30 lines
1.4 KiB
Markdown
30 lines
1.4 KiB
Markdown
|
# reg.py
|
||
|
|
|
||
|
|
> Query, add, delete, save or backup registry keys/values on a remote Windows machine over SMB/RPC.
|
||
|
|
> Part of the Impacket suite.
|
||
|
|
> More information: <https://github.com/fortra/impacket>.
|
||
|
|
|
||
|
|
- Query subkeys and values under a registry path:
|
||
|
|
|
||
|
|
`reg.py {{domain}}/{{username}}:{{password}}@{{target}} query -keyName '{{HKLM\SOFTWARE\Microsoft\Windows}}'`
|
||
|
|
|
||
|
|
- Query all subkeys and values under a registry path recursively:
|
||
|
|
|
||
|
|
`reg.py {{domain}}/{{username}}:{{password}}@{{target}} query -keyName '{{HKLM\SOFTWARE\Microsoft\Windows}}' -s`
|
||
|
|
|
||
|
|
- Add a new registry key or value (default value type is `REG_SZ`):
|
||
|
|
|
||
|
|
`reg.py {{domain}}/{{username}}:{{password}}@{{target}} add -keyName '{{HKLM\SOFTWARE\Microsoft\Windows}}' -v {{value_name}} -vt {{REG_SZ|REG_NONE|REG_EXPAND_SZ|REG_BINARY|REG_DWORD|REG_DWORD_BIG_ENDIAN|REG_LINK|REG_MULTI_SZ|REG_QWORD}} -vd {{value_data}}`
|
||
|
|
|
||
|
|
- Delete a registry key or value:
|
||
|
|
|
||
|
|
`reg.py {{domain}}/{{username}}:{{password}}@{{target}} delete -keyName '{{HKLM\SOFTWARE\Example}}' -v {{value_name}}`
|
||
|
|
|
||
|
|
- Save a registry key (and subkeys) to a file on the target via UNC path:
|
||
|
|
|
||
|
|
`reg.py {{domain}}/{{username}}:{{password}}@{{target}} save -keyName '{{HKLM\SOFTWARE\Example}}' -o '\\{{target}}\{{share}}\{{output_file.reg}}'`
|
||
|
|
|
||
|
|
- Backup SAM, SYSTEM and SECURITY hives to a file on a target via UNC path (requires SYSTEM privileges):
|
||
|
|
|
||
|
|
`reg.py {{domain}}/{{username}}:{{password}}@{{target}} backup -o '\\{{target}}\{{share}}'`
|