New version of Pass-The-Hash Toolkit v1.1

["Hernan Ochoa" <hernan@xxxxxxxxx>]

Hi!,

Pass-The-Hash Toolkit v1.1 is available here:

Source:
http://oss.coresecurity.com/pshtoolkit/release/1.1/pshtoolkit_src_v1.1.tgz

Binaries:
http://oss.coresecurity.com/pshtoolkit/release/1.1/pshtoolkit_v1.1.tgz


This version basically works best with German/French versions of WinXPSP2, and
also with Windows Server 2003. If  you had problems with any of these
with the previous
version, please try this one. Now, there's basically a -B switch that
tries to find the necessary addresses in runtime, and a bigger
database of possible addresses.

If you have issues, PLEASE let me know!. and thanks to all the people
that sent emails and gave me the necessary feedback to come up with a
solution to their pshtoolkit-related problems :).


WHATSNEW.What's new?:

-Improved support for windows xpsp2 german/french, windows 2003
sp1/sp2, both for
IAM.EXE and WHOSTHERE.EXE
-Added to IAM.EXE and WHOSTHERE.EXE the -B switch. If IAM.EXE or
WHOSTHERE.EXE is
not working in your configuration, please run the tools again
specifying -B at the end.
The -B option will try to find, using 'heuristics', the addresses the tools need
to do what they do. If you are still having issues, please let me
know, I expect people
to have issues because the addresses vary from OS version to OS version.


Note for Windows Server 2003 users:

-if you run IAM.EXE and it ends as expected, as If it had worked, but
then you run
WHOSTHERE.EXE and the credentials did not change, do the following:


-start a cmd.exe using runas, for example:

            runas /user:administrator cmd.exe

-and in the new console run IAM.EXE, and then WHOSTHERE.EXE to verify. And now
it should work.


It seems that sometimes you need a new session different than the interactive
session for LSASS.EXE to accept the modifications to the credentials
in memory. If
you are logging to the machine remotely using psexec/Remote Desktop
etc this does
not to occur (at least, this is what I observed), I had troubles like this when
logging interactively to the server. Also after you run 'runas', running IAM.EXE
in a regular CMD.EXE shell will start working. Don't take any of this as
a precise explanation of what's going on, this is just what I observed and a way
to work around it. I'll analyze what's really going on in the future..