Reg

Interacts with the registry

Synopsis

Reg <subcommand>

Subcommands

For help on a subcommand, use Reg <subcommand> -h

Reg dumplsasecrets

Dumps the LSA secrets of a remote system

Synopsis

Reg dumplsasecrets [options] <ServerName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Examples

Example 1 - Dump the LSA secrets using a backup operator

Reg dumplsasecrets -UserName marks@LUMON -Kdc 10.66.0.11 -Password She's@live!! LUMON-FS1 -BackupSemantics

Reg dumpsam

Dumps the SAM of a remote system

Synopsis

Reg dumpsam [options] <ServerName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Examples

Example 1 - Dump the SAM using a backup operator

Reg dumpsam -UserName marks@LUMON -Kdc LUMON-DC1 -Password She's@live!! LUMON-FS1 -BackupSemantics

Reg getdcomapp

Gets information about a DCOM application

Synopsis

Reg getdcomapp [options] -AppId <Guid[]> <ServerName> <AppId>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Reg getsd

Gets the security descriptor of a registry key

Synopsis

Reg getsd [options] <ServerName> <KeyPath>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Details

By default, this command requests the DACL, owner, and group. If any of the switches are specified, then only those components specified are included.

Examples

Example 1 - Request DACL, owner, and group of HKCU\Software

Reg getsd LUMON-FS1 HKCU\Software

Example 2 - Request DACL only

Reg getsd -IncludeDacl LUMON-FS1 HKCU\Software

Example 3 - Request DACL and ownner

Reg getsd -IncludeDacl -IncludeOwner LUMON-FS1 HKCU\Software

Reg keyinfo

Gets key info

Synopsis

Reg keyinfo [options] <ServerName> <KeyPath>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Reg list

Lists the contents of a key

Synopsis

Reg list [options] <ServerName> <KeyPath>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Examples

Example 1 - Lists loaded user hives backup operator

Reg list -UserName marks@LUMON -Kdc 10.66.0.11 -Password She'sAlive!! LUMON-FS1 -BackupSemantics HKU

Reg save

Saves a key to a file

Synopsis

Reg save [options] <ServerName> <KeyPath> <FileName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Reg set

Sets one or more values in a registry key

Synopsis

Reg set [options] <ServerName> [ <Items> ]

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Details

This command accepts one or more key/value specifications, allowing multiple keys to be created and multiple values to be set. When a key name is encountered, the key is created, and subsequent values are set in this key. Once the next key name is encountered, the previous key is closed, and the new one created. Specifying the same key name multiple times causes the key to be closed and reopened.

Keys are specified as:

<root>\<key>

or

<root>/<key>

The initial path separator following the root is interpreted as the path separator. When using the second syntax, all / in the path are interpreted as path separators and replaced with \ before sending to the remote server. If you intend to include a / in a key name, you must use the first syntax. To specify a root key itself, follow the root key name with a slash with no key name

Values are specified as:

<type>[;<encoding>]:[<value>]=<data>

The <type> may be specified either as a number (decimal or hex), or as one of the familiar REG_ values (with or without the REG_ prefix).

The value name is interpreted as a C-style string, interpreting character escapes. Since the = denotes the end of the value name and the beginning of <data>, you must escape = in the value name with a preceding backslash. To specify the default value in a key, omit <value> altogether. That is, to set the default value on a key to whatever:

sz:=whatever

The format of <data> depends on the encoding. The encoding may be specified after the value type. If no encoding is specified, the default encoding for the value type is assumed (table below).

The only difference between Utf16 and Utf16z is that Utf16z ensures the string ends with a null terminator. When file is used, the data is loaded from the file as-is, regardless of the value type. This means using file with SZ or MULTI_SZ will not convert an ASCII file to UTF-16, nor strip the byte order mark (if present), nor convert newlines to \0 separators; the file must be prepared and formatted properly before running this command.

Default encodings for value types:

Examples

Example 1 - Setting a few values

Reg set LUMON-FS1 HKCU/SOFTWARE/Experiment sz:=DefaultValueData dword:DwordValue=42 binary;sddl:ValueContainingPermissions=O:BAG:BAD:(A;;0x1F;;;AU)

Example 2 - Setting values in multiple keys

Reg set LUMON-FS1 HKCU/SOFTWARE/Experiment/Key1 sz:=This-is-in-key-1 HKCU/SOFTWARE/Experiment/Key2 sz:=DefaultValueData-Key2

Example 3 - Setting a value with a numeric-specified type

Reg set LUMON-FS1 HKCU/SOFTWARE/Experiment 2:ExpandStringWithNumericType=ABCD1234 2;utf16z:ExpandStringWithNumericTypeAsUtf16z=Set-as-a-normal-string

The type of the value is specified as a number. Even though it corresponds to REG_EXPAND_SZ, the default encoding is assumed to be hex. This can be overridden to specify it as a UTF-16 string or any other encoding

Example 4 - Setting a mismatched values

Reg set LUMON-FS1 HKCU/SOFTWARE/Experiment sz:=DefaultValueData dword:DwordValue=42 binary;dword:DwordAsBinary=42 dword;hex:BinaryAsDword=DF00529F dword;hex:IncompleteDword=2A none:NoneValueWithData=1234ABCD

This example demonstrates mixing different encodings with different value types. Some of them are logically invalid, but still permitting by the Registry API.

Example 5 - Setting DCOM properties

Reg set LUMON-FS1 HKLM/SOFTWARE/Classes/AppID/{00000000-1234-0000-0000-000000000000} sz:=MyDcomApp binary;sddl:LaunchPermissions=O:BAG:BAD:(A;;0x1F;;;AU) HKLM/SOFTWARE/Classes/CLSID/{00000000-1234-0000-0000-000000000000} sz:=ComponentClass sz:AppId={00000000-1234-0000-0000-000000000000}

Example 6 - Setting a value on a root key

Reg set LUMON-FS1 HKCU/ sz:SomeValue=data

Reg setsd

Sets the security descriptor of a registry key

Synopsis

Reg setsd [options] -SecurityDescriptor <SecurityDescriptor> <ServerName> <KeyPath> <SecurityDescriptor>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Examples

Example 1 - Set DACL

LUMON-FS1 -username marks@LUMON -password She's@live!!  -Kdc  lumon-dc1 -BackupSemantics HKCU\Software\Microsoft D:AI(A;CIID;0x20019;;;BU)(A;CIID;0xF003F;;;BA)(A;CIID;0xF003F;;;SY)(A;CIIOID;0xF003F;;;CO)

Reg syskey

Prints the system key of a remote system

Synopsis

Reg syskey [options] <ServerName>

Parameters

Options

Authentication

Authentication (Kerberos)

Authentication (NTLM)

Client Behavior

Connection

Output

Examples

Example 1 - Prints the syskey using a backup operator

Reg syskey -UserName marks@LUMON -Kdc 10.66.0.11 -Password She'sAlive!! LUMON-FS1 -BackupSemantics