epotseluevskaya/regsecretscs — explained in plain English
Analysis updated 2026-05-18
Extract local SAM password hashes during an authorized penetration test.
Pull LSA secrets and DPAPI keys from a Windows machine you have permission to test.
Recover cached domain credentials from a domain-joined machine for security research.
| epotseluevskaya/regsecretscs | bio-canse/fh6-miaomiao-tools | qiezi-228/saycheese_modular_unityshaderlibrary_supportvfxgraph | |
|---|---|---|---|
| Stars | 19 | 19 | 19 |
| Language | C# | C# | C# |
| Setup difficulty | moderate | moderate | moderate |
| Complexity | 4/5 | 3/5 | 3/5 |
| Audience | researcher | general | vibe coder |
Figures from each repo's GitHub metadata at analysis time.
Requires administrative Windows privileges (SeBackupPrivilege) and a legal authorization to test the target machine.
RegSecretsCS is a security research tool written in C# that reads sensitive credential material stored in the Windows registry on a local machine. It pulls out SAM password hashes for local user accounts, LSA secrets such as service account passwords and machine account hashes, DPAPI encryption keys, and cached domain login credentials from machines joined to a Windows domain. The README explains that it works by opening registry keys with a special backup and restore flag, which requires a Windows privilege called SeBackupPrivilege, then decrypting the data entirely in memory rather than writing anything to disk. The project describes itself as inspired by two existing pieces of public security research: a script from the Impacket toolkit and a Synacktiv research paper on extracting these same secrets purely through the registry. It can be compiled into either a standalone executable or a library file using the standard .NET compiler that ships with Windows, and can also be loaded and run entirely in memory from PowerShell without ever saving a file to disk. Command line options let you run a full extraction or restrict it to just the SAM hashes. The README states plainly that this is meant for authorized security testing, research, and education only, on systems the user owns or has explicit written permission to test, and warns that unauthorized use is illegal. It also discloses that the code was AI generated and then manually tested against a range of real Windows configurations. This tool fits penetration testers and security researchers rather than general developers, since using it requires administrative access and an understanding of what the extracted credentials mean.
A C# tool for authorized penetration testers to extract SAM hashes, LSA secrets, and cached domain credentials from a local Windows registry.
Mainly C#. The stack also includes C#, .NET, PowerShell.
No open source license is stated in the README, usage is restricted by the author to authorized testing and research only.
Setup difficulty is rated moderate, with roughly 30min to a first successful run.
Mainly researcher.
This repo across BitVibe Labs
double-check against the repo, no cap.