impacket/dcerpt/winreg 模块功能补全

最新推荐文章于 2024-05-14 12:38:09 发布
最新推荐文章于 2024-05-14 12:38:09 发布
阅读量190 收藏
点赞数
文章标签： Access Security Windows Apache 
# Copyright (c) 2003-2006 CORE Security Technologies
#
# This software is provided under under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# $Id: winreg.py,v 1.7 2006/05/23 21:19:26 gera Exp $
#
# Description:
#   WinReg (Windows Registry) interface implementation.
#

import array
import struct

import dcerpc
from impacket import ImpactPacket

MSRPC_UUID_WINREG = '\x01\xd0\x8c\x33\x44\x22\xf1\x31\xaa\xaa\x90\x00\x38\x00\x10\x03\x01\x00\x00\x00'

# Registry Security Access Mask values
KEY_CREATE_LINK         = 0x20
KEY_CREATE_SUB_KEY      = 0x04
KEY_ENUMERATE_SUB_KEYS  = 0x08
KEY_EXECUTE             = 0x20019
KEY_NOTIFY              = 0x10
KEY_QUERY_VALUE         = 0x01
KEY_SET_VALUE           = 0x02
KEY_ALL_ACCESS          = 0xF003F
KEY_READ                = 0x20019
KEY_WRITE               = 0x20006

# Registry Data types
REG_NONE                = 0    # No value type
REG_SZ                  = 1    # Unico nul terminated string
REG_EXPAND_SZ           = 2    # Unicode nul terminated string
                               # (with environment variable references)
REG_BINARY              = 3 #   // Free form binary
REG_DWORD                =    4 #   // 32-bit number
REG_DWORD_LITTLE_ENDIAN =   4 #   // 32-bit number (same as REG_DWORD)
REG_DWORD_BIG_ENDIAN    =    5 #   // 32-bit number
REG_LINK                =     6 #   // Symbolic Link (unicode)
REG_MULTI_SZ            =     7 #   // Multiple Unicode strings
REG_RESOURCE_LIST       =     8 #   // Resource list in the resource map
REG_FULL_RESOURCE_DESCRIPTOR  = 9   # Resource list in the hardware description
REG_RESOURCE_REQUIREMENTS_LIST  = 10


class WINREGCloseKey(ImpactPacket.Header):
    OP_NUM = 5

    __SIZE = 20

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGCloseKey.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)


    def get_header_size(self):
        return WINREGCloseKey.__SIZE


class WINREGRespCloseKey(ImpactPacket.Header):
    __SIZE = 24

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespCloseKey.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_return_code(self):
        return self.get_long(20, '<')
    def set_return_code(self, code):
        self.set_long(20, code, '<')


    def get_header_size(self):
        return WINREGRespCloseKey.__SIZE


class WINREGDeleteValue(ImpactPacket.Header):
    OP_NUM = 8

    __SIZE = 40

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGDeleteValue.__SIZE)

        # Write some unknown fluff.
        self.get_bytes()[22:36] = array.array('B', '\x0a\x02\x00\xEC\xfd\x7f\x05\x01' + (6 * '\x00'))

        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
	print var_size > 0
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_name(self):
        return unicode(self.get_bytes().tostring()[40:], 'utf-16le')
    def set_name(self, name):
        if not name.endswith('\0'):
            name += '\0'
        namelen = len(name)
        wlen = 2 * namelen
        if (wlen % 4):
            pad = ('\x00' * (4 - (wlen % 4)))
        else:
            pad = ''

        self.set_word(20, 2 * namelen, '<')
        self.set_long(36, namelen, '<')
        self.get_bytes()[40:] = array.array('B', name.encode('utf-16le') + pad)


