Skip to content

Instantly share code, notes, and snippets.

@TechByTom
Forked from Graph-X/ironregistry.py
Created October 1, 2019 00:28
Show Gist options
  • Save TechByTom/c0683340860c017422d779001255a481 to your computer and use it in GitHub Desktop.
Save TechByTom/c0683340860c017422d779001255a481 to your computer and use it in GitHub Desktop.
PoC for hiding things in the registry. My testing hasn't returned any errors when viewing in regedit
from Microsoft.Win32 import Registry
from time import sleep
rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest")
rkey.SetValue(u'\x00 Im mr meeseeks',u'\x00look at me!')
rkey.Close()
rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest")
values = rkey.GetValueNames()
print("We have {0} values.".format(str(len(values))))
print("The value names returned are: {0}.".format(values[0]))
value = rkey.GetValue(u'\x00 this is a test')
rkey.Close()
print(value)
sleep(10)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment