Skip to content

Commit 5f5ca1c

Browse files
author
jiuweigui
committed
Minor fix based on suggestions
1 parent 9a81420 commit 5f5ca1c

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

modules/post/windows/gather/enum_muicache.rb

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -50,9 +50,9 @@ def find_usernames()
5050
else
5151
profile_subkeys.each do |user_sid|
5252
if user_sid.length > 10
53-
user_home_path = registry_getvaldata("HKLM\\Software\\Microsoft\\Windows\ NT\\CurrentVersion\\ProfileList\\#{user_sid}", "ProfileImagePath")
53+
user_home_path = registry_getvaldata("#{username_reg_path}\\#{user_sid}", "ProfileImagePath")
5454
unless user_home_path.blank?
55-
full_path = user_home_path.delete("\00")
55+
full_path = user_home_path.strip
5656
usernames << full_path.split("\\").last
5757
user_homedir_paths << full_path
5858
user_sids << user_sid
@@ -133,7 +133,7 @@ def process_hive(sys_path, user, local_hive_copy, table, muicache, hive_file)
133133
hive_path = user_home_path + hive_file
134134
ntuser_status = client.fs.file.exists?(hive_path)
135135
if ntuser_status == true
136-
print_status("Downloading #{user}'s NTUSER.DAT/USERCLASS.DAT file..")
136+
print_status("Downloading #{user}'s NTUSER.DAT/USRCLASS.DAT file..")
137137
hive_status = hive_download_status(local_hive_copy, hive_path)
138138
if hive_status == true
139139
hive_parser(local_hive_copy, muicache, user, table)
@@ -232,7 +232,8 @@ def run
232232
# - http://www.irongeek.com/i.php?page=security/windows-forensics-registry-and-file-system-spots
233233

234234
print_status("Starting to enumerate MuiCache registry keys..")
235-
sysnfo = client.sys.config.sysinfo['OS']
235+
sysnfo = sysinfo['OS']
236+
236237
if sysnfo =~/(Windows XP)/ and is_admin?
237238
print_good("Remote system supported: #{sysnfo}")
238239
muicache = "\\Software\\Microsoft\\Windows\\ShellNoRoam\\MUICache"

0 commit comments

Comments
 (0)