hey guys hack exploit here back again
with another video and in this video i'm
going to be showing you how to use the
windows credential editor
also known as wce for post exploitation
on windows
all right so for those of you who have
never heard of wce before and i'll be uh
i'll be alternating between
the abbreviation uh and um and the
actual name so wce windows credential
editor so do bear with me
so for those of you who don't know what
wce is
it is essentially a tool that allows you
to harvest hashes
from a windows based system or windows
operating systems rather
now i've already talked about using
tools like mimikatz before so you can
watch those videos if you're interested
in tools like that
and you'll see why these various tools
exist in a second so
in terms of functionality what does the
wce have to offer
or what can it give us right so firstly
it allows us to perform
pass the hash attacks on windows of
course secondly you can obtain
ntlm or uniquely nt and lm hashes from
memory
so these come from both interactive
logins or log ons
services and of course remote desktop
connections
and the thirdly it allows us to dump
clear text passwords
entered by users at logon all right so
wce is a security tool that is widely
used by
professionals and penetration testers to
essentially test the security of windows
systems
you know when performing penetration
tests so it currently supports windows
xp
windows 2003 windows vista windows 7
windows server 2008 and windows 8.
so it does not support windows 10 that's
something very important to take into
consideration so
this is a mainly useful if you're if
you're performing penetration tests on
windows based systems or
or on a windows 7 based network sorry
not a windows based system
but on any of the operating systems that
i just listed
and of course this will this becomes
very important if you are performing
see if you are in ctfs or you're working
on hack the box or
whether you're doing your oscp you will
come across
various windows operating systems like
windows xp windows
windows 2003 uh windows 7 windows server
2008 etc etc so
for windows 10 i've already covered how
to do that so
let's get let's actually get started so
by default um kali linux comes
pre-packaged with the wce or the windows
credential editor
and it is accessible by going into the
directory user
share and we want to go into the wce
directory so if i list all the files in
here
you can see that we have the wce 32-bit
executable and the wce 64-bit executable
we also have a
wce universal executable here
now you might be wondering to yourself
why exactly do we have
a wce executable file on kali and how
how do we actually use wce because if
there's an executable how are we going
to
go about using it well this is exactly
how it works
all right so as mentioned earlier it is
used in penetration tests and in ctfs
that utilize windows
so that's your first hint secondly it
works extremely well in post
exploitation uh when
talking about credential harvesting or
dumping hashes and passwords
all right so in terms of post
exploitation it is a fantastic tool
when talking about windows based
operating systems or windows operating
systems for that matter
and all you need to do to use this tool
is to upload
the wce executable to do the target
system and run it
now that being said that means you need
to already have
uh you need to already have exploited
the system uh that
you you're going to be uploading the wce
executable to and that makes sense
because this is a post exploitation tool
so all you need to do is simply upload
this executable
to your target operating uh to your
target computer or
server whatever it is all right and i
already have
uh my environment set up so let me
explain how
i'm going to be demonstrating this to
you so i have a
windows 7 virtual machine that's
currently running on my vm server so
it's
it's currently not on my host operating
system so i have kali here and i have my
windows 7 vm running on my um
on my vm server uh and what i've done is
i've actually sent a payload
to that windows vm that is going to give
that is going to allow us to get a
uh interpreter uh reverse shell on our
on on kali linux right over here so i've
already set the options
or i'll set the options in a second so
that is basically the environment we're
going to be working on so i've sent a
meterpreter payload
onto my windows 7 vm so what i'm going
to do is i'm just going to
check my monitor here and we can get
started so if i show the options
uh let's see if i've set any of the
options no i haven't but you can see
that the payload i'm using is the
meterpreter and it is reverse tcp
that is the connection type so again you
can do this however you want
as long as you've already exploited your
target you can use the interpreter
functionality to upload
executables and you can also download
files uh etc etc so
um to get started we will set the uh l
host here
so set l host and that is uh let me just
confirm my local ip for cali here
uh so ifconfig and that is 192.168.1.103
right over here
and i will set that so 192.168.1.103
hit enter and i set the l port on the
payload
to one two three four and we are ready
to go
all right uh oops sorry about that i
actually missed an r there
and we'll just wait for this to return
the error there we are all right so we
can get started
uh but before we do that i'm going to
hit run here
and i'm now going to execute the payload
on my vm so just give me a few seconds
i'm just going to hit run and we're
going to execute it
and there we are all right so now we
have a meterpreter session
and we're ready to go so if i type in my
system information here
you can see that we're running windows 7
service pack one excellent so we can
begin
and we currently have two logged on
users that will come that will be very
important as we move along
all right so as i mentioned uh to get it
to work you need to upload that
executable to your target and
meterpreter gives us this functionality
uh using the upload command
all right so the upload commands allows
us to specify any file that we want to
upload to the target
uh but before we do that i just want to
check my current working directory so
uh i uh primarily you want to have this
within your system32
folder so that you can execute it within
the command prompt so
what i'm going to do is uh sorry we are
in the
windows 7 uh user here um
so yeah we'll just go back to windows
and
let me just clear that up so if i list
the files here uh windows
and system 32 uh system32
and we print the directory just to
confirm we are in that directory
yes we are all right so we want to
upload it to this directory and
now your architecture is something to
also take into consideration and when i
say that i am referring to your system
architecture and your operating system
architecture
so for in my case if i type in system
info you can see that i'm currently
running a 32-bit version
which means i'm going to have to upload
the wce 32-bit
executable here all right so
what i'm going to do is i'm just going
to hit upload and now i need to specify
the
local directory uh to the file or
executable that i want to upload
so user share and this is wce
and we are just going to uh we're going
to say wce
32 i'm going to say 32.exe
and we we're just going to enter or you
can specify the directory you want on
your target operating system
uh but i'm just going to hit upload and
there we are upload is complete
and now if we list the files in here and
we
grab the output and we say wce
wce32.exe and hit enter you can see
we have the file right over here and
we're able to execute it all right so
let's get started now
with actually displaying some of the
hashes and passwords
all right so uh in terms of using wc as
i mentioned
you can execute it right over here but
before
we do that let me just get a shell so
that we can actually execute it directly
so wce 32.
