17 Commits

Author SHA1 Message Date
Marc André Tanner 519d6f74d7 Fix smb script to work with distribution packaged impacket version 2025-10-28 17:17:31 +01:00
Marc André Tanner eb2c61558f winpe: remove drive letter assignment from documentation
This is not necessary because a drive letter is usually auto assigned
and this might just cause more confusion.
2025-06-24 21:06:14 +02:00
Marc André Tanner 9014aa2815 winpe: fix typos in documentation 2025-06-04 21:23:47 +02:00
Marc André Tanner 7590d72d64 winpe: improve compatibility of GDB automation
Previously it would fail if no symbol table for libc was available,
because the named first argument used in the break point condition
would not be found. Instead, use registers according to the calling
convention for x86_64 and aarch64 and fall back to the named argument
(relying on symbols) for other architectures.
2025-05-21 22:01:00 +02:00
Marc André Tanner 4f4da6c196 winpe: make sure second stage boot manager actually exists
The same boot manager is used for both stages. A dfferent file name
is only used to detect the loading of the second stage to swap out
the served BCD.

This should have been part of 28bfedb610
where the instructions were changed from the manual to the GDB based
method.
2025-05-18 21:23:36 +02:00
Marc André Tanner 28bfedb610 winpe: enable/recommend GDB automation
It is unlikely that the GDB automation is the reason for the flakiness.
2025-03-28 21:48:15 +01:00
Marc André Tanner 66b9fa2a3c winpe: use modified version of WinPmem instead of DumpIt
This does not perform a full memory dump, but instead searches
incrementally and stops after the first match.
2025-03-18 21:25:28 +01:00
Marc André Tanner 1148128d17 winpe: add customization script and some more debugging notes
Also add a warning that the WinPE-based exploitation strategy might
be less reliable than its Linux-based counterpart.
2025-03-18 07:13:23 +01:00
Marc André Tanner d200843737 winpe: improve second stage exploitation script
Abort in case VMK is not found. Include diskpart documentation as wimc
is not available, fix typo and provide more specific example command.
2025-03-12 18:13:35 +01:00
Marc André Tanner 5995eff4a5 Add high-level wrapper scripts for exploitation convenience 2025-02-26 11:29:15 +01:00
Marc André Tanner e1332680d6 Add WinPE based exploitation environment 2025-02-26 10:42:14 +01:00
Marc André Tanner 3f841cbbcd Move initramfs generation into subfolder 2025-02-26 10:42:14 +01:00
Marc André Tanner 7b5545c64e Rename Linux related artifact download scripts 2025-02-26 09:54:30 +01:00
Marc André Tanner 57611da4ca Rename BCD generation script and resulting configuration file 2025-02-26 09:54:30 +01:00
Marc André Tanner 9c84a43741 Update README
Fix typos, add section about working devices, provide additional
information regarding the source of `bootmgfw.efi`.
2025-02-06 10:37:29 +01:00
Marc André Tanner 8ff4a49e23 Add basic README 2025-02-03 14:08:04 +01:00
Marc André Tanner 3322e67fe4 Add PXE boot helper scripts
Except for the Windows boot manager the necesary artifacts are downloaded
from public resources.

This work was done in parallel and drew some inspiration from similar
avenues by Andreas Grasser.

 https://github.com/andigandhi/bitpixie
2025-01-31 17:52:37 +01:00