    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGDeleteValue.__SIZE
        assert var_size > 0
        return WINREGDeleteValue.__SIZE + var_size


class WINREGRespDeleteValue(ImpactPacket.Header):
    __SIZE = 4

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespDeleteValue.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_return_code(self):
        return self.get_long(0, '<')
    def set_return_code(self, code):
        self.set_long(0, code, '<')


    def get_header_size(self):
        return WINREGRespDeleteValue.__SIZE


class WINREGDeleteKey(ImpactPacket.Header):
    OP_NUM = 7

    __SIZE = 40

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGDeleteKey.__SIZE)

        # Write some unknown fluff.
        self.get_bytes()[22:36] = array.array('B', '\x0a\x02\x00\xEC\xfd\x7f\x05\x01' + (6 * '\x00'))

        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_key_name(self):
        return unicode(self.get_bytes().tostring()[40:], 'utf-16le')
    def set_key_name(self, name):
        if not name.endswith('\0'):
            name += '\0'
        namelen = len(name)
        wlen = 2 * namelen
        if (wlen % 4):
            pad = ('\x00' * (4 - (wlen % 4)))
        else:
            pad = ''

        self.set_word(20, 2 * namelen, '<')
        self.set_long(36, namelen, '<')
        self.get_bytes()[40:] = array.array('B', name.encode('utf-16le') + pad)


    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGDeleteKey.__SIZE
        assert var_size > 0
        return WINREGDeleteKey.__SIZE + var_size


class WINREGRespDeleteKey(ImpactPacket.Header):
    __SIZE = 4

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespDeleteKey.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_return_code(self):
        return self.get_long(0, '<')
    def set_return_code(self, code):
        self.set_long(0, code, '<')


    def get_header_size(self):
        return WINREGRespDeleteKey.__SIZE


class WINREGCreateKey(ImpactPacket.Header):
    OP_NUM = 6

    __SIZE = 64

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGCreateKey.__SIZE)

        # Write some unknown fluff.
        self.get_bytes()[22:36] = array.array('B', '\x0a\x02\x00\xEC\xfd\x7f\x05\x01' + (6 * '\x00'))
        self.get_bytes()[-24:] = array.array('B', 15 * '\x00' + '\x02' + 8 * '\x00')

        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_key_name(self):
        return unicode(self.get_bytes().tostring()[40:-24], 'utf-16le')
    def set_key_name(self, name):
        if not name.endswith('\0'):
            name += '\0'
        namelen = len(name)
        wlen = 2 * namelen
        if (wlen % 4):
            pad = ('\x00' * (4 - (wlen % 4)))
        else:
            pad = ''

        self.set_word(20, 2 * namelen, '<')
        self.set_long(36, namelen, '<')
        self.get_bytes()[40:-24] = array.array('B', name.encode('utf-16le') + pad)


    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGCreateKey.__SIZE
        assert var_size > 0
        return WINREGCreateKey.__SIZE + var_size


class WINREGRespCreateKey(ImpactPacket.Header):
    __SIZE = 28

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespCreateKey.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_return_code(self):
        return self.get_long(24, '<')
    def set_return_code(self, code):
        self.set_long(24, code, '<')


    def get_header_size(self):
        return WINREGRespCreateKey.__SIZE


#context handle
# WORD LEN (counting the 0s)
# DWORD LEN (in unicode, that is without counting the 0s)
# KEYNAME in UNICODE
# 6 bytes UNKNOWN (all 0s)
# DWORD ACCESS_MASK

class WINREGOpenKey(ImpactPacket.Header):
    OP_NUM = 15

    __SIZE = 44

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGOpenKey.__SIZE)

        self.set_access_mask(KEY_READ)