if we use the help option and we hit
enter you can see we have
various options that you can use i'm
going to be covering the most important
options here
so if you're simply to run the wc32.exe
here and i hit enter what this is going
to do is
it's going to list all the hashes of all
the users that are currently logged on
so if i hit enter oops sorry about that
guys
uh wce32.exe and hit enter
this is going to list the hashes of all
the users that are logged on so you can
see that we've got our user
our domain uh we've got our
this is our lm a hash and this is our nt
hash
right over here that both give you your
ntlm hash
i'll be explaining the structure of an
ntlm hash in a second
uh but before we do that let me just
show you a few other commands so you can
export these hashes
and then you can use tools like john the
ripper or hashcat to crack them
if you are going to do it offline
however we can also use
wce or the windows credential editor
to essentially retrieve or dump the
passwords in clear text for users that
are currently logged on
uh so i can see wce 32
wce 32.exe and for this we use the w
command all right but if we open up the
help menu or you can actually see it
right over here this will dump clear
text
password stored by the digest
authentication package so these users
have to be logged on
so if aw and hit enter you can see that
the password for this user windows 7
and that exists in the domain windows 7
vm
is test bench pass and i just simply set
a simple password so that i can
i can actually show you how this works
all right so this does not involve any
cracking that's something very important
to take into consideration
however if you're not if you're not able
if you don't have any other users logged
on but they are users
on this particular windows system you
can dump the hashes and then crack them
offline i'll be making
these follow-up videos to cracking
windows uh hashes in the next video but
for now i just simply want to focus on
how to use
the windows credential editor all right
so
uh if we want to retrieve the ntlm hash
for a particular password so this clear
text password so test bench pass
i can type in wce32.exe
and i can say uh we can use the g
command and if you see right over here
this will generate the lm
and nt hash which is your uh ntlm hash
in general i'll explain that in a second
so uh
g and i say test bench uh
password and hit enter it will generate
our
uh if you look at the uh the direct
order which is listed over here you have
your lm
hash and your nt hash so your lm hash is
first
and your nt ash is a second right over
here now let me explain
a little bit about windows hashes i'll
be making a follow-up video but let me
just explain it so you can understand it
so
uh first of all this is an ntlm hash
right over here
all right and you might be asking well
ntlm hashes
are you know they're cool and all but
can you explain the structure so the
structure is as follows you have your
username
this is the username uh of the
particular user
you then have the domain all right so
the domain that they're currently
connected to you then have
the landman hash or the uh the lm hash
right over here
which was um this was actually uh
used in previous windows operating
systems however it's less secure than
the nt hash so the nth which is right
over here succeeded
uh the lm hash right over here so the
uh the anti-ash is much more secure so
all together
it becomes the ntlm hash in case you're
wondering so i simply just wanted to
explain that
so that you can understand how to do it
so that is pretty much
all that i wanted to cover in regards to
using the windows credential editor
i'll be covering more on you know
windows penetration testing and i simply
wanted to cover
a little bit about the windows
credential editor because it is an
important tool
to know how to utilize for your
penetration test especially in large
networks
that may be utilizing older versions of
windows um so that's pretty much going
to be it for this video guys thank you
so much for
watching if you have any questions or
suggestions let me know in the comment
section on my social networks or at the
forum at hackersploit.org
and i'll be seeing you guys in the next
video peace guys
[Music]
you