Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Catalog · How the catalog works
Anything · Lazarus or Delphi
Random projectRandom project

RegVault-Delphi

Dump SAM, SYSTEM, SECURITY registry hives from local/remote host

View on GitHub

Member rating

No ratings yet.

Sign in to rate this project.

README

RegVault-Delphi

Dump SAM, SYSTEM, SECURITY registry keys from local/remote host to local/remote path of your choosing.

Help

pascal
C:\>RegVault.exe --help
[!] Target machine name is required unless using --local.
RegVault - Registry Save Utility

Usage:
  RegVault.exe [-t TARGET] [-o OUTPUT_PATH] [--backup] [--acl] [--local]

Options:
  -t, --Target       Remote machine name (not required with --local)
  -o, --OutputPath   Registry hives output directory path
  --backup           Use REG_OPTION_BACKUP_RESTORE flag for RegOpenKeyEx
  --acl              Show ACL for registry key SYSTEM\ControlSet001\Control\SecurePipeServers\winreg and exit
  --local            Dump registry hives from local machine instead of remote

Demo

Local backup

pascal
C:\RegVault>RegVault.exe --local --backup
[+] Successfully enabled privilege: SeBackupPrivilege
[+] Successfully enabled privilege: SeRestorePrivilege
[+] Exported local HKLM\SAM to C:\RegVault\SAM_{D60CC773-12C2-4A56-BADD-E5C5A09BA2BE}
[+] Exported local HKLM\SYSTEM to C:\RegVault\SYSTEM_{07C4D473-DE95-41BA-831B-B69B0E85DC0F}
[+] Exported local HKLM\SECURITY to C:\RegVault\SECURITY_{E53FD07E-35E9-40B9-9F08-6E66FED71513}

Local acl

pascal
C:\RegVault>RegVault.exe --local --acl

[*] Identity: BUILTIN\Administrators
   \_ Access Type: Allow
   \_ Registry Rights: 983103
   \_ Inherited: False

[*] Identity: BUILTIN\Administrators
   \_ Access Type: Allow
   \_ Registry Rights: 268435456
   \_ Inherited: False

[*] Identity: BUILTIN\Backup Operators
   \_ Access Type: Allow
   \_ Registry Rights: 131097
   \_ Inherited: False

[*] Identity: LocalService
   \_ Access Type: Allow
   \_ Registry Rights: 131097
   \_ Inherited: False

[*] Identity: LocalService
   \_ Access Type: Allow
   \_ Registry Rights: -2147483648
   \_ Inherited: False

Remote backup

pascal
C:\RegVault>RegVault.exe -t dc.contoso.com -o C:\Windows\SYSVOL\sysvol\contoso.com\scripts --backup
[+] Successfully enabled privilege: SeBackupPrivilege
[+] Successfully enabled privilege: SeRestorePrivilege
[+] Exported \\dc.contoso.com\HKLM\SAM to C:\Windows\SYSVOL\sysvol\contoso.com\scripts\{F05ED972-F230-4ED1-8766-430EA8F93F12}
[+] Exported \\dc.contoso.com\HKLM\SYSTEM to C:\Windows\SYSVOL\sysvol\contoso.com\scripts\{8835FEF5-6CFF-40B7-9A4C-D7EA33E4D6E5}
[+] Exported \\dc.contoso.com\HKLM\SECURITY to C:\Windows\SYSVOL\sysvol\contoso.com\scripts\{97609C57-1722-4688-91AD-D4030FA26BA3}

Remote acl

pascal
C:\RegVault>RegVault.exe -t dc.contoso.com  --acl

[*] Identity: BUILTIN\Administrators
   \_ Access Type: Allow
   \_ Registry Rights: 983103
   \_ Inherited: False

[*] Identity: BUILTIN\Administrators
   \_ Access Type: Allow
   \_ Registry Rights: 268435456
   \_ Inherited: False

[*] Identity: BUILTIN\Backup Operators
   \_ Access Type: Allow
   \_ Registry Rights: 131097
   \_ Inherited: False

[*] Identity: LocalService
   \_ Access Type: Allow
   \_ Registry Rights: 131097
   \_ Inherited: False

[*] Identity: LocalService
   \_ Access Type: Allow
   \_ Registry Rights: -2147483648
   \_ Inherited: False

Made with ❤️ using Delphi RAD Studio