Code Monkey home page Code Monkey logo

sharpreg's Introduction

SharpReg

SharpReg is a simple code set to interact with the Remote Registry service API using the same SMB process as reg.exe, which uses TCP port 445. This code is compatible with Cobalt Strike.

Z:\>SharpReg.exe

[-] Usage:
        --Query <Computer|local|hostname|ip> <KeyName|SOFTWARE\Microsoft\Policies> <ValueName|count|all|recurse|grep|ScriptBlockLogging> <SearchTeam|Grep() Only|E.g. "Google">

        --Add <Computer|local|hostname|ip> <KeyName|SOFTWARE\Microsoft\Policies> <DataType|SZ|EXPAND_SZ|DWORD|QWORD|BINARY> <ValueName|YourValueName> <ValueData|YourValueData>

        --Delete <Computer|local|hostname|ip> <KeyName|SOFTWARE\Microsoft\Policies> <ValueName|all|ScriptBlockLogging>

        --Persist <Computer|local|hostname|ip> <ValueName|netsvcs>

Examples

Using the all function to walk each key -- its like a simple dir of each key.

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local \ all


\\BCD00000000
\\HARDWARE
\\SAM
\\SECURITY
\\SOFTWARE
\\SYSTEM

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local SYSTEM all


SYSTEM\ActivationBroker
SYSTEM\ControlSet001
SYSTEM\DriverDatabase
SYSTEM\HardwareConfig
SYSTEM\Input
SYSTEM\Keyboard Layout
SYSTEM\Maps
SYSTEM\MountedDevices
SYSTEM\ResourceManager
SYSTEM\ResourcePolicyStore
SYSTEM\RNG
SYSTEM\Select
SYSTEM\Setup
SYSTEM\Software
SYSTEM\WPA
SYSTEM\CurrentControlSet

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local SYSTEM\CurrentControlSet all


SYSTEM\CurrentControlSet\Control
SYSTEM\CurrentControlSet\Enum
SYSTEM\CurrentControlSet\Hardware Profiles
SYSTEM\CurrentControlSet\Policies
SYSTEM\CurrentControlSet\Services
SYSTEM\CurrentControlSet\Software

Counting the subkey names -- fails on keys with a space, atm

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local SYSTEM\CurrentControlSet\Services count

There are 636 subkeys under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

 [!] IOException: The specified registry key does not exist.

Recursively searching keys and values for a specific search term

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local SYSTEM\CurrentControlSet\Services grep Google


SYSTEM\CurrentControlSet\Services\GoogleChromeElevationService
SYSTEM\CurrentControlSet\Services\GoogleChromeElevationService

    ImagePath    REG_EXPANDSTRING    "C:\Program Files\Google\Chrome\Application\80.0.3987.163\elevation_service.exe"
SYSTEM\CurrentControlSet\Services\GoogleChromeElevationService

    DisplayName    REG_STRING    Google Chrome Elevation Service
SYSTEM\CurrentControlSet\Services\gupdate

    ImagePath    REG_EXPANDSTRING    "C:\Program Files\Google\Update\GoogleUpdate.exe" /svc
SYSTEM\CurrentControlSet\Services\gupdate

    DisplayName    REG_STRING    Google Update Service (gupdate)
SYSTEM\CurrentControlSet\Services\gupdate

    Description    REG_STRING    Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.
SYSTEM\CurrentControlSet\Services\gupdatem

    ImagePath    REG_EXPANDSTRING    "C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc
SYSTEM\CurrentControlSet\Services\gupdatem

    DisplayName    REG_STRING    Google Update Service (gupdatem)
SYSTEM\CurrentControlSet\Services\gupdatem

    Description    REG_STRING    Keeps your Google software up to date. If this service is disabled or stopped, your Google software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This service uninstalls itself when there is no Google software using it.

Finding a specific binary on disk and getting the target value.

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>dir /s/b/a C:\Windows\calc.exe
C:\Windows\System32\calc.exe
C:\Windows\WinSxS\x86_microsoft-windows-calc_31bf3856ad364e35_10.0.14393.0_none_7b13d13279112b2e\calc.exe

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local SYSTEM\CurrentControlSet\Services\gupdatem ImagePath

    ImagePath    REG_EXPANDSTRING    "C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc

Overwriting the ImagePath of a service.

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Add local SYSTEM\CurrentControlSet\Services\gupdatem EXPAND_SZ ImagePath "C:\Windows\WinSxS\x86_microsoft-windows-calc_31bf3856ad364e35_10.0.14393.0_none_7b13d13279112b2e\calc.exe"

The add opetation of SYSTEM\CurrentControlSet\Services\gupdatem was successful.

