{"id":2970,"date":"2010-10-14T11:00:42","date_gmt":"2010-10-14T10:00:42","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=2970"},"modified":"2010-10-14T11:00:42","modified_gmt":"2010-10-14T10:00:42","slug":"windows-credentials-editor-v1-0-list-add-edit-logon-sessions","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2010\/10\/windows-credentials-editor-v1-0-list-add-edit-logon-sessions\/","title":{"rendered":"Windows Credentials Editor v1.0 &#8211; List, Add &#038; Edit Logon Sessions"},"content":{"rendered":"<p>Windows Credentials Editor (WCE) allows to list logon sessions and add, change, list and delete associated credentials (ex.: LM\/NT hashes). This can be used, for example, to perform pass-the-hash on Windows and also obtain NT\/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be used in further attacks.<\/p>\n<p><strong>Supported Platforms<\/strong><\/p>\n<p>Supports Windows XP, 2003, Vista, 7 and 2008 (Vista was not actually tested yet, but it should work).<\/p>\n<p><strong>Options<\/strong><\/p>\n<p>Windows Credentials Editor provides the following options:<\/p>\n<pre>\r\n        -l         List logon sessions and NTLM credentials (default).\r\n        -s         Changes NTLM credentials of current logon session.\r\n                   Parameters: <UserName>:<DomainName>:<LMHash>:<NTHash>.\r\n        -r         Lists logon sessions and NTLM credentials indefinitely.\r\n                   Refreshes every 5 seconds if new sessions are found.\r\n                   Optional: -r<refresh interval>.\r\n        -c         Run <cmd> in a new session with the specified NTLM credentials.\r\n                   Parameters: <cmd>.\r\n        -e         Lists logon sessions NTLM credentials indefinitely.\r\n                   Refreshes every time a logon event occurs.\r\n        -o         saves all output to a file.\r\n                   Parameters: <filename>.\r\n        -i         Specify LUID instead of use current logon session.\r\n                   Parameters: <luid>.\r\n        -d         Delete NTLM credentials from logon session.\r\n                   Parameters: <luid>.\r\n        -v         verbose output.<\/pre>\n<p>You can download Windows Credentials Editor v1.0 here:<\/p>\n<p><a href=\"http:\/\/www.ampliasecurity.com\/research\/wce_v1.0.tgz\">wce_v1.0.tgz<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Windows Credentials Editor (WCE) allows to list logon sessions and add, change, list and delete associated credentials (ex.: LM\/NT hashes). This can be used, for example, to perform pass-the-hash on Windows and also obtain NT\/LM hashes from memory (from interactive logons, services, remote desktop connections, etc.) which can be used in further attacks. Supported Platforms [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[9,31,4],"tags":[1054,2455,8857,492],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/2970"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=2970"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/2970\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=2970"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=2970"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=2970"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}