2 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
SILPH is an open-source tool designed for red team operations, allowing users to dump LSA secrets, SAM hashes, and DCC2 credentials entirely in memory without writing to disk. It integrates with the Orsted C2 framework and runs directly on Windows, avoiding common detection methods. The tool uses advanced Windows APIs to access sensitive data while maintaining stealth.
If you do, here's more
SILPH is an open-source red team tool designed for extracting sensitive data like LSA secrets, SAM hashes, and DCC2 credentials from memory without writing files to disk. It is tailored for integration with the Orsted C2 framework and operates directly on Windows hosts, eliminating the need for remote service creation via RPC. Users can clone the repository from GitHub and compile the tool using Go, targeting the Windows architecture. Once compiled, SILPH can be executed with various options to dump specific credential types.
The tool addresses gaps in existing solutions, particularly around stealth and local execution. Unlike go-secdump, which modifies registry DACLs to gain access, SILPH uses the REG_OPTION_BACKUP_RESTORE flag to enumerate registry keys without altering permissions. This method, derived from a pull request to the Impacket project, allows it to operate quietly, reducing the likelihood of detection by security tools. Testing showed that running SILPH did not generate additional Windows Event Log entries, maintaining a low profile during operation.
SILPH's design philosophy draws inspiration from the character Sylphiette in the series Mushoku Tensei, who navigates challenges through quiet resilience rather than overt power. The tool mirrors this by functioning entirely in memory and integrating smoothly into existing frameworks, aiming to minimize its digital footprint while executing its intended tasks. A forthcoming module for Orsted C2 will expand its capabilities further, providing users with more options for in-memory credential extraction.
Questions about this article
No questions yet.