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local SYSTEM\CurrentControlSet\Services\gupdatem ImagePath

    ImagePath    REG_EXPANDSTRING    C:\Windows\WinSxS\x86_microsoft-windows-calc_31bf3856ad364e35_10.0.14393.0_none_7b13d13279112b2e\calc.exe

Restoring the previous value.

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Add local SYSTEM\CurrentControlSet\Services\gupdatem EXPAND_SZ ImagePath "\"C:\Program Files\Google\Update\GoogleUpdate.exe\" /medsvc"

The add opetation of SYSTEM\CurrentControlSet\Services\gupdatem was successful.

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local SYSTEM\CurrentControlSet\Services\gupdatem ImagePath

    ImagePath    REG_EXPANDSTRING    "C:\Program Files\Google\Update\GoogleUpdate.exe" /medsvc

Searching for DLLs...

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Query local System\CurrentControlSet\Control grep ".dll"


System\CurrentControlSet\Control\AppReadiness

    DllName    REG_EXPANDSTRING    C:\Windows\system32\AppReadiness.dll
System\CurrentControlSet\Control\FileSystemUtilities

    IfsUtilExtension    REG_STRING    ifsutilx.dll
System\CurrentControlSet\Control\Print

    ConfigModule    REG_STRING    PrintConfig.dll
System\CurrentControlSet\Control\RetailDemo

    DllName    REG_EXPANDSTRING    C:\Windows\system32\RDXService.dll
System\CurrentControlSet\Control\SecurityProviders

    SecurityProviders    REG_STRING    credssp.dll
System\CurrentControlSet\Control\SrpExtensionConfig

    ExtensionDll    REG_EXPANDSTRING    C:\Windows\system32\appidapi.dll
System\CurrentControlSet\Control\TimeZoneInformation

    DaylightName    REG_STRING    @tzres.dll,-161
System\CurrentControlSet\Control\TimeZoneInformation

    StandardName    REG_STRING    @tzres.dll,-162
System\CurrentControlSet\Control\WalletService

    DllName    REG_EXPANDSTRING    C:\Windows\system32\walletservice.dll
System\CurrentControlSet\Control\WOW

    KnownDLLs    REG_STRING    comm.drv commdlg.dll ctl3dv2.dll ddeml.dll keyboard.drv lanman.drv mmsystem.dll mouse.drv netapi.dll olecli.dll olesvr.dll pmspl.dll shell.dll sound.drv system.drv toolhelp.dll vga.drv wfwnet.drv win87em.dll winoldap.mod winsock.dll winspool.exe wowdeb.exe timer.drv compobj.dll storage.dll ole2.dll ole2disp.dll ole2nls.dll typelib.dll msvideo.dll avifile.dll msacm.dll mciavi.drv mciseq.drv mciwave.drv progman.exe avicap.dll mapi.dll

Hunting persistent spaces in svchosts.exe

Z:\jnqpblc\SharpReg\SharpReg\bin\Debug>SharpReg.exe --Persist local netsvcs

 Empty Parking Spaces Within Svchost:

 [+] FastUserSwitchingCompatibility
 [+] Ias
 [+] Nla
 [+] Ntmssvc
 [+] NWCWorkstation
 [+] Nwsapagent
 [+] SRService
 [+] Wmi
 [+] WmdmPmSp
 [+] LogonHours
 [+] PCAudit
 [+] helpsvc
 [+] uploadmgr

 Unlocked Cars Owned By Svchost:

 [+] CertPropSvc
 [+] SCPolicySvc
 [+] seclogon
 [+] AppInfo
 [+] msiscsi
 [+] EapHost
 [+] browser
 [+] SessionEnv
 [+] wercplsupport
 [+] XblGameSave
 [+] DcpSvc
 [+] RetailDemo
 [+] dmwappushservice
 [+] BDESVC
 [+] DmEnrollmentSvc
 [+] DsmSvc
 [+] NcaSvc
 [+] XboxNetApiSvc
 [+] lfsvc
 [+] Irmon
 [+] Rasauto
 [+] Rasman
 [+] Sharedaccess
 [+] Tapisrv
 [+] wuauserv
 [+] BITS
 [+] AppMgmt
 [+] wisvc
 [+] UsoSvc
 [+] wlidsvc
 [+] NetSetupSvc
 [+] XblAuthManager
 
It's all about the ServiceDll. ;)

sharpreg's People

Contributors

jnqpblc avatar

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.