Adding bperry's various and sundry regex fixes

[Closes #109]

Squashed commit of the following:

commit 692568d02fbfd547ef2d05ad9887427fc53f8abb
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Mon Jan 16 12:34:35 2012 -0600

    small get_everything fix

commit 5b29a310601b6658ffb74a4922b52bc5b3f864fb
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Mon Jan 16 12:31:31 2012 -0600

    regex fixes

commit a565ade7f4fe42fb5d070d04ac1ba4e65c98d8b8
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Sun Jan 15 16:39:29 2012 -0600

    registry.rb in lib/rex

commit 3609313ea357884480750948a9b0cc6514dcfcc2
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Sun Jan 15 16:32:06 2012 -0600

    boot key fixed

commit e591ed1815b01b3e535b517c73470ad9984fe8c7
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Sun Jan 15 15:53:21 2012 -0600

    fixes

commit 3598f3482eea2845baead71310d6192e105b6074
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Sat Jan 14 13:47:29 2012 -0600

    stuff

commit 8a8d0dfda603d3697b54bd852f131795259f9c28
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Fri Jan 13 22:57:30 2012 -0600

    reg fixes

commit fcfb51bb64b2d8ee6a28722bbf1998be47145b90
Merge: 2c7cfde 24aaf85
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Fri Jan 13 21:54:45 2012 -0600

    Merge remote-tracking branch 'upstream/master'

commit 2c7cfdef41d9cdcce563c4d623c1c3585170d1fe
Author: Brandon Perry <bperry.volatile@gmail.com>
Date:   Tue Jan 10 19:16:37 2012 -0600

    typo

lib/rex/registry.rb

@@ -0,0 +1,13 @@
+require 'rex/registry/hive'
+require 'rex/registry/regf'
+require 'rex/registry/nodekey'
+require 'rex/registry/lfkey'
+require 'rex/registry/valuekey'
+require 'rex/registry/valuelist'
+
+module Rex
+module Registry
+
+	attr_accessor :alias
+end
+end

lib/rex/registry/hive.rb

@@ -24,6 +24,8 @@ class Hive
 		current_child = nil
 		paths = path.split("\\")
 
+		return if !@root_key.lf_record
+		
 		@root_key.lf_record.children.each do |child|			
 			next if child.name.downcase != paths[1].downcase
 
@@ -40,7 +42,7 @@ class Hive
 					current_child.full_path = path
 					return current_child
 				else
-					if current_child.lf_record
+					if current_child.lf_record && current_child.lf_record.children
 						current_child.lf_record.children.each do |c|
 							next if c.name.downcase != paths[i].downcase
 							
@@ -54,6 +56,8 @@ class Hive
 			end
 		end
 
+		return if !current_child
+
 		current_child.full_path = path
 		return current_child
 	end
@@ -65,6 +69,8 @@ class Hive
 	
 		paths = path.split("\\")
 		
+		return if !@root_key.lf_record
+		
 		@root_key.lf_record.children.each do |root_child|
 			next if root_child.name.downcase != paths[1].downcase
 
@@ -98,64 +104,6 @@ class Hive
 		end
 	end
 
-	def rip_boot_key
-	
-		return if @hive_regf.hive_name !~ /SYSTEM/
-	
-		scrambled_key = []
-		default_control_set = ""
-		
-		@root_key.lf_record.children.each do |node|
-			next if node.name != "Select"
-		
-			node.value_list.values.each do |value|
-				next if value.name != "Default"
-		
-				default_control_set = "ControlSet00" + value.value.data.unpack('c').first.to_s
-			end
-		end
-
-		puts "Default Control Set: " + default_control_set
-
-		@root_key.lf_record.children.each do |node|
-			next if node.name != default_control_set
-			
-			node.lf_record.children.each do |cchild|
-				next if cchild.name != "Control"
-				
-				puts "Found: " + cchild.name
-
-				cchild.lf_record.children.each do |lsachild|
-					next if lsachild.name != "Lsa"
-
-					puts "Found: " + lsachild.name
-
-					%w[JD Skew1 GBG Data].each do |key|
-						lsachild.lf_record.children.each do |child|
-							next if child.name != key
-	
-							puts "Found: " + child.name
-		
-							child.class_name_data.each_byte do |byte|
-								scrambled_key << byte if byte != 0x00 
-							end
-						end
-					end
-				end
-
-			end
-		end
-
-		scrambler = [ 0x8, 0x5, 0x4, 0x2, 0xb, 0x9, 0xd, 0x3, 0x0, 0x6, 0x1, 0xc, 0xe, 0xa, 0xf, 0x7 ]
-		bootkey = scrambled_key	
-
-		0.upto(0x10-1) do |i|
-			#p scrambler[i]
-			bootkey[i] = scrambled_key[scrambler[i]]
-		end
-		
-		puts "Bootkey: " + bootkey.to_s
-	end
 end
 
