Skip to content

Instantly share code, notes, and snippets.

@aguytech

aguytech/hive-disable-security-center.reg

Last active June 14, 2022 10:07
Show Gist options
  • Save aguytech/2822c843d31fb989cfe236df3439de14 to your computer and use it in GitHub Desktop.
Save aguytech/2822c843d31fb989cfe236df3439de14 to your computer and use it in GitHub Desktop.
Download ZIP
[hive] Windows hive analysis #bash #disk #forensic #help #hive #tips #windows
Raw
hive-disable-security-center.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Start"=dword:00000004
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"ConsentPromptBehaviorAdmin"=dword:00000000
[HKLM\Software\Policies\Microsoft\Windows Defender\UX Configuration]
"Notification_Suppress"=dword:00000001
;[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System]
;"DisableTaskMgr"=dword:00000001
Raw
hive-enable-security-center.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService]
"Start"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Start"=dword:00000002
Raw
hive-os-version.md

regripper

regripper -p winver -r $path_hive/SOFTWARE

reglookup

reglookup -p Software/Microsoft $path_hive/SYSTEM  | column -t -s,
Raw
hive-reglookup-timeline.md

global timeline

pathhive=$device/Windows/System32/config
pathreport=/share/examen/disk
cd $path
reglookup-timeline SAM SECURITY SOFTWARE SYSTEM > $pathreport/reglookup-timeline
Raw
hive-user-passwrd.md

mimikatz

cd {$path_hive}
log c:\lsadump.log
lsadump::sam /system:SYSTEM /sam:SAM
exit

hash_suite

bad methods ?

path_hive=/vol6/Windows/System32/config
path2=/cases/examen/artefacts
# get user id
reglookup -p SAM/Domains/Account/Users ${path_hive}/SAM | grep -i angela # select 0x.....
# data
uid=000003E9
hivexget ${path_hive}/SAM "SAM\Domains\Account\Users\000003E9" V | hexdump -ve '8/1 "%02X"' > ${path2}/sam-user-v.hexdump
hivexget ${path_hive}/SAM "SAM\Domains\Account" F | hexdump -ve '8/1 "%02X"' > ${path2}/sam-f.hexdump
hivexget ${path_hive}/SYSTEM "ControlSet001\Control\Lsa\JD" lookup | hexdump -ve '8/1 "%02X"' > ${path2}/system-jd.hexdump
hivexget ${path_hive}/SYSTEM "ControlSet001\Control\Lsa\Skew1" SkewMatrix | hexdump -ve '8/1 "%02X"' > ${path2}/system-skew.hexdump
hivexget ${path_hive}/SYSTEM "ControlSet001\Control\Lsa\GBG" GrafBlumGroup | hexdump -ve '8/1 "%02X"' > ${path2}/system-gbg.hexdump
hivexget ${path_hive}/SYSTEM "ControlSet001\Control\Lsa\Data" Pattern | hexdump -ve '8/1 "%02X"' > ${path2}/system-data.hexdump

for file in $(ls ${path2}); do echo $file; cat $file; echo; done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment