Re: Windows Credentials Editor (WCE) v1.3beta 32bit release

[Jeffrey Walton <noloader () gmail com>]

Hey Guys,

Are you making the source code available (it was not present in the 64
bit tarball)? I'm interested to see if you are using andy of the LSA
stuff, and if so, how you are using it.

Jeff

On Fri, Mar 9, 2012 at 4:18 PM, Amplia Security Research
<research () ampliasecurity com> wrote:
> WCE v1.3beta 32bit released.
>
> Download link: http://www.ampliasecurity.com/research/wce_v1_3beta.tgz
>
> Changelog:
>
> version 1.3beta:
> March 8, 2012
> * Bug fixes
> * Extended support to obtain NTLM hashes without code injection
> * Added feature to dump login cleartext passwords stored by the Digest
> Authentication package
>
>
> Example:
>
> * Dump cleartext passwords stored by the Digest Authentication package
>
> C:\>wce -w
> WCE v1.3beta (Windows Credentials Editor) - (c) 2010,2011,2012 Amplia
> Security -
> by Hernan Ochoa (hernan () ampliasecurity com)
> Use -h for help.
>
>
> test\MYDOMAIN:mypass1234
> NETWORK SERVICE\WORKGROUP:test
>
>
> The cleartext passwords dumped include passwords used to login to the
> Windows box interactively.
>
> What is WCE?
> ------------
>
> Windows Credentials Editor (WCE) v1.3beta allows you to
>
> NTLM authentication:
>
> * List logon sessions and add, change, list and delete associated
> credentials (e.g.: LM/NT hashes)
> * Perform pass-the-hash on Windows natively
> * Obtain NT/LM hashes from memory (from interactive logons, services,
> remote desktop connections, etc.) which can be
> used to authenticate to other systems. WCE can perform this task without
> injecting code, just by reading and decrypting information stored in
> Windows internal memory structures. It also has the capability to
> automatically switch to code injection when the aforementioned method
> cannot be performed
>
> Kerberos authentication:
>
> * Dump Kerberos tickets (including the TGT) stored in Windows machines
> * Reuse/Load those tickets on another Windows machines, to authenticate
> to other systems and services
> * Reuse/Load those tickets on *Unix machines, to authenticate to other
> systems and services
>
> Digest Authentication:
>
> * Obtain cleartext passwords entered by the user when logging into a
> Windows system, and stored by the Windows Digest Authentication security
> package
>
>
> Supported Platforms
> -------------------
> Windows Credentials Editor supports Windows XP, 2003, Vista, 7 and 2008.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT 
and CEPT certs require a full practical examination in order to become certified. 

http://www.iacertification.org
------------------------------------------------------------------------