SharpSecDump : .Net Port Of The Remote SAM + LSA Secrets Dumping

SharpSecDump is a .Net port of the remote SAM + LSA Secrets dumping functionality of impacket’s secretsdump.py. By default runs in the context of the current user. Please only use in environments you own or have permission to test against.

Usage

SharpSecDump.exe -target=192.168.1.15 -u=admin -p=Password123 -d=test.local

Required Flags

  • -target – Comma seperated list of IP’s / hostnames to scan. Please don’t include spaces between addresses. Can also dump hashes on the local system by setting target to 127.0.0.1.

Optional Flags

  • -u – Username to use, if you want to use alternate credentials to run. Must use with -p and -d flags
  • -p – Plaintext password to use, if you want to use alternate credentials to run. Must use with -u and -d flags
  • -d – Domain to use, if you want to use alternate credentials to run (. for local domain). Must use with -u and -p flags
  • -threads – Threads to use to concurently enumerate multiple remote hosts (Default: 10)

Notes

The project has been tested against Win 7,10, Server 2012, and Server 2016. Older versions (win 2003 / xp) may not work with this tool.

By default, if you’re attempting to dump hives from your local system, you’ll need to be running from a high-integrity context. However, this is not necessary when targeting remote systems.

This currently supports SAM + SECURITY registry hive dumping to retrieve cached credential data. However, it does not support NTDS.dit parsing / dcsync yet. If you’re looking for dcsync functionality in a .Net project I recommend sharpkatz.

If a system is configured to disallow RPC over TCP (RPC over named pipe is required — this is not a default setting) there is a 21s delay before Windows will fall back to RPC/NP, but will still allow the connection. This appears to be a limitation of using API calls that leverage the SCManager to remotely bind to services.

Credits

This code is a port of functionality from impacket by @agsolino and pypykatz by @skelsec. All credit goes to them for the original steps to parse and decrypt info from the registry hives.

The registry hive structures used are from gray_hat_csharp_code by @BrandonPrry.

Finally, the original idea for the script was based on a partial port I was working on of Posh_SecModule by @Carlos_Perez, a good chunk of initial SAM parsing code came from that project.

R K

Recent Posts

Playwright-MCP : A Powerful Tool For Browser Automation

Playwright-MCP (Model Context Protocol) is a cutting-edge tool designed to bridge the gap between AI…

2 weeks ago

JBDev : A Tool For Jailbreak And TrollStore Development

JBDev is a specialized development tool designed to streamline the creation and debugging of jailbreak…

2 weeks ago

Kereva LLM Code Scanner : A Revolutionary Tool For Python Applications Using LLMs

The Kereva LLM Code Scanner is an innovative static analysis tool tailored for Python applications…

2 weeks ago

Nuclei-Templates-Labs : A Hands-On Security Testing Playground

Nuclei-Templates-Labs is a dynamic and comprehensive repository designed for security researchers, learners, and organizations to…

2 weeks ago

SSH-Stealer : The Stealthy Threat Of Advanced Credential Theft

SSH-Stealer and RunAs-Stealer are malicious tools designed to stealthily harvest SSH credentials, enabling attackers to…

2 weeks ago

ollvm-unflattener : A Tool For Reversing Control Flow Flattening In OLLVM

Control flow flattening is a common obfuscation technique used by OLLVM (Obfuscator-LLVM) to transform executable…

2 weeks ago