Get-ProtocolHandle.ps1

Get-ProtocolHandle.ps1

# based on: https://msrc-blog.microsoft.com/2008/12/09/ms08-075-reducing-attack-surface-by-turning-off-protocol-handlers/
# https://blogs.msdn.microsoft.com/noahc/2006/10/19/register-a-custom-url-protocol-handler/
# https://zero.lol/2019-05-22-fun-with-uri-handlers/
# https://www.vdoo.com/blog/exploiting-custom-protocol-handlers-in-windows
# https://docs.microsoft.com/en-us/windows/win32/shell/app-registration
# https://docs.microsoft.com/en-us/windows/win32/shell/fa-intro
# HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts
# jnlp:file://///server/file.txt

$null = $DataTable = New-Object System.Data.DataTable;
$null = $DataTable.Columns.Add("key");
$null = $DataTable.Columns.Add("path");

foreach ($Key in Get-ChildItem Microsoft.PowerShell.Core\Registry::HKEY_CLASSES_ROOT)
{ 
    $Path = $Key.PSPath + '\shell\open\command';
    $HasURLProtocol = $Key.Property -contains 'URL Protocol';

    if(($HasURLProtocol) -and (Test-Path $Path)){
        $CommandKey = Get-Item $Path;
        $ProtBin = $CommandKey.GetValue("")
        $ProtKey = $Key.Name.SubString($Key.Name.IndexOf('\') + 1)
        $null = $DataTable.Rows.Add($ProtKey,$ProtBin)
    }
}     
     
$DataTable