Graph-X
Graph-X
/ ironregistry.py
Last active
October 1, 2019 16:46
PoC for hiding things in the registry. My testing hasn't returned any errors when viewing in regedit
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| from Microsoft.Win32 import Registry | |
| from time import sleep | |
| rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest") | |
| rkey.SetValue(u'\x00 this is a test',u'\x00look at me!') | |
| rkey.Close() | |
| rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest") | |
| values = rkey.GetValueNames() | |
| print("We have {0} values.".format(str(len(values)))) | |
| print("The value names returned are: {0}.".format(values[0])) | |
| value = rkey.GetValue(u'\x00 this is a test') |
OlderNewer