Interacting with the registry
The registry is a system-defined database used to store information that is necessary to configure the system for one or more users, applications, and hardware devices.
Getting ready
The data stored in the registry varies according to the version of Microsoft Windows, so you need to take that into account when interacting with the target system.
By looking at the registry, you can find what files have been used, websites visited using Internet Explorer, programs used, USB devices used, and much more.
How to do it...
- To interact with the target machine's registry, we will use the
regcommand, but before we start using it, let's see the available options:
meterpreter > reg Usage: reg [command] [options]
Interact with the target machine's registry. The following are the options:
-d <opt>: The data to store in the registry value-h: Help menu-k <opt>: The registry key path (for example,HKLM\Software\Foo)-r <opt>: The remote machine name to connect to...