        # Write some unknown fluff.
        self.get_bytes()[24:28] = array.array('B', '\x00\xEC\xfd\x7f')

        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_key_name(self):
        return unicode(self.get_bytes().tostring()[40:-4], 'utf-16le')
    def set_key_name(self, name):
        if not name.endswith('\0'):
            name += '\0'
        namelen = len(name)
#       padlen = 2 * (int((namelen+2) / 4) * 4 + 2 - namelen)
	padlen = 2*namelen-int(2*namelen/4)*4+4
        pad = '\x00' * padlen

        self.set_word(20, 2 * namelen, '<')
        self.set_word(22, 2 * namelen, '<')
        self.set_long(28, namelen, '<')
        self.set_long(36, namelen, '<')
        self.get_bytes()[40:-4] = array.array('B', name.encode('utf-16le') + pad)

    def get_access_mask(self):
        return self.get_long(-4, '<')
    def set_access_mask(self, mask):
        self.set_long(-4, mask, '<')


    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGOpenKey.__SIZE
        assert var_size > 0
        return WINREGOpenKey.__SIZE + var_size


class WINREGRespOpenKey(ImpactPacket.Header):
    __SIZE = 24

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespOpenKey.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_return_code(self):
        return self.get_long(20, '<')
    def set_return_code(self, code):
        self.set_long(20, code, '<')


    def get_header_size(self):
        return WINREGRespOpenKey.__SIZE


class WINREGSetValue(ImpactPacket.Header):
    OP_NUM = 22

    __SIZE = 52

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGSetValue.__SIZE)

        # Write some unknown fluff.
        self.get_bytes()[24:28] = array.array('B', '\x00\xEC\xfd\x7f')
        self.namelen = 0

        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_name(self):
        return unicode(self.get_bytes().tostring()[40:40+self.namelen], 'utf-16le')
    def set_name(self, name):
        if not name.endswith('\0'):
            name += '\0'
        namelen = len(name)
        if namelen & 0x01:
            pad = '\x00\x00'
        else:
            pad = ''

        self.set_word(20, 2 * namelen, '<')
        self.set_word(22, 2 * namelen, '<')
        self.set_long(28, namelen, '<')
        self.set_long(36, namelen, '<')
        padded_name = array.array('B', name.encode('utf-16le') + pad)
        self.get_bytes()[40:40+self.namelen] = padded_name
        self.namelen = len(padded_name)

    def get_data_type(self):
        return self.get_long(40+self.namelen, '<')
    def set_data_type(self, type):
        self.set_long(40+self.namelen, type, '<')

    def get_data(self):
        data_type = self.get_data_type()
        data = self.get_bytes().tostring()[40+self.namelen+8:-4]
        if data_type == REG_DWORD:
            data = struct.unpack('<L', data)[0]
        elif data_type == REG_SZ:
            data = unicode(data, 'utf-16le')
        return data

    def set_data(self, data):
        data_type = self.get_data_type()
        pad = ''
        if data_type == REG_DWORD:
            data = struct.pack('<L', data)
        elif data_type == REG_SZ:
            if not data.endswith('\0'):
                data += '\0'
            if len(data) & 0x01:
                pad = '\x00\x00'
            data = data.encode('utf-16le')
        elif data_type == REG_BINARY:
            if len(data) & 0x01:
                pad = '\x00\x00'

        datalen = len(data)
        self.set_long(40+self.namelen+4, datalen, '<')
        self.set_long(-4, datalen, '<')
        self.get_bytes()[40+self.namelen+8:-4] = array.array('B', data + pad)


    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGSetValue.__SIZE
        assert var_size > 0
        return WINREGSetValue.__SIZE + var_size


class WINREGRespSetValue(ImpactPacket.Header):
    __SIZE = 4

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespSetValue.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_return_code(self):
        return self.get_long(0, '<')
    def set_return_code(self, code):
        self.set_long(0, code, '<')


    def get_header_size(self):
        return WINREGRespSetValue.__SIZE


# context_handle
# len
# \x0a\x02\x00\xec\xfd\x7f\x05\x01 \x00 * 6
# len /2
# valuename

class WINREGQueryValue(ImpactPacket.Header):
    OP_NUM = 17

    __SIZE = 80

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGQueryValue.__SIZE)

        self.set_data_len(0xC8)

