Skip to content

Commit a2295af

Browse files
ly4kly4k
committed
Initial release
1 parent 9776bdb commit a2295af

28 files changed

Lines changed: 6828 additions & 0 deletions

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.vs/
2+
SecurityPackage/x64/*
3+
PassTheChallenge/x64/*

‎PassTheChallenge.sln‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 17
4+
VisualStudioVersion = 17.3.32825.248
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "PassTheChallenge", "PassTheChallenge\PassTheChallenge.vcxproj", "{8F018213-4136-4D97-9084-F0346BBED04F}"
7+
EndProject
8+
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "SecurityPackage", "SecurityPackage\SecurityPackage.vcxproj", "{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}"
9+
EndProject
10+
Global
11+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
12+
Debug|x64 = Debug|x64
13+
Debug|x86 = Debug|x86
14+
Release|x64 = Release|x64
15+
Release|x86 = Release|x86
16+
EndGlobalSection
17+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
18+
{8F018213-4136-4D97-9084-F0346BBED04F}.Debug|x64.ActiveCfg = Debug|x64
19+
{8F018213-4136-4D97-9084-F0346BBED04F}.Debug|x64.Build.0 = Debug|x64
20+
{8F018213-4136-4D97-9084-F0346BBED04F}.Debug|x86.ActiveCfg = Debug|Win32
21+
{8F018213-4136-4D97-9084-F0346BBED04F}.Debug|x86.Build.0 = Debug|Win32
22+
{8F018213-4136-4D97-9084-F0346BBED04F}.Release|x64.ActiveCfg = Release|x64
23+
{8F018213-4136-4D97-9084-F0346BBED04F}.Release|x64.Build.0 = Release|x64
24+
{8F018213-4136-4D97-9084-F0346BBED04F}.Release|x86.ActiveCfg = Release|Win32
25+
{8F018213-4136-4D97-9084-F0346BBED04F}.Release|x86.Build.0 = Release|Win32
26+
{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}.Debug|x64.ActiveCfg = Debug|x64
27+
{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}.Debug|x64.Build.0 = Debug|x64
28+
{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}.Debug|x86.ActiveCfg = Debug|Win32
29+
{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}.Debug|x86.Build.0 = Debug|Win32
30+
{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}.Release|x64.ActiveCfg = Release|x64
31+
{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}.Release|x64.Build.0 = Release|x64
32+
{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}.Release|x86.ActiveCfg = Release|Win32
33+
{2116E6C5-F609-4CA8-B1A1-E87B7BE770A4}.Release|x86.Build.0 = Release|Win32
34+
EndGlobalSection
35+
GlobalSection(SolutionProperties) = preSolution
36+
HideSolutionNode = FALSE
37+
EndGlobalSection
38+
GlobalSection(ExtensibilityGlobals) = postSolution
39+
SolutionGuid = {645B693B-12C2-41D9-9A8E-894AA1656594}
40+
EndGlobalSection
41+
EndGlobal

‎PassTheChallenge/Constants.h‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#pragma once
2+
3+
#define MSV1_0_CREDENTIAL_KEY_LENGTH 20
4+
#define MSV1_0_CHALLENGE_LENGTH 8
5+
#define MSV1_0_RESPONSE_LENGTH 24
6+
#define MSV1_0_NTLM3_RESPONSE_LENGTH 16
7+
#define MSV1_0_USER_SESSION_KEY_LENGTH 16
8+
#define MSV1_0_NT_OWF_PASSWORD_LENGTH 16
9+
#define MSV1_0_LM_OWF_PASSWORD_LENGTH 16
10+
#define MSV1_0_SHA_OWF_PASSWORD_LENGTH 20

