WCE v1.4beta released

WCE v1.4beta released. Includes several bug fixes and support for Windows 8.

32bit version available at http://www.ampliasecurity.com/research/wce_v1_4beta_x32.zip
64bit version available at http://www.ampliasecurity.com/research/wce_v1_4beta_x64.zip
"Universal Binary" (works both on x32 and x64) available at http://www.ampliasecurity.com/research/wce_v1_4beta_universal.zip

Java 7 Update 10 0-Day RCE Exploit Demo (CVE-2013-0422)

This is a demo of the Java 7 Update 10 0-Day Vulnerability made public on 01-10-2013 (CVE-2013-0422). Java 7 Update 10 0-Day RCE Exploit Demo (CVE-2013-0422)

Exploit made public by http://www.twitter.com/Kafeine
Exploit code released publicly by Gdark - DamageLabs

References:
http://malware.dontneedcoffee.com/2013/01/0-day-17u10-spotted-in-while-disable.html
http://pastebin.com/raw.php?i=cUG2ayjh
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0422

New addition to the WCE FAQ: "How can I prevent WCE dumping my logon password in cleartext?"

New addition to the WCE FAQ: "How can I prevent WCE dumping my logon password in cleartext?"

http://www.ampliasecurity.com/research/wcefaq.html#preventcleartextpwddump

Java 0-Day Vulnerability Exploit Demo (CVE-2012-4681)

This is a demo of the Java 0-Day Vulnerability made public on 08-26-2012 (now CVE-2012-4681): http://youtu.be/HO4yO7_5sEc?hd=1 (watch in HD)

This vulnerability was found being exploited in the wild and discovered by Michael Schierl.

This exploit was written based on the PoC published by @jduck1337 at http://pastie.org/pastes/4594319/text

Tested on Windows 7 with Internet Explorer, Firefox and Chrome (keep in mind this affects Java on all platforms)

The exploit is extremely easy to implement, not much needs to be changed from the public PoC besides adding code to drop a payload.

References:

http://blog.fireeye.com/research/2012/08/zero-day-season-is-not-over-yet.html
http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html
http://immunityproducts.blogspot.com.ar/2012/08/java-0day-analysis-cve-2012-4681.html

Exploiting MySQL Authentication Bypass Vulnerability (CVE-2012-2122)

via @ampliasecurity: This week in videos: Exploiting MySQL Authentication Bypass Vulnerability (CVE-2012-2122) http://youtu.be/Mg5iUjOpusE?hd=1

Exploitation of this critical vulnerability is trivial and requires only to perform several authentication attempts with any password and a valid username until the MySQL server grants access.

After successful exploitation this exploit dumps information from the target MySQL server such as: version, available databases, password hashes of MySQL users to be cracked later, dumps some system files, in this example, /etc/password, etc. Depending on the configuration of the target MySQL server and privileges of the user selected other actions can be performed.

More information:
http://seclists.org/oss-sec/2012/q2/493
http://bugs.mysql.com/bug.php?id=64884
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2122

Exploiting Apache Struts ExceptionDelegator Vulnerability (CVE-2012-0391)

via @ampliasecurity: This week in videos: Exploiting Apache Struts ExceptionDelegator Vulnerability (CVE-2012-0391) http://youtu.be/YGCSJEZ7kPk?hd=1

WCE v1.3beta 64bit released

WCE v1.3beta 64bit released. You can download it here. The same functionality recently added to the 32bit version was added to the 64bit version.

WCE v1.3beta 32bit released

WCE v1.3beta 32bit released. You can download it here.

Changelog for Windows Credentials Editor (WCE) 32-bit version

version 1.3beta:
March 8, 2012

Bug fixes

Extended support to obtain NTLM hashes without code injection

Added feature to dump login cleartext passwords stored by the Digest Authentication package


Example:

* Dump cleartext passwords stored by the Digest Authentication package

C:\>wce -w
WCE v1.3beta (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia Security -
by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.


test\MYDOMAIN:mypass1234
NETWORK SERVICE\WORKGROUP:test


The cleartext passwords dumped include passwords used to login to the Windows box interactively.

What is WCE?

Windows Credentials Editor (WCE) v1.3beta allows you to

NTLM authentication:

* List logon sessions and add, change, list and delete associated credentials (e.g.: LM/NT hashes)
* Perform pass-the-hash on Windows natively
* Obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be
used to authenticate to other systems. WCE can perform this task without injecting code, just by reading and decrypting information stored in Windows internal memory structures. It also has the capability to automatically switch to code injection when the aforementioned method cannot be performed

Kerberos authentication:

* Dump Kerberos tickets (including the TGT) stored in Windows machines
* Reuse/Load those tickets on another Windows machines, to authenticate to other systems and services
* Reuse/Load those tickets on *Unix machines, to authenticate to other systems and services

Digest Authentication:

* Obtain cleartext passwords entered by the user when logging into a Windows system, and stored by the Windows Digest Authentication security package


Supported Platforms
Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008.