 end

lib/rex/registry/nodekey.rb

@@ -19,7 +19,6 @@ class NodeKey
 		nk_type = hive[offset+0x02, 2]
 
 		if nk_header !~ /nk/ 
-			puts "nodekey broken"
 			return
 		end
 	
@@ -43,7 +42,9 @@ class NodeKey
 
 		@lf_record = LFBlock.new(hive, @lf_record_offset + 0x1000) if @lf_record_offset != -1	
 		@value_list = ValueList.new(hive, @value_list_offset + 0x1000, @value_count) if @value_list_offset != -1
-		@class_name_data = hive[@class_name_offset + 0x1000, @class_name_length]
+		
+		@class_name_data = hive[@class_name_offset + 0x04 + 0x1000, @class_name_length]
+
 	end
 
 end

lib/rex/registry/valuelist.rb

@@ -14,7 +14,10 @@ class ValueList
 		@values = []
 
 		1.upto(number_of_values) do |v|
-			valuekey_offset = hive[offset + inner_offset, 4].unpack('l').first
+			valuekey_offset = hive[offset + inner_offset, 4]
+			next if !valuekey_offset
+
+			valuekey_offset = valuekey_offset.unpack('l').first
 			@values << ValueKey.new(hive, valuekey_offset + 0x1000)
 			inner_offset = inner_offset + 4
 		end

tools/reg.rb

@@ -20,13 +20,19 @@ def print_all(nodekey)
 end
 
 def print_all_keys(nodekey)
+
+	return if !nodekey
+	return if !nodekey.lf_record
+	return if !nodekey.lf_record.children
+	return if nodekey.lf_record.children.length == 0
+	
 	table = Rex::Ui::Text::Table.new(
         	'Header'  => "Child Keys for #{nodekey.full_path}",
         	'Indent'  => '    '.length,
         	'Columns' => [ 'Name', 'Last Edited', 'Subkey Count', 'Value Count' ]
 	)
 
-        if nodekey.lf_record && nodekey.lf_record.children.length > 0
+        if nodekey.lf_record && nodekey.lf_record.children && nodekey.lf_record.children.length > 0
                 nodekey.lf_record.children.each do |key|
                         table << [key.name, key.readable_timestamp, key.subkeys_count, key.value_count]
                 end
@@ -37,6 +43,11 @@ end
 
 def print_all_values(nodekey)
 
+	return if !nodekey 
+	return if !nodekey.lf_record 
+	return if !nodekey.lf_record.children
+	return if nodekey.lf_record.children.length == 0
+
 	table = Rex::Ui::Text::Table.new(
 		'Header' => "Values in key #{nodekey.full_path}",
 		'Indent' => '    '.length,
@@ -56,48 +67,90 @@ def get_system_information
 		mounted_devices_info_key = @hive.relative_query("\\MountedDevices")
 
 		current_control_set_key = @hive.value_query('\Select\Default')
-		current_control_set = "ControlSet00" + current_control_set_key.value.data.unpack('c').first.to_s
+		current_control_set = "ControlSet00" + current_control_set_key.value.data.unpack('c').first.to_s if current_control_set_key
 	
-		computer_name_key = @hive.value_query("\\" + current_control_set + "\\Control\\ComputerName\\ComputerName")
+		computer_name_key = @hive.value_query("\\" + current_control_set + "\\Control\\ComputerName\\ComputerName") if current_control_set
-		computer_name = computer_name_key.value.data.to_s
+		computer_name = computer_name_key.value.data.to_s if computer_name_key
 		
-		event_log_info_key = @hive.relative_query("\\" + current_control_set + "\\Services\\EventLog")
+		event_log_info_key = @hive.relative_query("\\" + current_control_set + "\\Services\\EventLog") if current_control_set
 	
-		puts "Computer Name: " + computer_name
+		puts "Computer Name: " + computer_name if computer_name
 	
-		print_all_values(event_log_info_key)
+		print_all_values(event_log_info_key) if event_log_info_key
-		puts "-----------------------------------------"
+		puts "-----------------------------------------" if event_log_info_key
 
