Last active
October 1, 2019 16:46
-
-
Save Graph-X/19a79dd7129d005ce4d2e59240151e52 to your computer and use it in GitHub Desktop.
PoC for hiding things in the registry. My testing hasn't returned any errors when viewing in regedit
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from Microsoft.Win32 import Registry | |
from time import sleep | |
rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest") | |
rkey.SetValue(u'\x00 this is a test',u'\x00look at me!') | |
rkey.Close() | |
rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest") | |
values = rkey.GetValueNames() | |
print("We have {0} values.".format(str(len(values)))) | |
print("The value names returned are: {0}.".format(values[0])) | |
value = rkey.GetValue(u'\x00 this is a test') | |
rkey.Close() | |
print(value) | |
sleep(10) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment