WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-08-31 04:09:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

add user level hives for certificates

Browse Source
This commit is contained in:
superponible
2019-09-17 16:59:50 +01:00
committed by ikelos
parent 2053d957bc
commit 2e4a8c7247
1 changed files with 21 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/plugins/windows/registry/certificates.py
+21 -19
View File
@@ -39,26 +39,28 @@ class Certificates(interfaces.plugins.PluginInterface):
layer_name = self.config['primary'],
symbol_table = self.config['nt_symbols']):
try:
# Walk it
top_key = "Microsoft\\SystemCertificates"
node_path = hive.get_key(top_key, return_list = True)
for (depth, is_key, last_write_time, key_path, volatility, node) in printkey.PrintKey.key_iterator(
hive, node_path, recurse = True):
if not is_key and RegValueTypes.get(node.Type).name == "REG_BINARY":
name, certificate_data = self.parse_data(node.decode_data())
unique_key_offset = key_path.index(top_key) + len(top_key) + 1
reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)]
key_hash = key_path[key_path.rindex("\\") + 1:]
for top_key in ["Microsoft\\SystemCertificates",
"Software\\Microsoft\\SystemCertificates",
]:
try:
# Walk it
node_path = hive.get_key(top_key, return_list = True)
for (depth, is_key, last_write_time, key_path, volatility, node) in printkey.PrintKey.key_iterator(
hive, node_path, recurse = True):
if not is_key and RegValueTypes.get(node.Type).name == "REG_BINARY":
name, certificate_data = self.parse_data(node.decode_data())
unique_key_offset = key_path.index(top_key) + len(top_key) + 1
reg_section = key_path[unique_key_offset:key_path.index("\\", unique_key_offset)]
key_hash = key_path[key_path.rindex("\\") + 1:]
if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue):
filedata = interfaces.plugins.FileInterface("{} - {}.crt".format(reg_section, key_hash))
filedata.data.write(certificate_data)
self.produce_file(filedata)
yield (0, (top_key, reg_section, key_hash, name))
except KeyError:
# Key wasn't found in this hive, carry on
pass
if not isinstance(certificate_data, interfaces.renderers.BaseAbsentValue):
filedata = interfaces.plugins.FileInterface("{} - {}.crt".format(reg_section, key_hash))
filedata.data.write(certificate_data)
self.produce_file(filedata)
yield (0, (top_key, reg_section, key_hash, name))
except KeyError:
# Key wasn't found in this hive, carry on
pass
def run(self) -> renderers.TreeGrid:
return renderers.TreeGrid([("Certificate path", str), ("Certificate section", str), ("Certificate ID", str),