        # Write some unknown fluff.
        self.get_bytes()[24:28] = array.array('B', '\x00\xEC\xfd\x7f')
        self.get_bytes()[-40:-28] = array.array('B', '\x8c\xfe\x12\x00\x69\x45\x13\x00\x69\x45\x13\x00')
        self.get_bytes()[-16:-12] = array.array('B', '\x94\xfe\x12\x00')
        self.get_bytes()[-8:-4] = array.array('B', '\x80\xfe\x12\x00')

        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_name(self):
        return unicode(self.get_bytes().tostring()[40:-40], 'utf-16le')
    def set_name(self, name):
        if not name.endswith('\0'):
            name += '\0'
        namelen = len(name)
        if namelen & 0x01:
            pad = '\x00\x00'
        else:
            pad = ''

        self.set_word(20, 2 * namelen, '<')
        self.set_word(22, 2 * namelen, '<')
        self.set_long(28, namelen, '<')
        self.set_long(36, namelen, '<')
        self.get_bytes()[40:-40] = array.array('B', name.encode('utf-16le') + pad)

    def get_data_len(self):
        return self.get_long(-28, '<')
    def set_data_len(self, len):
        self.set_long(-28, len, '<')
        self.set_long(-12, len, '<')


    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGQueryValue.__SIZE
        assert var_size > 0
        return WINREGQueryValue.__SIZE + var_size


class WINREGRespQueryValue(ImpactPacket.Header):
    __SIZE = 44

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespQueryValue.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_data_type(self):
        return self.get_long(4, '<')
    def set_data_type(self, type):
        self.set_long(4, type, '<')

    def get_data_len(self):
        return self.get_long(20, '<')
    def set_data_len(self, len):
        self.set_long(20, len, '<')
        self.set_long(28, len, '<')

    def get_data(self):
        data_type = self.get_data_type()
        data = self.get_bytes().tostring()[24:24+self.get_data_len()]
        if data_type == REG_DWORD:
            data = struct.unpack('<L', data)[0]
        elif data_type == REG_SZ:
            data = unicode(data, 'utf-16le')
            #liuzhen
            #data = data.encode('gb2312')

        return data[:-1]

    def set_data(self, len):
        raise Exception, "method not implemented"

    def get_return_code(self):
        return self.get_long(-4, '<')
    def set_return_code(self, code):
        self.set_long(-4, code, '<')


    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGRespQueryValue.__SIZE
        assert var_size > 0
        return WINREGRespQueryValue.__SIZE + var_size


class WINREGOpenHK(ImpactPacket.Header):
    # OP_NUM is a "virtual" field.

    __SIZE = 12

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGOpenHK.__SIZE)

        self.set_long(0, 0x06f7c0, '<') # magic, apparently always the same
        self.set_long(4, 0x019b58, '<') # don't know exactly, can be almost anything so far
        self.set_access_mask(0x2000000)

        if aBuffer: self.load_header(aBuffer)

    def get_access_mask(self):
        return self.get_long(8, '<')
    def set_access_mask(self, mask):
        self.set_long(8, mask, '<')


    def get_header_size(self):
        return WINREGOpenHK.__SIZE


class WINREGRespOpenHK(ImpactPacket.Header):
    __SIZE = 24

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespOpenHK.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_return_code(self):
        return self.get_long(20, '<')
    def set_return_code(self, code):
        self.set_long(20, code, '<')


    def get_header_size(self):
        return WINREGRespOpenHK.__SIZE


class WINREGOpenHKCR(WINREGOpenHK):
    OP_NUM = 0

class WINREGOpenHKLM(WINREGOpenHK):
    OP_NUM = 2

class WINREGOpenHKU(WINREGOpenHK):
    OP_NUM = 4


class DCERPCWinReg:
    def __init__(self, dce):
        self._dce = dce

    def openHKCR(self):
        winregopen = WINREGOpenHKCR()
        self._dce.send(winregopen)
        data = self._dce.recv()
        retVal = WINREGRespOpenHK(data)
        return retVal

