mirror of
https://github.com/martanne/bitpixie
synced 2026-06-08 15:44:32 +00:00
Marc André Tanner
3322e67fe4
Except for the Windows boot manager the necesary artifacts are downloaded from public resources. This work was done in parallel and drew some inspiration from similar avenues by Andreas Grasser. https://github.com/andigandhi/bitpixie
This prepares a PXE boot environment to exploit the bitpixie vulnerability.
The kernel (linux) and initramfs (alpine-initrd.xz) is expected to be provided externally,
e.g. by running the scripts in the (corresponding linux directory](../linux).
The download.sh script fetches the required components from public sources:
shimx64.efisigned Debian shimgrubx64.efisigned Debian GRUB boot loader- TODO:
bootmgfw.efivulnerable Windows boot loader
The start-smb.sh script starts an impacket based SMB server providing the
create-bcd.bat script to generate a device specific
BCD.
The start-pxe.sh script starts dnsmasq with the needed options to serve
the file from the tftp directory.
$ ./download.sh
$ ./start-smb.sh
$ ./start-pxe.sh eth0
This work was done in parallel and drew some inspiration from similar avenues by Andreas Grasser.