tanner 8ff4a49e23 Add basic README 2025-02-03 14:08:04 +01:00
Marc André Tanner 3322e67fe4 Add PXE boot helper scripts
Except for the Windows boot manager the necesary artifacts are downloaded
from public resources.

This work was done in parallel and drew some inspiration from similar
avenues by Andreas Grasser.

 https://github.com/andigandhi/bitpixie
2025-01-31 17:52:37 +01:00
Marc André Tanner bd07ff3052 Import initramfs generation scripts for bitpixie exploitation
It is based on a stripped down version of Filippo Valsorda's rootfs-free
immutable NAS project with various bitpixie related hacks added.

 https://words.filippo.io/dispatches/frood/
2025-01-31 16:40:19 +01:00