Wednesday, March 14, 2012
WCE v1.3beta 64bit released
WCE v1.3beta 64bit released. You can download it here.
The same functionality recently added to the 32bit version was added to the 64bit version.
Thursday, March 08, 2012
WCE v1.3beta 32bit released
WCE v1.3beta 32bit released. You can download it here.
Changelog for Windows Credentials Editor (WCE) 32-bit version
version 1.3beta:
March 8, 2012Bug fixes
Extended support to obtain NTLM hashes without code injection
Added feature to dump login cleartext passwords stored by the Digest Authentication package
Example:
* Dump cleartext passwords stored by the Digest Authentication package
C:\>wce -w
WCE v1.3beta (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia Security -
by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.
test\MYDOMAIN:mypass1234
NETWORK SERVICE\WORKGROUP:test
The cleartext passwords dumped include passwords used to login to the Windows box interactively.
What is WCE?
Windows Credentials Editor (WCE) v1.3beta allows you to
NTLM authentication:
* List logon sessions and add, change, list and delete associated credentials (e.g.: LM/NT hashes)
* Perform pass-the-hash on Windows natively
* Obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be
used to authenticate to other systems. WCE can perform this task without injecting code, just by reading and decrypting information stored in Windows internal memory structures. It also has the capability to automatically switch to code injection when the aforementioned method cannot be performed
Kerberos authentication:
* Dump Kerberos tickets (including the TGT) stored in Windows machines
* Reuse/Load those tickets on another Windows machines, to authenticate to other systems and services
* Reuse/Load those tickets on *Unix machines, to authenticate to other systems and services
Digest Authentication:
* Obtain cleartext passwords entered by the user when logging into a Windows system, and stored by the Windows Digest Authentication security package
Supported Platforms
Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008.
Video (watch in 720p):
Changelog for Windows Credentials Editor (WCE) 32-bit version
version 1.3beta:
March 8, 2012
Example:
* Dump cleartext passwords stored by the Digest Authentication package
C:\>wce -w
WCE v1.3beta (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia Security -
by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.
test\MYDOMAIN:mypass1234
NETWORK SERVICE\WORKGROUP:test
The cleartext passwords dumped include passwords used to login to the Windows box interactively.
What is WCE?
Windows Credentials Editor (WCE) v1.3beta allows you to
NTLM authentication:
* List logon sessions and add, change, list and delete associated credentials (e.g.: LM/NT hashes)
* Perform pass-the-hash on Windows natively
* Obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be
used to authenticate to other systems. WCE can perform this task without injecting code, just by reading and decrypting information stored in Windows internal memory structures. It also has the capability to automatically switch to code injection when the aforementioned method cannot be performed
Kerberos authentication:
* Dump Kerberos tickets (including the TGT) stored in Windows machines
* Reuse/Load those tickets on another Windows machines, to authenticate to other systems and services
* Reuse/Load those tickets on *Unix machines, to authenticate to other systems and services
Digest Authentication:
* Obtain cleartext passwords entered by the user when logging into a Windows system, and stored by the Windows Digest Authentication security package
Supported Platforms
Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008.
Video (watch in 720p):
Subscribe to:
Posts (Atom)