-		print_all_values(mounted_devices_info_key)
+		print_all_values(mounted_devices_info_key) if mounted_devices_info_key
-		puts "-----------------------------------------"
+		puts "-----------------------------------------" if mounted_devices_info_key
 
 	elsif @hive.hive_regf.hive_name =~ /SOFTWARE/
 		current_version_info_key = @hive.relative_query("\\Microsoft\\Windows NT\\CurrentVersion")
 		login_info_key = @hive.relative_query("\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon")
 
 		print_all_values(current_version_info_key)
-		puts "-----------------------------------------"
+		puts "-----------------------------------------" if current_version_info_key
 
 		print_all_values(login_info_key)
-		puts "-----------------------------------------"
+		puts "-----------------------------------------" if login_info_key
 	end
 end
 
 def get_user_information
+
+		
 	local_groups_info_key = @hive.relative_query("\\SAM\\Domains\\Builtin\\Aliases\\Names")
 	local_users_info_key = @hive.relative_query("\\SAM\\Domains\\Account\\Users\\Names")	
 
-	print_all_keys(local_groups_info_key)
+	print_all(local_groups_info_key)
-	puts "------------------------------------------------"
+	puts "------------------------------------------------" if local_groups_info_key && local_groups_info_key.lf_record.children
 
-	print_all_keys(local_users_info_key)
+	print_all(local_users_info_key)
-	puts "------------------------------------------------"
+	puts "------------------------------------------------" if local_users_info_key && local_groups_info_key.lf_record.children
 end
 
 def dump_creds
 end
 
 def get_boot_key
+
+		return if !@hive.root_key
+		return if !@hive.root_key.name
+
+		puts "Getting boot key"
+		puts "Root key: " + @hive.root_key.name
+		
+		default_control_set = @hive.value_query('\Select\Default').value.data.unpack("c").first
+			
+		puts "Default ControlSet: ControlSet00#{default_control_set}"
+
+		bootkey = ""
+		basekey = "\\ControlSet00#{default_control_set}\\Control\\Lsa"
+
+		%W{JD Skew1 GBG Data}.each do |k|
+			ok = @hive.relative_query(basekey + "\\" + k)
+			return nil if not ok
+			
+			tmp = ""
+			0.upto(ok.class_name_length - 1) do |i|
+				next if i%2 == 1
+	
+				tmp << ok.class_name_data[i,1]
+			end			
+
+			bootkey << [tmp.to_i(16)].pack('V')
+		end
+		
+		
+		keybytes    = bootkey.unpack("C*")
+
+		descrambled = ""
+	#	descrambler = [ 0x08, 0x05, 0x04, 0x02, 0x0b, 0x09, 0x0d, 0x03, 0x00, 0x06, 0x01, 0x0c, 0x0e, 0x0a, 0x0f, 0x07 ]
+		descrambler = [ 0x0b, 0x06, 0x07, 0x01, 0x08, 0x0a, 0x0e, 0x00, 0x03, 0x05, 0x02, 0x0f, 0x0d, 0x09, 0x0c, 0x04 ]
+
+		0.upto(keybytes.length-1) do |x|
+			descrambled << [ keybytes[ descrambler[x] ] ].pack("C")
+		end
+
+		puts descrambled.unpack("H*")
 end
 
 def list_applications
@@ -108,7 +161,7 @@ end
 
 def get_aol_instant_messenger_information
 	
-	if @hive.hive_regf.hive_name != /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name != /NTUSER\.dat/i
 		users_list_key = @hive.relative_query('\Software\America Online\AOL Instant Messenger(TM)\CurrentVersion\Users')
                 last_logged_in_user_key = @hive.relative_query("\\Software\\America Online\\AOL Instant Messenger(TM)\\CurrentVersion\\Login - Screen Name")
 
@@ -131,7 +184,7 @@ end
 
 def get_msn_messenger_information
 
-	if @hive.hive_regf.hive_name =~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name =~ /NTUSER\.dat/i
 		general_information_key = @hive.relative_query("\\Software\\Microsoft\\MessengerService\\ListCache\\.NETMessengerService\\")
 		file_sharing_information_key = @hive.relative_query("\\Software\\Microsoft\\MSNMessenger\\FileSharing - Autoshare")
 		file_transfers_information_key = @hive.relative_query("\\Software\\Microsoft\\MSNMessenger\\ - FTReceiveFolder")
@@ -143,9 +196,9 @@ def get_msn_messenger_information
 end
 
 def get_windows_messenger_information
-	if @hive.hive_regf.hive_name =~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name =~ /NTUSER\.dat/i
 		contact_list_information_key = @hive.relative_query("\\Software\\Microsoft\\MessengerService\\ListCache\\.NET Messenger Service")
-		file_transfers_information_key = @hive.realtive_query("\\Software\\Microsoft\\Messenger Service - FtReceiveFolder")
+		file_transfers_information_key = @hive.relative_query("\\Software\\Microsoft\\Messenger Service - FtReceiveFolder")
 		last_user_information_key = @hive.relative_query("\\Software\\Microsoft\\MessengerService\\ListCache\\.NET Messenger Service - IdentityName")
 
