REG
Authorized use only. Offensive reference for systems you own or are explicitly permitted to test. You are responsible for staying within the law.
Windows Registry Command-line Tool. Query, add, modify, and delete registry keys and values.
REGISTRY HIVES#
HKLM HKEY_LOCAL_MACHINE # System-wide settings HKCU HKEY_CURRENT_USER # Current user settings HKU HKEY_USERS # All user profiles HKCR HKEY_CLASSES_ROOT # File associations HKCC HKEY_CURRENT_CONFIG # Hardware config
VALUE TYPES#
REG_SZ # String REG_MULTI_SZ # Multiple strings REG_EXPAND_SZ # Expandable string (%PATH%) REG_DWORD # 32-bit number REG_QWORD # 64-bit number REG_BINARY # Binary data REG_NONE # No type
QUERY REGISTRY#
reg query HKLM\SOFTWARE # List subkeys reg query HKLM\SOFTWARE\Microsoft # Query specific key reg query HKLM\SOFTWARE\Microsoft /s # Recursive reg query HKLM\SOFTWARE /v ValueName # Specific value reg query HKLM\SOFTWARE /ve # Default value reg query HKLM\SOFTWARE /f "search" /s # Search string reg query HKLM\SOFTWARE /f "search" /s /d # Search in data reg query HKLM\SOFTWARE /f "search" /s /k # Search in keys # Query specific types reg query HKLM\SOFTWARE /t REG_SZ /s # Only strings reg query HKLM\SOFTWARE /t REG_DWORD /s # Only DWORDs # Query 32/64 bit views reg query HKLM\SOFTWARE /reg:32 # 32-bit registry reg query HKLM\SOFTWARE /reg:64 # 64-bit registry
ADD VALUES#
reg add HKLM\SOFTWARE\Test # Create key reg add HKLM\SOFTWARE\Test /v Name /t REG_SZ /d "value" reg add HKLM\SOFTWARE\Test /v Number /t REG_DWORD /d 1 reg add HKLM\SOFTWARE\Test /v Path /t REG_EXPAND_SZ /d "%SystemRoot%" reg add HKLM\SOFTWARE\Test /v Multi /t REG_MULTI_SZ /d "a\0b\0c" reg add HKLM\SOFTWARE\Test /v Binary /t REG_BINARY /d 0102030405 # Force overwrite without prompt reg add HKLM\SOFTWARE\Test /v Name /t REG_SZ /d "value" /f # Set default value reg add HKLM\SOFTWARE\Test /ve /t REG_SZ /d "default"
DELETE VALUES#
reg delete HKLM\SOFTWARE\Test /v ValueName # Delete value reg delete HKLM\SOFTWARE\Test /ve # Delete default reg delete HKLM\SOFTWARE\Test # Delete key reg delete HKLM\SOFTWARE\Test /va # Delete all values reg delete HKLM\SOFTWARE\Test /f # Force (no prompt)
EXPORT & IMPORT#
reg export HKLM\SOFTWARE\Test export.reg # Export to file reg export HKLM\SOFTWARE\Test export.reg /y # Overwrite reg import settings.reg # Import from file
COPY KEYS#
reg copy HKLM\SOFTWARE\Source HKLM\SOFTWARE\Dest # Copy key reg copy HKLM\SOFTWARE\Source HKLM\SOFTWARE\Dest /s # Copy subkeys reg copy HKLM\SOFTWARE\Source HKLM\SOFTWARE\Dest /f # Force
SAVE & RESTORE#
reg save HKLM\SYSTEM backup.hiv # Save hive reg restore HKLM\SOFTWARE backup.hiv # Restore hive reg load HKU\TempHive backup.hiv # Load hive reg unload HKU\TempHive # Unload hive
COMPARE KEYS#
reg compare HKLM\SOFTWARE\Key1 HKLM\SOFTWARE\Key2 reg compare HKLM\SOFTWARE\Key1 HKLM\SOFTWARE\Key2 /v ValueName reg compare HKLM\SOFTWARE\Key1 HKLM\SOFTWARE\Key2 /s # Recursive
REMOTE REGISTRY#
reg query \\COMPUTER\HKLM\SOFTWARE # Remote query reg add \\COMPUTER\HKLM\SOFTWARE\Test /v Name /t REG_SZ /d "value" reg delete \\COMPUTER\HKLM\SOFTWARE\Test /f
IMPORTANT REGISTRY LOCATIONS#
STARTUP (Run Keys)#
# System-wide HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx # Per-user HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce # 32-bit on 64-bit (WoW64) HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
SERVICES#
HKLM\SYSTEM\CurrentControlSet\Services
INSTALLED SOFTWARE#
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
USER PROFILES#
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
NETWORK#
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Parameters
SECURITY#
HKLM\SECURITY # Security database HKLM\SAM # SAM database HKLM\SYSTEM\CurrentControlSet\Control\Lsa # LSA settings
WINLOGON#
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
EXPLORER POLICIES#
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
SCHEDULED TASKS#
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
SHELL EXTENSIONS#
HKCR\*\shellex\ContextMenuHandlers HKCR\Directory\shellex\ContextMenuHandlers HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers
SECURITY ANALYSIS#
# Check Run keys for persistence reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" # Check RunOnce keys reg query HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce # Check services for suspicious entries reg query HKLM\SYSTEM\CurrentControlSet\Services /s /f "ImagePath" # Check Winlogon for shell replacements reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit # Check AppInit_DLLs reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs # Check Image File Execution Options (IFEO) reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" /s # Check scheduled tasks reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks" /s # Check COM hijacking reg query HKCU\Software\Classes\CLSID /s
USEFUL QUERIES#
# Windows version reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName # Computer name reg query "HKLM\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" /v ComputerName # Time zone reg query "HKLM\SYSTEM\CurrentControlSet\Control\TimeZoneInformation" /v TimeZoneKeyName # Network interfaces reg query "HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces" /s # Proxy settings reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v ProxyServer # Recent documents reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs" /s # USB history reg query "HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR" /s # User Assist (program execution history - encoded) reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /s
DISABLE FEATURES#
# Disable Windows Defender (requires admin) reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f # Disable UAC (requires reboot) reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f # Disable firewall reg add "HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f # Enable RDP reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f # Disable NLA for RDP reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f
QUICK REFERENCE#
reg query HKLM\path # Query key reg query HKLM\path /v value # Query value reg query HKLM\path /s # Recursive query reg query HKLM\path /f "text" /s # Search reg add HKLM\path # Create key reg add HKLM\path /v name /t REG_SZ /d "data" /f reg add HKLM\path /v num /t REG_DWORD /d 1 /f reg delete HKLM\path /f # Delete key reg delete HKLM\path /v value /f # Delete value reg export HKLM\path file.reg # Export reg import file.reg # Import reg copy HKLM\src HKLM\dst /s /f # Copy key reg save HKLM\path file.hiv # Save hive