Skip to content

Instantly share code, notes, and snippets.

@Graph-X

Graph-X/ironregistry.py

Last active October 1, 2019 16:46
Show Gist options
  • Star 4 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save Graph-X/19a79dd7129d005ce4d2e59240151e52 to your computer and use it in GitHub Desktop.
Save Graph-X/19a79dd7129d005ce4d2e59240151e52 to your computer and use it in GitHub Desktop.
Download ZIP
PoC for hiding things in the registry. My testing hasn't returned any errors when viewing in regedit
Raw
ironregistry.py
from Microsoft.Win32 import Registry
from time import sleep
rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest")
rkey.SetValue(u'\x00 this is a test',u'\x00look at me!')
rkey.Close()
rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest")
values = rkey.GetValueNames()
print("We have {0} values.".format(str(len(values))))
print("The value names returned are: {0}.".format(values[0]))
value = rkey.GetValue(u'\x00 this is a test')
rkey.Close()
print(value)
sleep(10)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment