|
|
1
|
import os
|
|
|
2
3
4
|
import logger
import tomb
|
|
|
5
|
import winver
|
|
|
6
|
from modules.module import Module
|
|
|
7
|
from mount import mount,umount
|
|
|
8
9
|
from runcmd import runProcess
|
|
|
10
11
12
13
14
15
16
17
18
|
def getInstance():
return RegistryModule()
class RegistryModule(Module):
def __init__(self):
self.name = "winreg"
self.description = "Extracts Windows Registry files"
|
|
|
19
|
self.requiredVars = ["winvol"]
|
|
|
20
21
22
23
|
self.vars = {}
def run(self):
path = tomb.getPath() + self.name + "/"
|
|
|
24
25
|
if(not os.path.exists(path)):
os.mkdir(path)
|
|
|
26
|
logger.msgLog("Extracting Windows registry from volumes: " + repr(self.vars['winvol'].value), "winreg", logger.TYPE_INFO)
|
|
|
27
28
|
for vol in self.vars['winvol'].value:
mntpoint = "/mnt/"
|
|
|
29
30
31
32
|
try:
mntid = mount("/dev/" + vol)
except:
raise
|
|
|
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
mntpoint += mntid
files = []
windir = winver.getWindowsDirectory(mntpoint)
if windir == None:
raise Exception("No Windows installation present")
version = winver.getWindowsVersion(mntpoint)
profiles = winver.getUserProfiles(mntpoint)
if version <= winver._WIN_ME:
#9x
files = [windir + "USER.DAT",windir + "SYSTEM.DAT"]
if(len(profiles) > 0):
for profile in profiles:
if(os.path.isfile(profile + "USER.DAT")):
files += [profile + "USER.DAT"]
if version == winver._WIN_ME:
#ME
files += [windir + "CLASSES.DAT"]
elif version > winver._WIN_ME:
#NT
files += [windir + "/System32/config/SAM" ]
files += [windir + "/System32/config/SECURITY"]
files += [windir + "/System32/config/SOFTWARE"]
files += [windir + "/System32/config/SYSTEM"]
files += [windir + "/System32/config/DEFAULT"]
for profile in profiles:
files += [profile + "/NTUSER.DAT"]
if version > winver._WIN_NT and version < winver._WIN_VISTA:
#2k XP 2k3
files += [profile + "/Local Settings/Application Data/Microsoft/Windows/UsrClass.dat"]
else:
#Vista+
files += [profile + "/AppData/Local/Microsoft/Windows/UsrClass.dat"]
|
|
|
66
|
|
|
|
67
|
runProcess(["tar","-czvf",path + "winreg_" + vol + ".tar.gz"] + files)
|
|
|
68
69
70
71
|
try:
umount(mntid)
except:
raise
|
