Pass-The-Hash Toolkit v.1.4 released

by

In: Data Sniffer , Enumeration , Pass-The-Hash

2 July 2008

The Pass-The-Hash Toolkit contains utilities to manipulate the Windows Logon Sessions mantained by the LSA (Local Security Authority) component. These tools allow you to list the current logon sessions with its corresponding NTLM credentials (e.g.: users remotely logged in thru Remote Desktop/Terminal Services), and also change in runtime the current username, domain name, and NTLM hashes

Changelog for this release:

  • Support for XP SP 3 for whosthere/iam (whosthere-alt/iam-alt work on xp sp3
    without requiring any update)
  • New -t switch for whosthere/whosthere-alt: establishes interval used by the -i switch (by default 2 seconds).
  • New -a switch for whosthere/iam: specify addresses to use. Format: ADDCREDENTIAL_ADDR:ENCRYPTMEMORY_ADDR:FEEDBACK_ADDR:DESKEY_ADDR:LOGONSESSIONLIST_ADDR:LOGONSESSIONLIST_COUNT_ADDR (WARNING!: if you use the wrong values the system may crash)
    The idea is that, if you find yourself in a version of Windows where
    whosthere/iam don’t work (and iam-alt/whosthere-alt don’t work either); you can run LSASRV.DLL thru IDA, run the PASSTHEHASH.IDC script included in the Pass-The-Hash toolkit, and use the addresses found by the script with the -a switch.

This basically allows you to specify addresses at runtime to whosthere whithout
the need to recompile the tool.

  • New -r switch for iam/iam-alt: Create a new logon session and run a command with
    the specified credentials (e.g.: -r cmd.exe)
  • genhash now outputs hashes using the LM HASH:NT HASH format
  • several bugfixes and stuff

Post scriptum


Related Articles

Data Sniffer
Enumeration
Pass-The-Hash