CmdID

CmdID / Commands

reg.py

Query, add, delete, save, or back up registry keys/values on a remote Windows machine over SMB/RPC. tldr-pages

On several platforms

Opens CmdID with your command. It is read in your browser and sent nowhere.

Several platforms

from tldr-pages, CC BY 4.0

Query, add, delete, save, or back up registry keys/values on a remote Windows machine over SMB/RPC. Part of the Impacket suite.

Query subkeys and values under a registry path

reg.py domain/username:password@target query -keyName 'HKLM\SOFTWARE\Microsoft\Windows'Identify

Query all subkeys and values under a registry path recursively

reg.py domain/username:password@target query -keyName 'HKLM\SOFTWARE\Microsoft\Windows' -sIdentify

Add a new registry key or value (default value type is REG_SZ)

reg.py domain/username:password@target add -keyName 'HKLM\SOFTWARE\Microsoft\Windows' -v value_name -vt REG_SZ -vd value_dataIdentify

Delete a registry key or value

reg.py domain/username:password@target delete -keyName 'HKLM\SOFTWARE\Example' -v value_nameIdentify

Save a registry key (and subkeys) to a file on the target via UNC path

reg.py domain/username:password@target save -keyName 'HKLM\SOFTWARE\Example' -o '\\target\share\output_file.reg'Identify

Back up SAM, SYSTEM, and SECURITY hives to a file on a target via UNC path (requires SYSTEM privileges)

reg.py domain/username:password@target backup -o '\\target\share'Identify