{"id":838,"date":"2020-03-10T20:08:45","date_gmt":"2020-03-10T19:08:45","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=838"},"modified":"2025-03-18T14:57:04","modified_gmt":"2025-03-18T13:57:04","slug":"windows-registry","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=838","title":{"rendered":"Windows Registry"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The Win\u00addows reg\u00adistry is a cen\u00adtral data stor\u00adage for the oper\u00ada\u00adtion sys\u00adtem as well as for appli\u00adca\u00adtions. It\u2019s a key-val\u00adue stor\u00adage in a tree structure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A <em>hive<\/em> is a set of keys and their val\u00adues. The root hives&nbsp;are:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Short<\/th><th>Long<\/th><th>Con\u00adtent<\/th><th>Source file<\/th><\/tr><\/thead><tbody><tr><td><span class=\"caps\">HKCR<\/span><\/td><td><span class=\"caps\">HKEY_CLASSES_ROOT<\/span><\/td><td>Infor\u00adma\u00adtion about file types and properties<\/td><td><\/td><\/tr><tr><td><span class=\"caps\">HKCC<\/span><\/td><td><span class=\"caps\">HKEY_CURRRENT_CONFIG<\/span><\/td><td>Infor\u00adma\u00adtion about the hard\u00adware configuration<\/td><td><\/td><\/tr><tr><td><span class=\"caps\">HKCU<\/span><\/td><td><span class=\"caps\">HKEY_CURRENT_USER<\/span><\/td><td>Set\u00adtings from the cur\u00adrent user. This key changes depend\u00ading the cur\u00adrent&nbsp;user.<\/td><td>$userprofile\\Ntuser.dat<\/td><\/tr><tr><td><span class=\"caps\">HKLM<\/span><\/td><td><span class=\"caps\">HKEY_LOCAL_MACHINE<\/span><\/td><td>Hard\u00adware infor\u00adma\u00adtion about devices, mem\u00ado\u00adry and drivers.<\/td><td><span class=\"caps\">HKLM<\/span>\\<span class=\"caps\">SAM<\/span>: \\system32\\config\\sam<br><span class=\"caps\">HKLM<\/span>\\Security: \\system32\\config\\security<br><span class=\"caps\">HKLM<\/span>\\Software: \\system32\\config\\software<br><span class=\"caps\">HKLM<\/span>\\System: \\system32\\config\\system<\/td><\/tr><tr><td><span class=\"caps\">HKU<\/span><\/td><td><span class=\"caps\">HKEY_USERS<\/span><\/td><td>Default set\u00adtings for new&nbsp;users.<\/td><td><\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">Reg\u00adistry&nbsp;hives<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">There are also a few volatile keys like <span class=\"caps\">HKLM<\/span>\\Hardware which are delet\u00aded with sys\u00adtem shutdown.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Enumeration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Get infor\u00adma\u00adtion about a&nbsp;key:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">reg query \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\Currentversion\\Winlogon\"<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Search in the reg\u00adistry for passwords:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">reg query HKLM \/f password \/t REG_SZ \/s\nreg query HKCU \/f password \/t REG_SZ \/s\nreg query \"HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\" \/s | findstr \"HKEY_CURRENT_USER HostName PortNumber UserName PublicKeyFile PortForwardings ConnectionSharing ProxyPassword ProxyUsername\nreg query HKCU\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\\nreg query HKEY_CURRENT_USER\\Software\\OpenSSH\\Agent\\Keys<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Usage<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">See the per\u00admis\u00adsions for reg\u00adistry keys like follows:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">subinacl \/keyreg HKEY_LOCAL_MACHINE\\software\\microsoft<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Write a null-ter\u00admi\u00adnat\u00aded string in the new key NewKeyName:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">reg add hklm\\Software\\Bla \/v NewKeyName \/t REG_SZ \/d \"This is new string content.\"<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Export a (sub-) tree:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">reg export HKLM\\Software\\Suppensoftware exp.reg<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Various<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">To detect autostart programs:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">reg query \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<br>reg query \"HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"<br>reg query \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\"<br>reg query \"HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\"<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Regrip<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/airbus-cert\/regrippy\">Github<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use <a href=\"https:\/\/miloserdov.org\/?p=5448\">Regrip\u00adper<\/a> to export parts of a reg\u00adistry hive file (e.g. <span class=\"caps\">NTUSER<\/span>.<span class=\"caps\">DAT<\/span>) into a clear text&nbsp;file.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Use registry-read.py (from Impack\u00adet) to parse offline a reg\u00adistry hive file (<span class=\"caps\">NTUSER<\/span>.<span class=\"caps\">DAT<\/span>).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Reglookup is also available.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Win\u00addows reg\u00adistry is a cen\u00adtral data stor\u00adage for the oper\u00ada\u00adtion sys\u00adtem as well as for appli\u00adca\u00adtions. It\u2019s a key-val\u00adue stor\u00adage in a tree struc\u00adture. A hive is a set of keys and their val\u00adues. The root hives&nbsp;are: Short Long Con\u00adtent Source file <span class=\"caps\">HKCR<\/span> <span class=\"caps\">HKEY_CLASSES_ROOT<\/span> Infor\u00adma\u00adtion about file types and prop\u00ader\u00adties <span class=\"caps\">HKCC<\/span> <span class=\"caps\">HKEY_CURRRENT_CONFIG<\/span> Infor\u00adma\u00adtion&nbsp;about&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[468],"tags":[213,24],"class_list":["post-838","post","type-post","status-publish","format-standard","hentry","category-general","tag-registry","tag-windows"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/838","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=838"}],"version-history":[{"count":11,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/838\/revisions"}],"predecessor-version":[{"id":4646,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/838\/revisions\/4646"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=838"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=838"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=838"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}