This guide outlines how to use Meterpreter to manipulate the registry, similar to the `regedit.cmd` program on a Windows machine. # Concepts The Window's registry is used to store configuration settings for both the operating system, as well as software applications. This registry is hierarchical and stores keys and values. The registry keys are similar to folders, and registry values are similar to files. Each registry key should be unique and is separated by backslashes - similar to a Window's filepath. ## Root keys Every registry key must start from one of the following root keys or abbreviations: - `HKEY_LOCAL_MACHINE` or `HKLM` - `HKEY_CURRENT_USER` or `HKCU` - `HKEY_USERS` or `HKU` - `HKEY_CLASSES_ROOT` or `HKCR` - `HKEY_CURRENT_CONFIG` or `HKCC` - `HKEY_PERFORMANCE_DATA` or `HKPD` - `HKEY_DYN_DATA` or `HKDD` ## Value types Each value also has an associated type, for example: - `REG_NONE` - `REG_BINARY` - `REG_DWORD` / `REG_DWORD_LITTLE_ENDIAN` / `REG_DWORD_BIG_ENDIAN` - 32-bit number - `REG_QWORD` / `REG_QWORD_LITTLE_ENDIAN` - 64-bit number - `REG_SZ` - String value, terminated with a null byte - `REG_EXPAND_SZ` - String value which contains unexpanded environment variables, i.e. `%APPDATA%` - `REG_MULTI_SZ` - An array of strings. Each string is separated by a null byte, with a final trailing null byte. i.e. `line1\0line2\0\line3\0\0` # Examples All of these examples assume you are in a Meterpreter session. To see the latest help information run `help reg`: ```msf meterpreter > help reg Usage: reg [command] [options] Interact with the target machine's registry. ``` ## Common mistakes ### Escaping keys Registry keys must be escaped correctly. Window's registry keys are escaped with backslashes. In msfconsole backslashes and spaces have a special meaning - which means you will need to escape these characters for your key to work as expected. ```msf # Valid: Using single quotes around the registry key meterpreter > reg enumkey -k 'HKCU\Keyboard Layout' # Valid: Escaping the backslash and spaces within the registry key meterpreter > reg enumkey -k HKCU\\Keyboard\ Layout # Invalid examples: The user has not escaped backslashes or spaces correctly: meterpreter > reg enumkey -k HKLM\SAM meterpreter > reg enumkey -k HKCU\\Keyboard Layout ``` ### 32/64 bit differences The result of your registry queries can be impacted if you are interacting with a x86 or x64 Windows session. You can see the type of session you currently have open with the `sessions` command: ```msf msf6 exploit(windows/smb/psexec) > sessions Active sessions =============== Id Name Type Information Connection -- ---- ---- ----------- ---------- 1 meterpreter x86/windows NT AUTHORITY\SYSTEM @ DESKTOP-N3MAG5R 192.168.123.1:4444 -> 192.168.123.141:58209 (192.168.123.141) 2 meterpreter x64/windows NT AUTHORITY\SYSTEM @ DESKTOP-N3MAG5R 192.168.123.1:4433 -> 192.168.123.141:58263 (192.168.123.141) ``` For example - when interacting with a x86 session there are 12 keys listed: ```msf # x86 Session meterpreter > reg enumkey -k 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows' Enumerating: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Keys (12): # ... omitted for clarity ... ``` Versus a x64 session which shows 23 keys: ```msf # x64 Session meterpreter > reg enumkey -k 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows' Enumerating: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Keys (23): # ... omitted for clarity ... ``` If this is problematic either [[upgrade your session to Meterpreter|./Metasploit-Guide-Upgrading-Shells-to-Meterpreter.md]], or specify the `-w` flag which will impact the result of queries: ```msf meterpreter > reg enumkey -k 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows' -w 32 Enumerating: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Keys (12): # ... omitted for clarity ... ``` ```msf meterpreter > reg enumkey -k 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows' -w 64 Enumerating: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Keys (23): # ... omitted for clarity ... ``` ## Enumerate registry keys Enumerate a root key: ```msf meterpreter > reg enumkey -k HKLM Enumerating: HKLM Keys (6): BCD00000000 HARDWARE SAM SECURITY SOFTWARE SYSTEM ``` Enumerate a subkey: ```msf meterpreter > reg enumkey -k 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run' Enumerating: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Values (2): SecurityHealth VMware User Process ``` ## Query values Display the registry value and type information: ```msf meterpreter > reg queryval -k 'HKLM\Software\Microsoft\Windows NT\CurrentVersion' -v ProductName Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion Name: ProductName Type: REG_SZ Data: Windows 10 Enterprise ``` Values that are of type `REG_SZ_EXPAND` such as ` %SystemRoot%\system32\drivers\GM.DLS` will not automatically be expanded: ```msf meterpreter > reg queryval -k 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectMusic' -v 'GMFilePath' Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectMusic Name: GMFilePath Type: REG_EXPAND_SZ Data: C:\Windows\system32\drivers\GM.DLS ``` Values that are of type `REG_MULTI_SZ` will be separated by `\0`: ```msf meterpreter > reg queryval -k 'HKLM\Software\example' -v 'example multi value with spaces' Key: HKLM\Software\example Name: example multi value with spaces Type: REG_MULTI_SZ Data: line1\0line2\0line3 ``` ### Creating a key ```msf meterpreter > reg createkey -k 'HKLM\software\example' Successfully created key: HKLM\software\example ``` ### Setting a value Setting a `REG_DWORD` - use a decimal value: ```msf meterpreter > reg setval -k 'HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\system' -v LocalAccountTokenFilterPolicy -t REG_DWORD -d 1 Successfully set LocalAccountTokenFilterPolicy of REG_DWORD. ``` Setting a `REG_QWORD` - use a decimal value: ```msf meterpreter > reg setval -k 'HKLM\Software\example' -t REG_DWORD -v qword_example -d 12345678 Successfully set example multi value with spaces of REG_MULTI_SZ. ``` Setting `REG_MULTI_SZ` - i.e. an array of strings: ```msf meterpreter > reg setval -k 'HKLM\Software\example' -t REG_MULTI_SZ -v 'example multi value with spaces' -d 'line1\0line2\0line3' Successfully set example multi value with spaces of REG_MULTI_SZ. ``` Setting `REG_BINARY` - use lowercase hexadecimal input without the preceding `0x`: ```msf meterpreter > reg setval -k 'HKLM\Software\example' -t REG_BINARY -v binary_example -d deadbeef Successfully set binary_example of REG_BINARY. ``` ### Deleting a key ```msf meterpreter > reg deletekey -k 'HKLM\software\example' Successfully deleted key: HKLM\software\example ``` ### Deleting a value ```msf meterpreter > reg deleteval -k 'HKLM\software\example' -v 'example multi value with spaces' Successfully deleted example multi value with spaces. ```