Video (watch in 720p):

WCE v1.21 64-bit version released

I just released WCE v1.21 64bit. This is a minor release, only for the x64 version of WCE.
It fixes some minor issues with the tool when run on Windows Server 2008.

You can download it here.

If you have any questions, please don't hesitate to contact me at hernan[[at]]ampliasecurity.com.

For any issues you may have, please send me an email instead of leaving your issues as comments; I can't answer your questions properly if you do, and you'll most likely not get your problem solved. Email me and I'll solve your issue.

WCE v1.2 64-bit version released

You can find the 64-bit version of WCE v1.2 here

As always, all feedback is welcome, email me.


Thank you!

"Post-Exploitation with WCE" Presentation

This presentation describes the techniques WCE brings to penetration testers and how these can be used in different scenarios. Although originally targeted to college students studying information security, you might find useful information you didn't know about even if you are an experienced user of WCE or penetration tester.

Direct links:
Post-Exploitation with WCE (SPANISH)

Post-Exploitation with WCE (ENGLISH)

Windows Credentials Editor (WCE) FAQ released

I find myself answering a lot of questions about WCE and related matters all the time; for this reason I decided to create a WCE FAQ to try to provide a centralized source of information and answers to all the questions. 

You can find it here http://www.ampliasecurity.com/research/wcefaq.html

The FAQ is still work in progress and I will continue to update it regularly with new information, attack scenarios, different ways to use the features provided by the tool, etc. 

If you have a question in particular that you want answer, please don't hesitate to contact me, I'll answer you personally and also add the question and answer to the FAQ.

Windows Credentials Editor (WCE) v1.2 released

Windows Credentials Editor v1.2

New features in this version:
-g              Generate LM & NT Hash.
                Parameters: <password>.
-K              Dump Kerberos tickets to file (unix & 'windows wce' format)
-k              Read Kerberos tickets from file and insert into Windows cache

Description:
Windows Credentials Editor (WCE) allows to list logon sessions and add, change, list and delete associated credentials (ex.: LM/NT hashes and Kerberos tickets). This can be used, for example, to perform pass-the-hash on Windows, obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be used to perform further attacks, obtain Kerberos tickets and reuse them in other Windows or Unix systems.

WCE v1.2 supports obtaining logon sessions and NTLM credentials just by reading
memory without performing code injection.

Dumping Kerberos tickets and adding them to the Windows cache was tested on Windows 7; your feedback is welcome.


Download:
http://www.ampliasecurity.com/research/wce_v1_2.tgz

RootedCON 2011 "WCE Internals" presentation available at slideshare

Check out my presentation on "WCE Internals" (based on WCEv1.1) available at slideshare (posted by RootedCON):

http://www.slideshare.net/rootedcon/hernan-ochoa-wce-internals-rootedcon-2011

I'll publish the .pdf on http://www.ampliasecurity.com/research/ next week.

You can find all the RootedCON 2011 presentations here:


http://www.slideshare.net/rootedcon/

Some presos are in Spanish and some in English.

Go check them out!

WCE v1.1 is out!

WCE v1.1 is out!

http://www.ampliasecurity.com/research/wce_v1_1.tgz

README:


Windows Credentials Editor v1.1
(c) 2010, 2011 Amplia Security, Hernan Ochoa
written by: hernan@ampliasecurity.com
http://www.ampliasecurity.com
-------------------------------------------------------------

Abstract
----------
Windows Credentials Editor (WCE) allows to list logon sessions and add, change, list and delete associated credentials (ex.: LM/NT hashes). This can be used, for example, to perform pass-the-hash on Windows and also obtain NT/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be used in further attacks.

WCE v1.1 supports obtaining logon sessions and NTLM credentials just by reading
memory without performing code injection.

Supported Platforms
-------------------
Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008

Requirements
-------------
This tool requires administrator privileges.

Options
--------
Windows Credentials Editor provides the following options:

Options:  
    -l        List logon sessions and NTLM credentials (default).
    -s        Changes NTLM credentials of current logon session.
            Parameters: :::.
    -r        Lists logon sessions and NTLM credentials indefinitely.
            Refreshes every 5 seconds if new sessions are found.
            Optional: -r.
    -c        Run in a new session with the specified NTLM credentials.
            Parameters: .
    -e        Lists logon sessions NTLM credentials indefinitely.
            Refreshes every time a logon event occurs.
    -o        saves all output to a file.
            Parameters: .
    -i        Specify LUID instead of use current logon session.
            Parameters: .
    -d        Delete NTLM credentials from logon session.
            Parameters: .
    -a        Use Addresses.
            Parameters:
    -f        Force 'safe mode'.
    -v        verbose output.