    def openHKU(self):
        winregopen = WINREGOpenHKU()
        self._dce.send(winregopen)
        data = self._dce.recv()
        retVal = WINREGRespOpenHK(data)
        return retVal

    def regCloseKey(self, context_handle):
        wreg_closekey = WINREGCloseKey()
        wreg_closekey.set_context_handle( context_handle )
        self._dce.send(wreg_closekey)
        data = self._dce.recv()
        retVal = WINREGRespCloseKey(data)
        return retVal

    def regOpenKey(self, context_handle, aKeyname, anAccessMask):
        wreg_openkey = WINREGOpenKey()
        wreg_openkey.set_context_handle( context_handle )
        wreg_openkey.set_key_name( aKeyname )
        wreg_openkey.set_access_mask( anAccessMask )
        self._dce.send(wreg_openkey)
        data = self._dce.recv()
        retVal = WINREGRespOpenKey(data)
        return retVal

    def regCreateKey(self, context_handle, aKeyname):
        wreg_createkey = WINREGCreateKey()
        wreg_createkey.set_context_handle( context_handle )
        wreg_createkey.set_key_name( aKeyname )
        self._dce.send(wreg_createkey)
        data = self._dce.recv()
        retVal = WINREGRespCreateKey(data)
        return retVal

    def regDeleteKey(self, context_handle, aKeyname):
        wreg_deletekey = WINREGDeleteKey()
        wreg_deletekey.set_context_handle( context_handle )
        wreg_deletekey.set_key_name( aKeyname )
        self._dce.send(wreg_deletekey)
        data = self._dce.recv()
        retVal = WINREGRespDeleteKey(data)
        return retVal

    def regDeleteValue(self, context_handle, aValuename):
        wreg_deletevalue = WINREGDeleteValue()
        wreg_deletevalue.set_context_handle( context_handle )
        wreg_deletevalue.set_name( aValuename )
        self._dce.send(wreg_deletevalue)
        data = self._dce.recv()
        retVal = WINREGRespDeleteValue(data)
        return retVal

    def regQueryValue(self, context_handle, aValueName, aDataLen):
        wreg_queryval = WINREGQueryValue()
        wreg_queryval.set_context_handle( context_handle )
        wreg_queryval.set_name( aValueName )
        wreg_queryval.set_data_len( aDataLen )
        self._dce.send(wreg_queryval)
        data = self._dce.recv()
        retVal = WINREGRespQueryValue(data)
        return retVal

    def regSetValue(self, context_handle, aValueType, aValueName, aData):
        wreg_setval = WINREGSetValue()
        wreg_setval.set_context_handle( context_handle )
        wreg_setval.set_data_type(aValueType)
        wreg_setval.set_name(aValueName)
        wreg_setval.set_data(aData)
        self._dce.send(wreg_setval)
        data = self._dce.recv()
        retVal = WINREGRespSetValue(data)
        return retVal

    def openHKLM(self):
        winregopen = WINREGOpenHKLM()
        self._dce.send(winregopen)
        data = self._dce.recv()
        retVal = WINREGRespOpenHK(data)
        return retVal
    #When getList=False will get alone Enum Value, and indexNum value is Enum's index
    def regEnumValue(self, context_handle,indexNum=0,getList=True):
        enumList=[]
        wreg_enumkey = WINREGEnumValue()
        wreg_enumkey.set_context_handle( context_handle )
        if getList:
           indexNum=0
           while True:
               wreg_enumkey.set_index(indexNum)
               self._dce.send(wreg_enumkey)
               data = self._dce.recv()
               retVal = WINREGRespEnumValue(data)
               data=retVal.get_data()
               data=data[:].decode('utf-16')
               if data:
                  enumList.append(data)
               else:
                  break
               indexNum+=1
           return enumList 
        else:
           wreg_enumkey.set_index( indexNum )
           self._dce.send(wreg_enumkey)
           data = self._dce.recv()
           retVal = WINREGRespEnumValue(data)
           return retVal

class WINREGEnumValue(ImpactPacket.Header):
    OP_NUM = 9

    __SIZE = 64

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGEnumValue.__SIZE)

