full-disclosure - Windows Credentials Editor (WCE) v1.3beta 32bit release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Fri, 09 Mar 2012 18:48:24 -0300
From: Amplia Security Research <research@...liasecurity.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Windows Credentials Editor (WCE) v1.3beta 32bit
	release

WCE v1.3beta 32bit released.

Download link: http://www.ampliasecurity.com/research/wce_v1_3beta.tgz

Changelog:

version 1.3beta:
March 8, 2012
* Bug fixes
* Extended support to obtain NTLM hashes without code injection
* Added feature to dump login cleartext passwords stored by the Digest
Authentication package

Example:

* Dump cleartext passwords stored by the Digest Authentication package

C:\>wce -w
WCE v1.3beta (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia
Security -
by Hernan Ochoa (hernan@...liasecurity.com)
Use -h for help.

test\MYDOMAIN:mypass1234
NETWORK SERVICE\WORKGROUP:test

The cleartext passwords dumped include passwords used to login to the
Windows box interactively.

What is WCE?
------------

Windows Credentials Editor (WCE) v1.3beta allows you to

NTLM authentication:

* List logon sessions and add, change, list and delete associated
credentials (e.g.: LM/NT hashes)
* Perform pass-the-hash on Windows natively
* Obtain NT/LM hashes from memory (from interactive logons, services,
remote desktop connections, etc.) which can be
used to authenticate to other systems. WCE can perform this task without
injecting code, just by reading and decrypting information stored in
Windows internal memory structures. It also has the capability to
automatically switch to code injection when the aforementioned method
cannot be performed

Kerberos authentication:

* Dump Kerberos tickets (including the TGT) stored in Windows machines
* Reuse/Load those tickets on another Windows machines, to authenticate
to other systems and services
* Reuse/Load those tickets on *Unix machines, to authenticate to other
systems and services

Digest Authentication:

* Obtain cleartext passwords entered by the user when logging into a
Windows system, and stored by the Windows Digest Authentication security
package

Supported Platforms
-------------------
Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008.

Additional information
----------------------
http://www.ampliasecurity.com/research/wcefaq.html

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/