Shulou(Shulou.com)06/03 Report--

This article introduces the knowledge of "how to write VBScript to find hidden services by comparing the registry". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

The copy code is as follows:

'On Error Resume Next

Const HKEY_LOCAL_MACHINE = & H80000002

Set oReg=GetObject ("winmgmts: {impersonationLevel=impersonate}!\.\ root\ default:StdRegProv")

StrKeyPath = "SYSTEM\ CurrentControlSet\ Services"

OReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

Wscript.Echo "Checking, please wait..."

Wscript.Echo ""

For Each subkey In arrSubKeys

OReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue

If Not (strValue = "") Then

'judge the service and use the array to compare. I wonder if it will be faster?

If Not (CheckSvr (subkey)) Then

Wscript.Echo subkey & FormatOutTab (subkey) & strValue & FormatOutTab (strValue) & "[Hidden]"

Else

Wscript.Echo subkey & FormatOutTab (subkey) & strValue & FormatOutTab (strValue) & "[OK]"

End If

End If

Next

Wscript.Echo ""

Wscript.Echo "All done."

Wscript.Quit (0)

Function CheckSvr (strName)

Set oWMI = GetObject ("winmgmts:" & "{impersonationLevel=impersonate}!\.\ root\ cimv2")

Set cService = oWMI.ExecQuery ("Select * from Win32_Service WHERE Name='" & strName & "'")

If (cService.count 0) Then

CheckSvr = True

Else

CheckSvr = False

End If

End Function

Function FormatOutTab (strName)

StrLen = Len (strName)

Select Case True

Case strLen < 8

FormatOutTab = vbTab & vbTab & vbTab & vbTab & vbTab

Case strLen < 16

FormatOutTab = vbTab & vbTab & vbTab & vbTab

Case strLen < 24

FormatOutTab = vbTab & vbTab & vbTab

Case strLen < 32

FormatOutTab = vbTab & vbTab

Case strLen < 40

FormatOutTab = vbTab

Case Else

FormatOutTab = vbTab

End Select

End Function

Using dictionaries is much faster:

The copy code is as follows:

Dim oDic, oReg, oWmi, arrServices

Const HKEY_LOCAL_MACHINE = & H80000002

Wscript.Echo "[*] Checking, please wait..."

Wscript.Echo ""

Set oDic = CreateObject ("Scripting.Dictionary")

Set oWmi = GetObject ("winmgmts:" & "{impersonationLevel=impersonate}!\.\ root\ cimv2")

Set arrServices = oWmi.ExecQuery ("Select * from Win32_Service")

For Each strService In arrServices

ODic.Add strService.Name, strService.Name

Next

Set oReg = GetObject ("winmgmts: {impersonationLevel=impersonate}!\\.\ root\ default:StdRegProv")

StrKeyPath = "SYSTEM\ CurrentControlSet\ Services"

OReg.EnumKey HKEY_LOCAL_MACHINE, strKeyPath, arrSubKeys

For Each subkey In arrSubKeys

OReg.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath & "\\" & subkey, "ObjectName", strValue

If Not (strValue = "") Then

If oDic.Exists (subkey) Then

Wscript.Echo subkey & FormatOutTab (subkey) & strValue & FormatOutTab (strValue) & "[OK]"

Else

Wscript.Echo subkey & FormatOutTab (subkey) & strValue & FormatOutTab (strValue) & "[Hidden]"

End If

End If

Next

ODic.RemoveAll

Wscript.Echo ""

Wscript.Echo'[*] All done.

Wscript.Quit (0)

Function FormatOutTab (strName)

StrLen = Len (strName)

Select Case True

Case strLen < 8

FormatOutTab = vbTab & vbTab & vbTab & vbTab

Case strLen < 16

FormatOutTab = vbTab & vbTab & vbTab

Case strLen < 24

FormatOutTab = vbTab & vbTab

Case strLen < 32

FormatOutTab = vbTab

Case Else

FormatOutTab = vbTab

End Select

End Function

This is the end of "how to write VBScript to find hidden services by comparing the registry". Thank you for reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.