 		print_all(contact_list_information_key)
@@ -155,19 +208,19 @@ def get_windows_messenger_information
 end
 
 def get_icq_information
-	if @hive.hive_regf.hive_name != /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name =~ /NTUSER\.dat/i
 		general_information_key = @hive.relative_query("\\Software\\Mirabalis\\ICQ")
 		
 		print_all(general_information_key)
-	elsif @hive.hive_regf.hive_name != /SOFTWARE/
+	elsif @hive.hive_regf.hive_name =~ /SOFTWARE/
-		owner_number_key = @hive.value_query("\\Software\\Mirabalis\\ICQ\\Owner")
+		owner_number_key = @hive.relative_query("\\Software\\Mirabalis\\ICQ\\Owner")
 	
-		puts "Owner UIN: #{owner_number_key.value.data.to_s}"
+		print_all(owner_number_key)
 	end
 end
 
 def get_ie_information
-	if @hive.hive_regf.hive_name =~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name =~ /NTUSER\.dat/i
 		stored_logon_information_key = @hive.relative_query("\\Software\\Microsoft\\Protected Storage System Provider\\SID\\Internet Explorer\\Internet Explorer - URL:StringData")
 		stored_search_terms_information_key = @hive.relative_quety("\\Software\\Microsoft\\Protected Storage SystemProvider\\SID\\Internet Explorer\\Internet Explorer - q:SearchIndex")
 		ie_setting_information_key = @hive.relative_query("\\Software\\Microsoft\\Internet Explorer\\Main")
@@ -190,7 +243,7 @@ def get_ie_information
 end
 
 def get_outlook_information
-	if @hive.hive_regf.hive_name =~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name =~ /NTUSER\.dat/i
 		account_information_key = @hive.relative_query("\\Software\\Microsoft\\Protected Storage System Provider\\SID\\Identification\\INETCOMM Server Passwords")
 		
 		print_all(account_information_key)
@@ -198,7 +251,7 @@ def get_outlook_information
 end
 
 def get_yahoo_messenger_information
-	if @hive.hive_regf.hive_name =~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name =~ /NTUSER\.dat/i
 		profiles_key = @hive.relative_query("\\Software\\Yahoo\\Pager\\profiles")
 
 		print_all(profiles_key)
@@ -217,9 +270,6 @@ def get_networking_information
 	
 end
 
-def get_user_information
-end
-
 def get_user_application_information
 end
 
@@ -311,11 +361,16 @@ elsif ARGV[0] == "list_drivers"
 
 elsif ARGV[0] == "get_everything"
 	Dir.foreach(ARGV[1]) do |file|
-		next if file =~ /^[.]/
+		next if file =~ /^\./
 
 		@hive = Rex::Registry::Hive.new(ARGV[1] + "/" + file)
 
-		if @hive.hive_regf.hive_name =~ /SYSTEM$/
+		next if !@hive.hive_regf
+		next if !@hive.hive_regf.hive_name
+			
+		if @hive.hive_regf.hive_name =~ /SYSTEM/
+
+			puts "Found a SYSTEM hive..."			
 
 			list_drivers
 			get_boot_key
@@ -323,7 +378,9 @@ elsif ARGV[0] == "get_everything"
 			get_networking_information
 			get_user_information
 
-		elsif @hive.hive_regf.hive_name =~ /SOFTWARE$/
+		elsif @hive.hive_regf.hive_name =~ /SOFTWARE/
+
+			puts "Found a SOFTWARE hive..."			
 
 			list_applications
 			get_icq_information
@@ -332,16 +389,22 @@ elsif ARGV[0] == "get_everything"
 			get_user_information
 			get_user_application_information
 			
-		elsif @hive.hive_regf.hive_name =~ /SAM$/
+		elsif @hive.hive_regf.hive_name =~ /SAM/
+
+			puts "Found a SAM hive..."
 
 			get_networking_information
 			get_user_information
 
-		elsif @hive.hive_regf.hive_name =~ /SECURITY$/
+		elsif @hive.hive_regf.hive_name =~ /SECURITY/
+
+			puts "Found a SECURITY hive..."
 
 			get_user_information
 
-		elsif @hive.hive_regf_hive_name =~ /NTUSER[.]dat$/i
+		elsif @hive.hive_regf.hive_name =~ /NTUSER\.dat/i
+
+			puts "Found a NTUSER.dat hive..."
 
