@@ -50,9 +50,9 @@ def find_usernames()
50
50
else
51
51
profile_subkeys . each do |user_sid |
52
52
if user_sid . length > 10
53
- user_home_path = registry_getvaldata ( "HKLM \\ Software \\ Microsoft \\ Windows \ NT \\ CurrentVersion \\ ProfileList \\ #{ user_sid } " , "ProfileImagePath" )
53
+ user_home_path = registry_getvaldata ( "#{ username_reg_path } \\ #{ user_sid } " , "ProfileImagePath" )
54
54
unless user_home_path . blank?
55
- full_path = user_home_path . delete ( " \00 " )
55
+ full_path = user_home_path . strip
56
56
usernames << full_path . split ( "\\ " ) . last
57
57
user_homedir_paths << full_path
58
58
user_sids << user_sid
@@ -133,7 +133,7 @@ def process_hive(sys_path, user, local_hive_copy, table, muicache, hive_file)
133
133
hive_path = user_home_path + hive_file
134
134
ntuser_status = client . fs . file . exists? ( hive_path )
135
135
if ntuser_status == true
136
- print_status ( "Downloading #{ user } 's NTUSER.DAT/USERCLASS .DAT file.." )
136
+ print_status ( "Downloading #{ user } 's NTUSER.DAT/USRCLASS .DAT file.." )
137
137
hive_status = hive_download_status ( local_hive_copy , hive_path )
138
138
if hive_status == true
139
139
hive_parser ( local_hive_copy , muicache , user , table )
@@ -232,7 +232,8 @@ def run
232
232
# - http://www.irongeek.com/i.php?page=security/windows-forensics-registry-and-file-system-spots
233
233
234
234
print_status ( "Starting to enumerate MuiCache registry keys.." )
235
- sysnfo = client . sys . config . sysinfo [ 'OS' ]
235
+ sysnfo = sysinfo [ 'OS' ]
236
+
236
237
if sysnfo =~/(Windows XP)/ and is_admin?
237
238
print_good ( "Remote system supported: #{ sysnfo } " )
238
239
muicache = "\\ Software\\ Microsoft\\ Windows\\ ShellNoRoam\\ MUICache"
0 commit comments