        # Write some unknown fluff.
        self.get_bytes()[24:65] = array.array('B', '\x00\x00\x14\x04\x01\x00\x00\x00\x0a\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\x7f')
    #set index
    def set_index(self,num):
        self.set_long(20,num,'<')
    def get_context_handle(self):
        return self.get_bytes().tolist()[:20]
    def set_context_handle(self, handle):
        assert 20 == len(handle)
        self.get_bytes()[:20] = array.array('B', handle)

    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGEnumValue.__SIZE
        assert var_size > 0
        return WINREGEnumValue.__SIZE + var_size

class WINREGRespEnumValue(ImpactPacket.Header):
    __SIZE = 44

    def __init__(self, aBuffer = None):
        ImpactPacket.Header.__init__(self, WINREGRespEnumValue.__SIZE)
        if aBuffer: self.load_header(aBuffer)

    def get_data_len(self):
        return self.get_long(16, '<')
    def set_data_len(self, len):
        self.set_long(16, len, '<')
        self.set_long(19, len, '<')

    def get_data(self):
        #Decide whether more items, last 4 byte 
        if self.get_bytes().tostring()[-1:-4]==r'\0x03\0x01\0x00\0x00':
            data=False
        else:
            data = self.get_bytes().tostring()[20:20+2*self.get_data_len()]
            data = unicode(data, 'utf-8')
            #liuzhen
            #data=data.encode('gb2312')
        return data[:-2]

    def set_data(self, len):
        raise Exception, "method not implemented"


    def get_header_size(self):
        var_size = len(self.get_bytes()) - WINREGRespEnumValue.__SIZE
        assert var_size > 0
        return WINREGRespEnumValue.__SIZE + var_size
 

impacket/dcerpt/winreg 模块 补全枚举

 

用这个代码替换winreg.py 即可

 

 

