-
-
Save TechByTom/c0683340860c017422d779001255a481 to your computer and use it in GitHub Desktop.
PoC for hiding things in the registry. My testing hasn't returned any errors when viewing in regedit
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
from Microsoft.Win32 import Registry | |
from time import sleep | |
rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest") | |
rkey.SetValue(u'\x00 Im mr meeseeks',u'\x00look at me!') | |
rkey.Close() | |
rkey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\aatest") | |
values = rkey.GetValueNames() | |
print("We have {0} values.".format(str(len(values)))) | |
print("The value names returned are: {0}.".format(values[0])) | |
value = rkey.GetValue(u'\x00 this is a test') | |
rkey.Close() | |
print(value) | |
sleep(10) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment