---------------------------------------------------------------------------

Section 09

The Registry

---------------------------------------------------------------------------

09-1. What is the Registry?

The Registry is the central core registrar for Windows NT. Each NT 
workstation for server has its own Registry, and each one contains info on
the hardware and software of the computer it resides on. For example, comm
port definitions, Ethernet card settings, desktop setting and profiles,
and what a particular user can and cannot do are stored in the Registry.
Remember those ugly system INI files in Windows 3.1? Well, they are all 
included with even more fun stuff into one big database called the 
Registry in NT.

Of interest to hackers is the fact that all access control and assorted
parameters are located in the Registry. While I'm tempted to discuss just
that portion of the Registry, I'll briefly cover everything for 
completeness but put the fun stuff up front.

The Registry contains thousands of individual items of data, and are 
grouped together into "keys" or some type of optional value. These keys
are grouped together into subtrees -- placing like keys together and making
copies of others into separate trees for more convenient system access.

The Registry is divided into four separate subtrees. These subtrees are
called HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, and
HKEY_USERS. We'll go through them from most important to the hacker to
least important to the hacker.

First and formost is the HKEY_LOCAL_MACHINE subtree. It contains five 
different keys. These keys are as follows:

	SAM and SECURITY - These keys contain the info such as user rights,
	user and group info for the domain (or workgroup if there is no
	domain), and passwords. In the NT hacker game of capture the flag,
	this is the flag. Bag this and all bets are off.

	The keys are binary data only (for security reasons) and are
	typically not accessible unless you are an Administrator or in the
	Administrators group. It is easier to copy the data and play with
	it offline than to work on directly. This is discussed in a little
	more detail in section 09-4.

	HARDWARE - this is a storage database of throw-away data that
	describes the hardware components of the computer. Device drivers
	and applications build this database during boot and update it
	during runtime (although most of the database is updated during
	the boot process). When the computer is rebooted, the data is
	built again from scratch. It is not recommended to directly edit
	this particular database unless you can read hex easily.
	
	There are three subkeys under HARDWARE, these are the Description
	key, the DeviceMap key, and the ResourceMap key. The Description
	key has describes each hardware resource, the DeviceMap key has
	data in it specific to individual groups of drivers, and the
	ResourceMap key tells which driver goes with which resource.

	SYSTEM - This key contains basic operating stuff like what happens
	at startup, what device drivers are loaded, what services are 
	in use, etc. These are split into ControlSets which have unique
	system configurations (some bootable, some not), with each 
	ControlSet containing service data and OS components for that
	ControlSet. Ever had to boot from the "Last Known Good" 
	configuration because something got hosed? That is a ControlSet
	stored here.

	SOFTWARE - This key has info on software loaded locally. File
	associations, OLE info, and some miscellaneous configuration data
	is located here.

The second most important main key is HKEY_USERS. It contains a subkey 
for each local user who accesses the system, either locally or remotely.
If the server is a part of a domain and logs in across the network, their
subkey is not stored here, but on a Domain Controller. Things such as
Desktop settings and user profiles are stored here.

The third and fourth main keys, HKEY_CURRENT_USER and HKEY_CLASSES_ROOT,
contain copies of portions of HKEY_USERS and HKEY_LOCAL_MACHINE
respectively. HKEY_CURRENT_USER contains exactly would you would expect,
a copy of the subkey from HKEY_USERS of the currently logged in user.
HKEY_CLASSES_ROOT contains a part of HKEY_LOCAL_MACHINE, specifically from
the SOFTWARE subkey. File associations, OLE configuration and dependency 
information.

---------------------------------------------------------------------------

09-2. What are hives?

Hives are the major subdivisions of all of these subtrees, keys, subkeys,
and values that make up the Registry. They contains "related" data. Look,
I know what you might be thinking, but this is just how Microsoft divided
things up -- I'm just relaying the info, even I don't know exactly what
all the advantages to this setup are. ;-)

All hives are stored in %systemroot%\SYSTEM32\CONFIG. The major hives and
their files are as follows:

Hive                         File      Backup File
---------------------------  ------    ------------
HKEY_LOCAL_MACHINE\SOFTWARE  SOFTWARE  SOFTWARE.LOG
HKEY_LOCAL_MACHINE\SECURITY  SECURITY  SECURITY.LOG
HKEY_LOCAL_MACHINE\SYSTEM    SYSTEM    SYSTEM.LOG
HKEY_LOCAL_MACHINE\SAM       SAM       SAM.LOG
HKEY_CURRENT_USER            USERxxx   USERxxx.LOG
                             ADMINxxx  ADMINxxx.LOG
HKEY_USERS\.DEFAULT          DEFAULT   DEFAULT.LOG

Hackers should look for the SAM file, with the SAM.LOG file as a secondary
target. This contains the password info.

---------------------------------------------------------------------------

09-3. Why is the Registry like this and why do I care?

Who the hell knows why it's this way? ;-)

The main reason is a step towards central administration and combining all
that crap from SYSTEM.INI, WIN.INI, and other "legacy" Windows 3.x config
stuff into one database. Then nice and neat individual GUI applications
could be used to manipulate the data contained inside. And with the idea
of a "domain" there are some "centralized" functionalities that are a 
little more convenient.

Is it better than Windows 3.x? This is debatable, although in my personal
opinion I'd say yes. Were the design functions met? Probably not. While the
Registry tries to be all things to all subcomponents of a domain, it does
tend to smell like there were too many cooks in Microsoft's kitchen and
simply not enough spoons. Some functions seem to be well suited for the
Registry, some not. It is certainly not "portable" like Novell's NDS, that
is you will probably never find the Registry running on a Unix system,
whereas Novell's NDS is a much simpler design and is quite portable. Both
schemes have their place -- NDS does not contain or manage OS info at the
Desktop level and the Registry does. 

Who wins? My guess is the people currently offering training classes in 
any modern OS are probably loving this because it is so complex, therefore
it is guaranteed income. And hackers also win, because this is a complex
environment where one wrong parameter setting or one Hot Fix not loaded
could mean free and easy access.

My main advice to hackers is to play around with the Registry before the
attack, because as you go further and further into an NT environment, you
stand more chances of screwing things up, which is an easy way to make
yourself known.

---------------------------------------------------------------------------

09-4. What do I do with a copy of SAM?

You get passwords. First use a copy of SAMDUMP.EXE to extract the user info
out of it. You do not need to import this data into the Registry of your
home machine to play with it. You can simply load it up into one of the
many applications for cracking passwords, such as L0phtCrack. See section
3 for more info on NT passwords and cracking them.

---------------------------------------------------------------------------