liuzhen1984
关注
Impacket官方使用指南
weixin_30877755的博客
04-09 2844
什么是Impacket Impacket是用于处理网络协议的Python类的集合。Impacket专注于提供对数据包的简单编程访问，以及协议实现本身的某些协议（例如SMB1-3和MSRPC）。数据包可以从头开始构建，也可以从原始数据中解析，而面向对象的API使处理协议的深层次结构变得简单。该库提供了一组工具，作为在此库找到可以执行的操作的示例。 有关某些工具的说明，请访问：https:/...
pythonwin使用_python之windows模块_winreg的使用心得
weixin_39779032的博客
12-10 574
_winreg模块可以用来操作windows的注册表首先用OpenKey获得句柄handle:_winreg.OpenKey(key,sub_key[,res[,sam]])这个就是句柄handler=_winreg.OpenKey(_winreg.HKEY_CURRENT_USER\Software\Microsoft\TerminalServer Client,'LocalDevices')就...
winreg模块的使用
weixin_30949361的博客
06-20 983
python有内置的注册表操作库--winreg（在33版本中为winreg，在2x版本为_winreg). 1.打开键，枚举键值 1 # -*- coding: gbk -*- 2 import winreg 3 key=winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE,r"SYSTEM\CurrentControlSet\Services\Tc...
【Python】Winreg模块的使用
时光不老的博客
11-24 2153
在Windows操作系统中，注册表是一个重要的数据库，它用于存储系统和应用程序的设置和配置信息。为了操作注册表，Python提供了winreg模块。winreg模块允许我们以编程的方式读取、写入和修改注册表键值。
​winreg --- 访问 Windows 注册表​
C'mon的博客
12-17 933
这些函数将 Windows 注册表 API 暴露给 Python。为了确保即便程序员忘记显式关闭时也能够正确关闭，这里没有用整数作为注册表句柄，而是采用了。在 3.3 版更改: 模块中有几个函数用于触发，此异常现在是的别名。
2024年最全超详细Impacket官方使用指南(1)，2024年最新2024HarmonyOS鸿蒙常见面试题分享
最新发布
2401_84862386的博客
05-14 1071
对于ntlmrelayx.py你还需要安装ldapdomaindump，flask并ldap3如果你在Windows下，你将需要安装 pyReadline最近发布的Impacket安装为了安装源，请从解压缩Impacket包的目录中执行以下命令：pip install . 这将把类安装到默认的Python模块路径中;请注意，您可能需要特殊的权限才能在那里进行写入。有关setup.py中可用的命令和选项的详细信息，请运行python setup.py --help-commands。
electron使用regedit模块时的正确配置方法
01-20
Electron允许我们在一个基于Chromium的环境中运行Node.js代码，这意味着我们可以利用Node.js的全部功能，包括第三方模块。`regedit`模块是这样一个第三方模块，它提供了一种方便的方式来读写Windows注册表。 **第一...
C语言头文件 WINREG
06-13
C语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC语言头文件 WINREGC...
内网渗透系列：内网隧道之ICMP隧道
闵行小鱼塘
07-06 3163
最近开始研究隧道相关，如前做了个整理——内网渗透系列：内网穿透（隧道）学习，本篇专门来学习ICMP隧道
Python模块——_winreg操作注册表
热门推荐
JoeBlackZQQ的专栏
08-31 1万+
From: http://blog.sina.com.cn/s/blog_4b5039210100gmsb.html      用python操作修改windows注册表，显然要比用C或者C++简单。     主要参考资料：官方文档：http://docs.python.org/library/_winreg.html 通过python操作注册表主要有两种方式，一种是通过python的
Python爬虫技术拆解1：获取代理IP集合
沛哥儿的专栏
03-18 657
Python这么语言很多人刚开始的项目都是写个小爬虫，但是大家在写的时候发现经常会被目标网站给拒绝。 目标网站拒绝你千百遍，你待她依然如初恋。如何敲开初恋的大门，这里不得不说下代理IP。 因为很多网站为了拉新，不让老客户不停的访问（作了访问限制）。大家在拉数据的时候，需要每次替换不同的访问IP。这样目标网站会以为你是新用户，就会放你进去。 国内免费的代理IP网站，一般以西刺代理比较火。域...
python构造IP包
JackLiu16的博客
10-22 2327
#coding=utf-8 import sys import socket from impacket import ImpactDecoder, ImpactPacket   def main():       if len(sys.argv)         print "Use: %s " % sys.argv[0]         print "Use: %s
CVE-2019-0708 poc 漏洞复现
qq_42184699的博客
06-03 6011
转载请注明出处！ 技术无罪，但网络不是法外之地，请勿用于恶意用途 个人技术网站：http://www.forever121.cn/ windows服务器在5月15日被爆出高危漏洞，涉及极广可比CVE-2017-0146（永恒之蓝） 影响系统：windows xp 、windows2003、windows 2007 、windows2008、windows2008 R2 虽然x...
Python模块_winreg操作注册表
weixin_33675507的博客
12-21 761
用python操作修改windows注册表，显然要比用C或者C++简单。 主要参考资料：官方文档：http://docs.python.org/library/_winreg.html 通过python操作注册表主要有两种方式，一种是通过python的内置模块_winreg，另一种方式就是Win32 Extension For Python的win32api模块。这里主要简单看看用内置模块...
Python内置_winreg模块操作Windows注册表详解
在Python中操作Windows注册表，内置模块`_winreg`提供了一种便捷的方式。`_winreg`模块是Python标准库的一部分，它允许开发者访问Windows注册表，这对于系统级别的配置管理和数据获取非常有用。操作注册表主要有两个...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值