février 2018 – Erwan's Blog

NativeReg

Fév 032018

A native app is an app that will be launched as soon as the kernel initialization is completed.

It will be launched (in user mode) by the session manager (smss.exe) thru the registry key HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\BootExecute(run at every boot) or HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\setupexecute(run once only).

A native app can only use NT API functions (ntdll.dll) and not the Windows API functions.

Possible usages :
nativereg createkey \Registry\Machine\SYSTEM\Setup key1
nativereg createvalue \Registry\Machine\SYSTEM\Setup\key1 test0 8 REG_RND_SZ
nativereg createvalue \Registry\Machine\SYSTEM\Setup\key1 test1 toto REG_SZ
nativereg createvalue \Registry\Machine\SYSTEM\Setup\key1 test2 112233AABBCC REG_BINARY
nativereg createvalue \Registry\Machine\SYSTEM\Setup\key1 test3 666 REG_DWORD
nativereg deletevalue \Registry\Machine\SYSTEM\Setup\key1 test1
nativereg deletekey \Registry\Machine\SYSTEM\Setup\key1

The tool is 32 bits (a 64 bits may come later).
It works on XP and up.

Discussion here.

Regards,
Erwan

Tiny PXE Server guide

network, PXE, TinyPXE Server 2 Responses »

Fév 032018

Comprehensive guide for Tiny PXE Server here.

Million thanks to Misty on reboot.pro.

OfflineReg and Windows password

offlinereg No Responses »

Fév 032018

From an offline SAM hive (could be from winpe), run the below command, reboot and log in with a blank password.
CAREFULL : make a backup of your hive first !

OfflineReg-win32 "c:\windows\system32\config\SAM" sam\domains\account\users\000003e8 setvaluebyteat v 0 160 OfflineReg-win32 "c:\windows\system32\config\SAM" sam\domains\account\users\000003e8 setvaluebyteat v 0 172

See here for more details about setvaluebyteat details.

000003e8 is my custom local admin account.
000001f4 would be the default windows account.
0xA0 (160) and 0xAC (170) are the offset for the LM and NTLM hash lengths: setting this to 0 effectively set the password to blank.

Use the below command line to enum accounts in your SAM db.

OfflineReg-win32 "c:\windows\system32\config\SAM" SAM\Domains\Account\Users enumkeys

OfflineReg guide

offlinereg No Responses »

Fév 032018

Comprehensive guide for OfflineReg here.

Many thanks to the Misty on reboot.pro

OfflineReg update

offlinereg No Responses »

Fév 032018

Lots of additions, changes, bug fixes, etc made to OfflineReg.

Discussion here.

Donwload here.

Command line
OfflineReg v1.0.3 by Erwan.L - https://erwan.labalec.fr/ - erwan2212@gmail.fr Main Usage : OfflineReg hivepath keypath verb argument(s) Example : OfflineReg "c:\temp\system" a_key_path getvalue a_value_name Example : OfflineReg "c:\temp\system" a_key_path getvaluebyteat a_value_name offset Example : OfflineReg "c:\temp\system" a_key_path setvalue a_reg_sz_value a_new_value Example : OfflineReg "c:\temp\system" a_key_path setvalue " " a_new_value -> will set default key Example : OfflineReg "c:\temp\system" a_key_path setvalue a_reg_dword_value a_dword_value 4 Example : OfflineReg "c:\temp\system" a_key_path setvalue a_reg_qword_value a_qword_value 11 Example : OfflineReg "c:\temp\system" a_key_path setvalue a_reg_binary_value 0a,0b,0c,0d,0e,0f 3 Example : OfflineReg "c:\temp\system" a_key_path setvalue a_reg_binary_value "0a 0b 0c 0d 0e 0f" 3 Example : OfflineReg "c:\temp\system" a_key_path setvalue a_reg_multi_sz_value "blah blah blah" 7 Example : OfflineReg "c:\temp\system" a_key_path setvalue a_reg_expand_sz_value "blah blah blah" 2 Example : OfflineReg "c:\temp\system" a_key_path setvaluebyteat a_reg_binary_value a_byte_value offset Example : OfflineReg "c:\temp\system" a_key_path deletevalue a_value Example : OfflineReg "c:\temp\system" a_key_path deletekey a_key Example : OfflineReg "c:\temp\system" a_key_path deletekey Example : OfflineReg "c:\temp\system" a_key_path deletekeys Example : OfflineReg "c:\temp\system" a_key_path createkey a_key Example : OfflineReg "c:\temp\system" a_key_path createkey Example : OfflineReg "c:\temp\system" " " createkey a_key -> will create a key under root Example : OfflineReg "c:\temp\system" a_key_path enumkeys Example : OfflineReg "c:\temp\system" " " enumkeys -> will enum keys under root Example : OfflineReg "c:\temp\system" a_key_path enumkeysR Example : OfflineReg "c:\temp\system" a_key_path enumvalues Example : OfflineReg "c:\temp\system" a_key_path enumvaluesall Example : OfflineReg "c:\temp\system" a_key_path create Example : OfflineReg "c:\temp\system" " " create Example : OfflineReg "c:\temp\system" " " import commands.reg Example : OfflineReg "c:\temp\system" " " run commands.txt