Hello everyone. In this video. We're going to be taking a look at
how to dump a Windows password, hashes from memory
using the windows credentials editor. So again,
I'm going to lie on the website here. So I am play Security.com
on the research and windows credentials editor.
So Windows credentials editor is a security tool
to List, log on sessions and add change list or
delete Associated credentials. These are
in ntlm hashes, plaintext passwords and
Kerberos tickets. This tool can be used for
Able to perform pasta hash on Windows update, and dlm hashes
from memory, which is what we're interested in. And the
key distinction to make here in regards
to the comparison between hash dump and the
windows credentials editor is that the windows credentials. Editor
does not dump the contents of the Sam database, rather.
It dumps. The hashes, the ntlm hashes
from memory from users that are
currently logged on to the system, which is very important. Whereas
with hash dump you essentially dumping the
Fire contents of the of the Sam database which gives
you the ashes for all users on the system, regardless of
whether they are logged on to the system or not. However, with with
the windows credentials editor, you lonely, lonely, dump the
hashes of users that are currently logged on to the
system. And again, it also gives
you the ability to obtain Kerberos tickets, but we're going to be
focusing on dumping ntlm hashes from memory. Now,
when we talk about the windows credentials editor,
the windows credentials editor.
Prepackaged with Kali Linux and most of
the other penetration testing distributions
and is currently available. I'll just open
up a new tab here under the user shared directory.
So I'll just list out the contents of the directory. So user
share, and we're looking on the Windows resources and
we're looking for WCE, right? Survival is the contents of
the WC directory. You can see that we have the windows
credentials editor. Executables right over here. We
have two types of executables one.
Of them is 32-bit. The other one is, is 64 bit based
on the architecture of the system. You're currently working on, although
the architecture of the system that you're currently targeting. So
again, we need to get this particular executable on
to our Target system and then execute it to
them. Now. There's plenty of ways we can do this. And of course, we're
going to assume that again, you can
get, you can get these executable on to the system using, you
know, various forms of file transfer or various methods
of file transfer, like, using,
Show your power Shield, download scripts. Or in our
case. We'll just simply just use the meterpreter session to
actually download this particular or
upload this particular executable onto
a directory or onto a user directory here and then we can execute
it through a shell. Right? So what I'm going to do is I'll just copy
the the actual path to the executable and
we'll go and we'll go back into Kelly here into
the meterpreter session. And again if I just say get user ID, you
can see we have and your Authority here. So all
Sa C, CD into the root here
and also a CD into users and CD
into iucn. We're currently doing
this on the Windows 7 VM. So again, I'll
go into the desktop and if I list the contents of
the desktop, you can see, we don't have anything in here. So I'm going to upload and
to do that. We simply type in upload. I paste the path to
the particular file. We want to upload on the galley VM and
the the one we're looking for is WCE 32.0
exe. And that is primarily
Close the Windows 7 VM is 32 bit. So we'll hit enter,
and that is going to upload it right over here. And
if I list the contents, now you can see we have a WC 32,
.exe, right? So to
start using this week in executed directly from the meterpreter. However,
given that this is a command line, utility, we
need to get a shell session. And if you are, if
you do not have a meterpreter session, this will work, fine. Because again,
you will be using a command you'll be using a command shell. So
that means you, that means, you're essentially interacting.
With the command prompt, so to execute it. All we need to
do is type in WC 32 exe. But before we do
that, let's take a look at some of the help options that we can use.
So I can say WCE 32 .xe, and we
can use the minus H option to open up the help menu. Now,
the options that we are looking for, primarily
here are going to be the first option, which will list the
log on sessions and ntlm credentials. This
is the default. This is the default command that will be
run. When we run the WCE 32 .xe,
Which is what we want. This is going to dump the passwords a
a day in clear text or the until em credentials
or hashes from memory. Not the same database,
that's very important. And then, of course, you
have the ability to List log on sessions and and
ntlm credentials indefinitely and this will refresh
every time a new user logs in, which is also very useful if
the system has a lot of users and they're currently logging
into it or, you know, in
various times that being said,
and we are going to be looking at the second option right over
here, which allows us to dump, clear text passwords stored by
the digest authentication package again, and
this what this will do is it will dump the clear text
passwords that were entered by users. When they logged in, these puzzles
are usually stored in the memory. So, we'll start off
with the first option, which is the L command. So we'll say, WCE the
deal .exe and we use l and
we hit enter and you can see it will give us
the password hashes here. And of course it's giving us the possibility.
The dashes in the ntlm format or the
LMN t format where you have the
LM hash. And then, of course, you have the en T hash right over here.
Now, the LM hash was used on older
versions of windows, but was discontinued. However,
for compatibility reasons, you can see that the window still preserves
and combines the two, and the therefore, you
have the ntlm hash over, really Windows
7 and new operating systems only
use the ntp Azure. And of course, we have various
Versions of the of the ntlm. Hash like ntlm
V 1 and Del M V2, so on and so forth. Since
we've already got the ntlm ashes using Ash dump,
our next step will involve cracking
them with John, the Ripper, which is again, very, very simple, but we
can try and dump with a clear text passwords stored by
the digest authentication package. So, for example, I
can say, WCE 32 .exe. So
you say, WCE 32 .xe, and
I use the dump option.
So w. And in this case you can see the
the password for the sshd server
is darling or Darjeeling, depending
on how you want to pronounce that. And the password for
the IE user is password. And this
is the password right away. So immediately with the windows credentials
editor, you can see, we can dump passwords in clear-text. So
we don't have to actually go about cracking them. That being
said, we will still, we will still be cracking them with John
the Ripper. Because if I say net users,
As you can see that we have the administrator account and
that will be extremely helpful. And, of course, we have other users that
are currently on the system but have not logged on to it. So we want to
crack those hashes as well. So that
is how to essentially use the
windows credentials Editor to dump the ntlm hashes right
over here. And now, to dump the clear text passwords taught
by the digest authentication package, so that is going to
be it for this video and I'll be seeing you in the next video.