How to write VBScript to find hidden services by comparing the registry
This article introduces the knowledge of "how to write VBScript to find hidden services by comparing the registry". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!
The copy code is as follows:
'On Error Resume Next
Const HKEY_LOCAL_MACHINE = & H80000002
Set oReg=GetObject ("winmgmts: {impersonationLevel=impersonate}!\.\ root\ default:StdRegProv")
StrKeyPath = "SYSTEM\ CurrentControlSet\ Services"
OReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
Wscript.Echo "Checking, please wait..."
Wscript.Echo ""
For Each subkey In arrSubKeys
OReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue
If Not (strValue = "") Then
'judge the service and use the array to compare. I wonder if it will be faster?
If Not (CheckSvr (subkey)) Then
Wscript.Echo subkey & FormatOutTab (subkey) & strValue & FormatOutTab (strValue) & "[Hidden]"
Else
Wscript.Echo subkey & FormatOutTab (subkey) & strValue & FormatOutTab (strValue) & "[OK]"
End If
End If
Next
Wscript.Echo ""
Wscript.Echo "All done."
Wscript.Quit (0)
Function CheckSvr (strName)
Set oWMI = GetObject ("winmgmts:" & "{impersonationLevel=impersonate}!\.\ root\ cimv2")
Set cService = oWMI.ExecQuery ("Select * from Win32_Service WHERE Name='" & strName & "'")
If (cService.count 0) Then
CheckSvr = True
Else
CheckSvr = False
End If
End Function
Function FormatOutTab (strName)
StrLen = Len (strName)
Select Case True
Case strLen < 8
FormatOutTab = vbTab & vbTab & vbTab & vbTab & vbTab
Case strLen < 16
FormatOutTab = vbTab & vbTab & vbTab & vbTab
Case strLen < 24
FormatOutTab = vbTab & vbTab & vbTab
Case strLen < 32
FormatOutTab = vbTab & vbTab
Case strLen < 40
FormatOutTab = vbTab
Case Else
FormatOutTab = vbTab
End Select
End Function
Using dictionaries is much faster:
The copy code is as follows:
Dim oDic, oReg, oWmi, arrServices
Const HKEY_LOCAL_MACHINE = & H80000002
Wscript.Echo "[*] Checking, please wait..."
Wscript.Echo ""
Set oDic = CreateObject ("Scripting.Dictionary")
Set oWmi = GetObject ("winmgmts:" & "{impersonationLevel=impersonate}!\.\ root\ cimv2")
Set arrServices = oWmi.ExecQuery ("Select * from Win32_Service")
For Each strService In arrServices
ODic.Add strService.Name, strService.Name
Next
Set oReg = GetObject ("winmgmts: {impersonationLevel=impersonate}!\\.\ root\ default:StdRegProv")
StrKeyPath = "SYSTEM\ CurrentControlSet\ Services"
OReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys
For Each subkey In arrSubKeys
OReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue
If Not (strValue = "") Then
If oDic.Exists (subkey) Then
Wscript.Echo subkey & FormatOutTab (subkey) & strValue & FormatOutTab (strValue) & "[OK]"
Else
Wscript.Echo subkey & FormatOutTab (subkey) & strValue & FormatOutTab (strValue) & "[Hidden]"
End If
End If
Next
ODic.RemoveAll
Wscript.Echo ""
Wscript.Echo'[*] All done.
Wscript.Quit (0)
Function FormatOutTab (strName)
StrLen = Len (strName)
Select Case True
Case strLen < 8
FormatOutTab = vbTab & vbTab & vbTab & vbTab
Case strLen < 16
FormatOutTab = vbTab & vbTab & vbTab
Case strLen < 24
FormatOutTab = vbTab & vbTab
Case strLen < 32
FormatOutTab = vbTab
Case Else
FormatOutTab = vbTab
End Select
End Function
This is the end of "how to write VBScript to find hidden services by comparing the registry". Thank you for reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!
