Class: Rex::Registry::Hive

Inherits:
Object
  • Object
show all
Defined in:
lib/rex/registry/hive.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(hivepath) ⇒ Hive

Returns a new instance of Hive.



11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
 
# File 'lib/rex/registry/hive.rb', line 11

def initialize(hivepath)

	hive_blob = open(hivepath, "rb") { |io| io.read }

	@hive_regf = RegfBlock.new(hive_blob)
	return nil if !@hive_regf.root_key_offset

	@root_key = NodeKey.new(hive_blob, 0x1000 + @hive_regf.root_key_offset)
	return nil if !@root_key.lf_record

	keys = []
	root_key.lf_record.children.each do |key|
		keys << key.name
	end

	if keys.include? "LastKnownGoodRecovery"
		@hive_name = "SYSTEM"
	elsif keys.include? "Microsoft"
		@hive_name = "SOFTWARE"
	elsif keys.include? "Environment"
		@hive_name = "NTUSER.DAT"
	elsif keys.include? "SAM"
		@hive_name = "SAM"
	elsif keys.include? "Policy"
		@hive_name = "SECURITY"
	else
		@hive_name = "UNKNOWN"
	end

end

Instance Attribute Details

#hive_name ⇒ Object

Returns the value of attribute hive_name.



9
10
11
 
# File 'lib/rex/registry/hive.rb', line 9

def hive_name
  @hive_name
end

#hive_regf ⇒ Object

Returns the value of attribute hive_regf.



9
10
11
 
# File 'lib/rex/registry/hive.rb', line 9

def hive_regf
  @hive_regf
end

#root_key ⇒ Object

Returns the value of attribute root_key.



9
10
11
 
# File 'lib/rex/registry/hive.rb', line 9

def root_key
  @root_key
end

Instance Method Details

#relative_query(path) ⇒ Object 



42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
 
# File 'lib/rex/registry/hive.rb', line 42

def relative_query(path)

if path == "" || path == "\\"
	return @root_key
end

current_child = nil
paths = path.split("\\")

return if !@root_key.lf_record

@root_key.lf_record.children.each do |child|
	next if child.name.downcase != paths[1].downcase

	current_child = child

	if paths.length == 2
		current_child.full_path = path
		return current_child
	end

	2.upto(paths.length) do |i|

		if i == paths.length
			current_child.full_path = path
			return current_child
		else
			if current_child.lf_record && current_child.lf_record.children
				current_child.lf_record.children.each do |c|
					next if c.name.downcase != paths[i].downcase

					current_child = c

					break
				end
			end
		end
	end
end

return if !current_child

current_child.full_path = path
return current_child
end

#value_query(path) ⇒ Object 



88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
 
# File 'lib/rex/registry/hive.rb', line 88

def value_query(path)
		if path == "" || path == "\\"
		return nil
	end

	paths = path.split("\\")

	return if !@root_key.lf_record

	@root_key.lf_record.children.each do |root_child|
		next if root_child.name.downcase != paths[1].downcase

		current_child = root_child

		if paths.length == 2
			return nil
		end

		2.upto(paths.length - 1) do |i|
			next if !current_child.lf_record

			current_child.lf_record.children.each do |c|
				next if c.name != paths[i]
				current_child = c

				break
			end
		end

		if !current_child.value_list || current_child.value_list.values.length == 0
			return nil
		end

		current_child.value_list.values.each do |value|
			next if value.name.downcase != paths[paths.length - 1].downcase

			value.full_path = path
			return value
		end
	end
end