SharpLocker retrieves current user credentials by simulating a Windows lock screen. It's a C# application intended for execution in memory on target systems, particularly for use with penetration testing tools like Cobalt Strike. The solution addresses the need for credential harvesting within memory-constrained environments, avoiding disk-based execution.
SharpLocker facilitates credential collection via in-memory execution, preventing disk artifacts. Its design focuses on integration with memory injection techniques commonly used in penetration testing. The tool supports multiple monitors, enhancing flexibility in target environments.
- In-memory Execution: Operates entirely in memory, leaving no traces on the target system's disk.
- Cobalt Strike Compatibility: Designed to be used with Cobalt Strike's
execute-assemblycommand for seamless deployment. - Multi-Monitor Support: Functions correctly with single and multiple monitor setups.
- Windows 10 Focused: Specifically designed to work with Windows 10 operating systems.
- Console Output: Sends collected credentials to the console for easy monitoring and analysis.
SharpLocker is a relatively mature tool, with a few months of development activity before the last commit in May 2020. Documentation is minimal, relying primarily on README instructions. The project's limited scope and focused purpose suggest a stable, albeit specialized, tool. Limited issue activity indicates moderate community engagement.
SharpLocker benefits penetration testers and security researchers needing in-memory credential harvesting capabilities. It enables credential collection from compromised systems without leaving residual files. It offers a valuable alternative to traditional credential dumping techniques that require disk access or local execution, providing a streamlined approach for specific exploitation scenarios.