 			get_aol_instant_messenger_information
 			get_icq_information
@@ -360,7 +423,7 @@ elsif ARGV[0] == "get_everything"
 elsif ARGV[0] == "get_aol_instant_messenger_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 
-	if @hive.hive_regf.hive_name !~ /NTUSER[.]DAT/i
+	if @hive.hive_regf.hive_name !~ /NTUSER\.DAT/i
 		puts "I need the NTUSER.dat hive, not #{@hive.hive_regf.hive_name}."
 	else
 		get_aol_instant_messenger_information
@@ -369,7 +432,7 @@ elsif ARGV[0] == "get_aol_instant_messenger_information"
 elsif ARGV[0] == "get_icq_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 
-	if @hive.hive_regf.hive_name !~ /NTUSER[.]dat/i && @hive.hive_regf.hive_name !~ /SOFTWARE/
+	if @hive.hive_regf.hive_name !~ /NTUSER\.dat/i && @hive.hive_regf.hive_name !~ /SOFTWARE/
 		puts "I need either a SOFTWARE or NTUSER.dat hive, not #{@hive.hive_regf.hive_name}."
 	else
 		get_icq_information
@@ -377,7 +440,7 @@ elsif ARGV[0] == "get_icq_information"
 elsif ARGV[0] == "get_ie_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 	
-	if @hive.hive_regf.hive_name !~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name !~ /NTUSER\.dat/i
 		puts "I need an NTUSER.dat hive, not #{@hive.hive_regf.hive_name}."
 	else
 		get_ie_information
@@ -386,7 +449,7 @@ elsif ARGV[0] == "get_ie_information"
 elsif ARGV[0] == "get_msn_messenger_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 	
-	if @hive.hive_regf.hive_name !~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name !~ /NTUSER\.dat/i
 		puts "I need an NTUSER.dat hive, not #{@hive.hive_regf.hive_name}."
 	else
 		get_msn_messenger_information
@@ -395,7 +458,7 @@ elsif ARGV[0] == "get_msn_messenger_information"
 elsif ARGV[0] == "get_outlook_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 
-	if @hive.hive_regf.hive_name !~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name !~ /NTUSER\.dat/i
 		puts "I need an NTUSER.dat hive, not #{@hive.hive_regf.hive_name}."
 	else
 		get_outlook_information
@@ -404,7 +467,7 @@ elsif ARGV[0] == "get_outlook_information"
 elsif ARGV[0] == "get_windows_messenger_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 
-	if @hive.hive_regf.hive_name !~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name !~ /NTUSER\.dat/i
 		puts "I need an NTUSER.dat hive, not a #{@hive.hive_regf.hive_name}."
 	else
 		get_windows_messenger_information
@@ -413,7 +476,7 @@ elsif ARGV[0] == "get_windows_messenger_information"
 elsif ARGV[0] == "get_yahoo_messenger_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 	
-	if @hive.hive_regf.hive_name !~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name !~ /NTUSER\.dat/i
 		puts "I need an NTUSER.dat hive, not a #{@hive.hive_regf.hive_name}."
 	else
 		get_yahoo_messenger_information
@@ -430,7 +493,7 @@ elsif ARGV[0] == "get_system_information"
 elsif ARGV[0] == "get_networking_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 
-	if @hive.hive_regf.hive_name !~ /SAM/ && @hive.hive_regf.hive_name !~ /SYSTEM/ && @hive.hive_regf.hive_name !~ /NTUSER[.]dat/i
+	if @hive.hive_regf.hive_name !~ /SAM/ && @hive.hive_regf.hive_name !~ /SYSTEM/ && @hive.hive_regf.hive_name !~ /NTUSER\.dat/i
 		puts "I need either a SAM, SYSTEM, or NTUSER.dat hive, not a #{@hive.hive_regf.hive_name}."
 	else
 		get_networking_information
@@ -443,11 +506,12 @@ elsif ARGV[0] == "get_user_information"
 		puts "I need a SAM hive. Not a #{@hive.hive_regf.hive_name}."
 	else
 		get_user_information
+	
 	end
 elsif ARGV[0] == "get_user_application_information"
 	@hive = Rex::Registry::Hive.new(ARGV[ARGV.length - 1])
 	
-	if @hive.hive_regf.hive_name !~ /NTUSER[.]dat/i && @hive.hive_regf.hive_name !~ /SOFTWARE/
+	if @hive.hive_regf.hive_name !~ /NTUSER\.dat/i && @hive.hive_regf.hive_name !~ /SOFTWARE/
 		puts "I need either an NTUSER.dat or SOFTWARE hive, not a #{@hive.hive_regf.hive_name}."
 	else
 		get_user_application_information