Examples:

    * List current logon sessions

C:\>wce -l
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

meme:meme:11111111111111111111111111111111:11111111111111111111111111111111

    * List current logon sessions with verbose output enabled

C:\>wce -l -v
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

Current Logon Session LUID: 00064081h
Logon Sessions Found: 8
WIN-REK2HG6EBIS\auser:NTLM
        LUID:0006409Fh
WIN-REK2HG6EBIS\auser:NTLM
        LUID:00064081h
NT AUTHORITY\ANONYMOUS LOGON:NTLM
        LUID:00019137h
NT AUTHORITY\IUSR:Negotiate
        LUID:000003E3h
NT AUTHORITY\LOCAL SERVICE:Negotiate
        LUID:000003E5h
WORKGROUP\WIN-REK2HG6EBIS$:Negotiate
        LUID:000003E4h
\:NTLM
        LUID:0000916Ah
WORKGROUP\WIN-REK2HG6EBIS$:NTLM
        LUID:000003E7h

00064081:meme:meme:11111111111111111111111111111111:11111111111111111111111111111111   

    * Change NTLM credentials associated with current logon session

C:\>wce -s auser:adomain:99999999999999999999999999999999:99999999999999999999999999999999
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

Changing NTLM credentials of current logon session (00064081h) to:
Username: auser
domain: admin
LMHash: 99999999999999999999999999999999
NTHash: 99999999999999999999999999999999
NTLM credentials successfully changed!

    * Add/Change NTLM credentials of a logon session (not the current one)

C:\>wce -i 3e5 -s auser:adomain:99999999999999999999999999999999:99999999999999999999999999999999 
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Och
oa (hernan@ampliasecurity.com)
Use -h for help.

Changing NTLM credentials of logon session 000003E5h to:
Username: auser
domain: admin
LMHash: 99999999999999999999999999999999
NTHash: 99999999999999999999999999999999
NTLM credentials successfully changed!

    * Delete NTLM credentials associated with a logon session

C:\>wce -d 3e5
WCE v1.0 (Windows Credentials Editor) - (c) 2010 Amplia Security - by Hernan Ochoa (hernan@ampliasecurity.com)
Use -h for help.

NTLM credentials successfully deleted!

    * Run WCE indefinitely, waiting for new credentials/logon sessions.
    Refresh is performed every time a logon event is registered in the Event Log.

C:\>wce -e

    * Run WCE indefinitely, waiting for new credentials/logon sessions
    Refresh is every 5 seconds by default.

C:\>wce -r

    * Run WCE indefinitely, waiting for new credentials/logon sessions, but refresh every 1 second (by default wce refreshes very 5 seconds)

C:\>wce -r5


GETLSASRVADDR.EXE
-----------------
This tool can be used to obtain automatically needed addresses for WCE
to be able to read logon sessions and NTLM credentials from memory.

Addresses obtained can then be used with WCE using the -A switch.

This tool requires the dlls symsrv.dll and dbghelp.dll available from the
"Debugging Tools for Windows" package.

Amplia Security at H2HC Cancun

Amplia Security at H2HC Cancun :)

Contributing author of Hacking Exposed Web Applications 3rd. Edition

Shamless plug alert!

Hacking Exposed Web Applications 3rd. Edition is out! and I'm a contributing author! Check it out!

 http://www.amazon.com/HACKING-EXPOSED-WEB-APPLICATIONS-3/dp/0071740643/ref=sr_1_1?ie=UTF8&qid=1288459138&sr=8-1

MS10-070 ASP.NET Auto-Decryptor File Download PoC exploit

This is another exploit part of the MS10-070 saga :)

It is not the same as our other previously released exploit, this one uses another information leak. On average, this exploit should allow you to do the same as the previous one but faster (which is important/desirable in this scenario).

You can find it here:
http://www.ampliasecurity.com/research/aspx_ad_chotext_attack.rb

MS10-070 ASP.NET Padding Oracle attack PoC exploit video

Yesterday, Agustin Azubel from Amplia Security released a proof-of-concept exploit implementing a Padding Oracle attack against ASP.NET (MS10-070) that allows an attacker to download a file from the remote web server.


Today we released a video showing how the PoC exploit works.

You can find it here:
http://vimeo.com/15856549

and also, here:
http://www.youtube.com/ampliasecurity#p/u/0/2jvmT5lmIIM


If you don't feel like installing IIS/ASP.NET and creating a sample application or don't have an already vulnerable ASP.NET application to test the PoC exploit on, the video will give you an idea on how the exploit works.

MS10-070 ASP.NET Padding Oracle Attack to download web.config or other files

You can find it here:  

 http://www.ampliasecurity.com/research/aspx_po_chotext_attack.rb 

A proof-of-concept attack against MS10-070, this PoC is an implementation in Ruby of a Padding Oracle attack and allows you to download the 'Web.config' file or any other file from a vulnerable ASP.NET installation.





It was written by Agustin Azubel (aazubel [ at ]  ampliasecurity.com).