44
55
66class NXCModule :
7+ """Module by @joaovarelas"""
8+
79 name = "hyperv-host"
810 description = "Performs a registry query on the VM to lookup its HyperV Host"
911 supported_protocols = ["smb" ]
@@ -25,25 +27,28 @@ def on_admin_login(self, context, connection):
2527 path = "SOFTWARE\Microsoft\Virtual Machine\Guest\Parameters"
2628 key = "HostName"
2729
28- remote_ops = RemoteOperations (connection .conn , False )
29- remote_ops .enableRegistry ()
30-
3130 try :
31+ remote_ops = RemoteOperations (connection .conn , False )
32+ remote_ops .enableRegistry ()
33+
3234 ans = rrp .hOpenLocalMachine (remote_ops ._RemoteOperations__rrp )
3335 reg_handle = ans ["phKey" ]
3436
35- ans = rrp .hBaseRegOpenKey (remote_ops ._RemoteOperations__rrp , reg_handle , path )
36- key_handle = ans ["phkResult" ]
37-
3837 # Query
3938 try :
39+ ans = rrp .hBaseRegOpenKey (remote_ops ._RemoteOperations__rrp , reg_handle , path )
40+ key_handle = ans ["phkResult" ]
41+
4042 data_type , reg_value = rrp .hBaseRegQueryValue (remote_ops ._RemoteOperations__rrp , key_handle , key )
4143 self .context .log .highlight (f"{ key } : { reg_value } " )
44+
45+ rrp .hBaseRegCloseKey (remote_ops ._RemoteOperations__rrp , key_handle )
46+
4247 except Exception :
43- self .context .log .fail (f"Registry key { path } \\ { key } does not exist" )
44- return
48+ #self.context.log.fail(f"Registry key {path}\\{key} does not exist")
49+ pass # Muted
50+
4551
46- rrp .hBaseRegCloseKey (remote_ops ._RemoteOperations__rrp , key_handle )
4752 except DCERPCException as e :
4853 self .context .log .fail (f"DCERPC Error while querying registry: { e } " )
4954 except Exception as e :
0 commit comments