‎PassTheChallenge/Menu.cpp‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
#include "Menu.h"
2+
3+
PARAM CHALLENGE_PARAMS[] = {
4+
{"<addresses>", "<context handle>:<proxy info>"},
5+
{"<encrypted blob>", "<HEX>"},
6+
{"<server challenge>", "<UTF16_HEX domain>:<UTF16_HEX username>:<HEX server name>:<HEX server challenge>"},
7+
{NULL, NULL}
8+
};
9+
10+
PARAM NTHASH_PARAMS[] = {
11+
{"<addresses>", "<context handle>:<proxy info>"},
12+
{"<encrypted blob>", "<HEX>"},
13+
{"[<server challenge>]", "If omitted, a static challenge of 1122334455667788 will be used"},
14+
{NULL, NULL}
15+
};
16+
17+
PARAM PROTECT_PARAMS[] = {
18+
{"<addresses>", "<context handle>:<proxy info>"},
19+
{"<nt hash>", "<HEX>"},
20+
{NULL, NULL}
21+
};
22+
23+
PARAM COMPARE_PARAMS[] = {
24+
{"<addresses>", "<context handle>:<proxy info>"},
25+
{"<encrypted blob>", "<HEX>"},
26+
{"<encrypted blob/NT hash>", "<HEX>"},
27+
{NULL, NULL}
28+
};
29+
30+
COMMAND_PTR Inject, Ping, Challenge, Compare, NtHash, Protect;
31+
32+
COMMAND COMMANDS[] = {
33+
{ "inject", "Inject module and start PtC-RPC server inside LSASS", NULL, Inject},
34+
{ "ping", "Ping the PtC-RPC server inside LSASS", NULL, Ping },
35+
{ "challenge", "Calculate NTLMv2 Response using encrypted credentials", CHALLENGE_PARAMS, Challenge },
36+
{ "nthash", "Calculate NTLMv1 Response using encrypted credentials", NTHASH_PARAMS, NtHash },
37+
{ "protect", "Convert NT hash to encrypted blob", PROTECT_PARAMS, Protect },
38+
{ "compare", "Compare two encrypted blobs or an encrypted blob with a NT hash", COMPARE_PARAMS, Compare },
39+
{ NULL, NULL }
40+
};
41+
42+
LPCCH EXAMPLES[] = {
43+
"PtC.exe inject [<module>]",
44+
"PtC.exe ping",
45+
"PtC.exe challenge 0x1a34b[...]:0x7fff7[...] 0a92a82feb4[...] 6c0079[...]:610064[...]:020008[...]:66a98b[...]",
46+
"PtC.exe nthash 0x1a34b[...]:0x7fff7[...] 0a92a82feb4[...]",
47+
"PtC.exe protect 0x1a34b[...]:0x7fff7[...] 0a92a82feb4[...]",
48+
"PtC.exe compare 0x1a34b[...]:0x7fff7[...] 0a92a82feb4[...] 66a98b[...]",
49+
NULL
50+
};
51+
52+
void PrintMenu() {
53+
printf("Usage: <command> [<parameters...>]\n");
54+
printf("\nCommands:\n");
55+
for (int i = 0; ; i++) {
56+
if (COMMANDS[i].name == NULL) break;
57+
printf(" %s - %s\n", COMMANDS[i].name, COMMANDS[i].description);
58+
59+
if (COMMANDS[i].params != NULL) {
60+
for (int n = 0; ; n++) {
61+
if (COMMANDS[i].params[n].name == NULL) break;
62+
printf(" %s - %s\n", COMMANDS[i].params[n].name, COMMANDS[i].params[n].description);
63+
}
64+
}
65+
}
66+
printf("\nExamples:\n");
67+
for (int i = 0; ; i++) {
68+
if (EXAMPLES[i] == NULL) break;
69+
printf(" %s\n", EXAMPLES[i]);
70+
}
71+
}
72+

‎PassTheChallenge/Menu.h‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#pragma once
2+
3+
#include <Windows.h>
4+
#include <stdio.h>
5+
6+
typedef int COMMAND_PTR(int, LPCCH*);
7+
8+
typedef struct _PARAM {
9+
LPCCH name;
10+
LPCCH description;
11+
} PARAM, * PPARAM;
12+
13+
typedef struct _COMMAND {
14+
LPCCH name;
15+
LPCCH description;
16+
PPARAM params;
17+
COMMAND_PTR* func;
18+
} COMMAND, * PCOMMAND;
19+
20+
COMMAND COMMANDS[];
21+
void PrintMenu();

0 commit comments

Comments
 (0)