$ sudo efibootmgr
BootCurrent: 0019
Timeout: 0 seconds
BootOrder: 0019,0009,001A,000A,0006,0007,0008,000B,000C,000D,000E,000F,0010,0011,0012,0013
Boot0000 Setup
Boot0001 Boot Menu
Boot0002 Diagnostic Splash Screen
Boot0003 Startup Interrupt Menu
[…]
Boot0017* ATAPI CD:
Boot0018* PCI LAN
Boot0019* Fedora
Boot001A* EFI Shell
$ sudo efibootmgr --bootnext 001A
BootNext: 001A
BootCurrent: 0019
Timeout: 0 seconds
BootOrder: 0019,0009,001A,000A,0006,0007,0008,000B,000C,000D,000E,000F,0010,0011,0012,0013
Boot0000 Setup
Boot0001 Boot Menu
Boot0002 Diagnostic Splash Screen
Boot0003 Startup Interrupt Menu
[…]
Boot0017* ATAPI CD:
Boot0018* PCI LAN
Boot0019* Fedora
Boot001A* EFI Shell
The following example shows a function that returns TRUE if the application is running in a remote session and FALSE if the application is running on the console.
C++
#include <windows.h>
#pragma comment(lib, "user32.lib")
BOOL IsRemoteSession(void)
{
return GetSystemMetrics( SM_REMOTESESSION );
}# nmcli c modify 'eth0' ipv4.route-table 1234
# nmcli c modify 'eth0' ipv4.routing-rules "from 1.2.3.4 table 1234 priority 1000"# ip route add default dev lo
Before the actual coding part, let’s think for a minute what we need to do:
• start the program in suspended mode
• read the original bytes we are going to patch at the magic address
• write some bytes at the magic address, to make program enter an infinite-loop
• let the program run
• monitor if the program arrived at the infinite-loop (at magic address)
• if previous step is done, suspend the program and sniff the serial from EAX
• restore the original bytes (clear the infinite-loop) and resume the program