BitPixie

A Linux-run proof of concept for exploiting the BitLocker security-feature bypass tracked as CVE-2023-21563. With physical access and a usable PXE soft-reboot path, it can recover the BitLocker volume master key (VMK) from memory when a vulnerable Windows boot manager is still accepted and the target's PCR validation permits the downgrade. TPM-only configurations are exposed without an additional secret; the project maintainer also demonstrated the v1.4 scanner on a TPM+PIN-protected test when the valid PIN was known. TPM+PIN therefore blocks an attacker who lacks the PIN, but is not a guarantee against an insider who knows it. This is disk-encryption-key access and possible offline volume access, not Windows account-password or NTLM-hash dumping, and it does not apply to every BitLocker configuration.