registry

The Mindset

The registry is a hierarchical database storing settings for the OS, applications, users, and hardware. For a pentester it's valuable for three reasons:

• Persistence — autostart keys (Run, RunOnce, services) that launch programs at boot or logon
• Stored credentials — autologon passwords, saved VNC/PuTTY/SNMP secrets, sometimes plaintext
• Configuration intel — installed software, security settings, what's enabled and what isn't

Structure — Hives, Keys, and Values

The registry is organized into hives (top-level roots), which contain keys (like folders), which contain values (the actual data).

The Five Root Hives

Value Types

Each value has a data type. The ones you'll encounter:

Querying the Registry

reg query — From CMD

# Read all values under a key
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

# Read a specific value
reg query "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections

# Search the entire registry for a string (e.g. "password")
reg query HKLM /f password /t REG_SZ /s
reg query HKCU /f password /t REG_SZ /s

From PowerShell

# Read a key's values
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run"

# Read one value
Get-ItemProperty -Path "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" -Name "OneDrive"

# List subkeys
Get-ChildItem -Path "HKLM:\Software"

Persistence Keys — Where Autostart Lives

These keys launch programs automatically. Attackers plant entries here for persistence; you check them to find both attacker footholds and escalation opportunities (a writable autostart entry that runs as admin).

The Run Keys

# Runs every time the user logs on
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"

# Runs ONCE at next logon, then deletes itself
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"

Other Autostart Locations Worth Checking

# Winlogon — userinit and shell hooks (classic persistence)
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"

# Services set to auto-start (cross-reference with service misconfigs)
reg query "HKLM\System\CurrentControlSet\Services" /s

Stored Credentials in the Registry

The registry sometimes holds credentials in cleartext or weakly protected — a direct pillaging win.

# Autologon credentials — sometimes plaintext password in DefaultPassword
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName

# VNC stored passwords (various products)
reg query "HKCU\Software\ORL\WinVNC3\Password"
reg query "HKLM\Software\TightVNC\Server" /v Password

# PuTTY saved sessions (may contain proxy credentials)
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s

# SNMP community strings
reg query "HKLM\System\CurrentControlSet\Services\SNMP" /s

# Broad sweep for password values
reg query HKLM /f password /t REG_SZ /s 2>nul
reg query HKCU /f password /t REG_SZ /s 2>nul

The SAM, SYSTEM, and SECURITY Hives

The most sensitive registry hives are stored as files on disk and hold the local password hashes. Reading them is a primary credential-theft technique (requires admin or SeBackupPrivilege).

# Save the hives to files (needs admin / SeBackupPrivilege)
reg save HKLM\SAM C:\Users\Public\sam.save
reg save HKLM\SYSTEM C:\Users\Public\system.save
reg save HKLM\SECURITY C:\Users\Public\security.save

Then extract the hashes offline with impacket on your Linux box:

# Dump local account hashes from the saved hives
impacket-secretsdump -sam sam.save -system system.save -security security.save LOCAL

Next: Windows Pillaging — automated enumeration, hunting sensitive files, and the data-exfiltration endgame.