Writeup 4 2020 - 之江杯 - 注册表分析

Writeup 4 2020 - 之江杯 - 注册表分析

知识点

WiFi 信息一般在这些注册表路径中：

• SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
• SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged
• SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed

其中 Profiles 下面每个子项里通常有：

• ProfileName：WiFi 名称
• Description：网络描述
• Managed：是否受管
• Category：网络类别

解题技巧

如果注册表已经导出成 .reg 文本，直接搜索 ProfileName 就能看到 WiFi 名。

...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{6E6D2E56-BC24-47D5-8F55-8891506C0C3F}]
"ProfileName"="OPPO Reno"
"Description"="OPPO Reno"
"Managed"=dword:00000000
"Category"=dword:00000000
"DateCreated"=hex:e4,07,0c,00,00,00,0d,00,11,00,38,00,0d,00,53,00
"NameType"=dword:00000047
"DateLastConnected"=hex:e4,07,0c,00,00,00,0d,00,11,00,38,00,0d,00,53,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{9B5BA71F-779F-4CE6-A6D4-33C2FD55317A}]
"ProfileName"="网络"
"Description"="网络"
"Managed"=dword:00000000
"Category"=dword:00000000
"DateCreated"=hex:e4,07,0c,00,00,00,0d,00,11,00,30,00,23,00,1f,01
"NameType"=dword:00000006
"DateLastConnected"=hex:e4,07,0c,00,00,00,0d,00,11,00,33,00,1a,00,c7,03

...

Flag

flag{OPPOReno}