#%NASL_MIN_LEVEL 70300 # # (C) Tenable Network Security, Inc. # include('deprecated_nasl_level.inc'); include("compat.inc"); if(description) { script_id(214088); script_version("1.2"); script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/27"); script_name(english:"Enumerate the Microsoft Windows Registry"); script_summary(english:"A problem with the scan prevented registry enumeration."); script_set_attribute(attribute:"synopsis", value: "It was not possible to enumerate the registry of the remote Windows host."); script_set_attribute(attribute:"description", value: "Using the supplied credentials, Nessus was unable to log into the remote Windows host, enumerate registry keys and values required for vulnerability scans and store them in the knowledge base for other plugins to use."); script_set_attribute(attribute:"solution", value:"n/a"); script_set_attribute(attribute:"risk_factor", value:"None"); script_set_attribute(attribute:"plugin_publication_date", value:"2025/01/14"); script_set_attribute(attribute:"plugin_type", value:"local"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("netbios_name_get.nasl", "smb_login.nasl","smb_registry_full_access.nasl", "smb_reg_service_pack.nasl","smb_reg_service_pack_W2K.nasl", "smb_reg_service_pack_XP.nasl"); script_exclude_keys("SMB/not_windows"); script_require_keys("SMB/name", "SMB/login", "SMB/password", "SMB/registry_access"); script_require_ports(139, 445); script_timeout(600); exit(0); } include("smb_func.inc"); include("smb_hotfixes.inc"); include("smb_hotfixes_fcheck.inc"); include("smb_reg_query.inc"); include("lcx.inc"); include("json2.inc"); include("charset_func.inc"); if(get_kb_item("SMB/not_windows")) audit(AUDIT_OS_NOT, "Windows"); get_kb_item_or_exit("SMB/registry_access"); global_var handle; global_var Versions; Versions = make_array(); function crawl_for_version(key, level, maxlevel, allow) { local_var mylist, entries, l, list, item, tmp, key_h, info, i, subkey; list = make_list(); entries = make_list(); if(level >= maxlevel ) return make_list(); if(isnull(allow) || (allow == FALSE)) { tmp = tolower (key); if("software\classes" >< tmp || "software\wow6432node\classes" >< tmp || "software\clients" >< tmp || "software\microsoft" >< tmp || "software\odbc" >< tmp || "software\policies" >< tmp) return make_list(); } key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h)) { info = RegQueryInfoKey(handle:key_h); if(isnull(info) ) { RegCloseKey(handle:key_h); return make_list(); } for ( i = 0; i != info[1]; i++ ) { subkey = RegEnumKey(handle:key_h, index:i); if(subkey == NULL ) break; else list = make_list(list, key + "\" + subkey); } item = RegQueryValue(handle:key_h, item:"Version"); if(!isnull(item) ) { Versions[key] = item[1]; } RegCloseKey(handle:key_h); } entries = make_list(); foreach l (list) { entries = make_list(entries, crawl_for_version(key:l, level:level + 1, maxlevel:maxlevel, allow:allow)); } return make_list(list, entries); } function get_key(key, item) { local_var key_h, value; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(isnull(key_h)) return NULL; value = RegQueryValue(handle:key_h, item:item); RegCloseKey(handle:key_h); if(isnull(value)) return NULL; else return value[1]; } if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init'); port = kb_smb_transport(); login = kb_smb_login(); pass = kb_smb_password(); domain = kb_smb_domain(); ret = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$"); if(ret != 1) audit(AUDIT_SHARE_FAIL, 'IPC$'); handle = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE); if(isnull(handle) ) { lcx::log_issue(type:lcx::ISSUES_ERROR, proto:lcx::PROTO_SMB, msg: "it was not possible to connect to the remote registry", port:port, user:login); NetUseDel (); exit(0); } vers = get_kb_item("SMB/WindowsVersion"); systemroot = get_kb_item("SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/SystemRoot"); if(!systemroot) { key = "SOFTWARE\Microsoft\Windows NT\CurrentVersion"; item = "SystemRoot"; data = get_key(key:key, item:item); if(data) { set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/SystemRoot", value:data); systemroot = data; } } r = NULL; share = NULL; access = FALSE; if(systemroot) { share = ereg_replace(pattern:"^([A-Za-z]):.*", string:systemroot, replace:"\1$"); RegCloseKey(handle:handle); NetUseDel(close:FALSE); r = NetUseAdd(share:share); NetUseDel(close:FALSE); NetUseAdd(share:"IPC$"); handle = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE); if(isnull(handle)) { lcx::log_issue(type:lcx::ISSUES_ERROR, proto:lcx::PROTO_SMB, msg: "it was not possible to connect to the remote registry", port:port, user:login); NetUseDel (); exit(0); } if(r == 1) access = TRUE; } if(access != TRUE) { log_msg = ""; if(!systemroot) { report = ' The required registry information for the location of SystemRoot was not successfully written in Nessus scan data. Solution : Ensure the account you are using can connect to the IPC$ administrative SMB share'; log_msg = "unable to determine systemroot"; } else if(r == 0) { report = '\nThe system root '; if(! isnull(share) && strlen(share) ) { report += share + ' '; } report += 'used for this test does not have a working network share over SMB, or has encountered another error similar to STATUS_BAD_NETWORK_NAME. As a result, Nessus was not able to determine the missing hotfixes on the remote host and most SMB checks have been disabled. Solution : Configure the system root to have an SMB network share which the scanning account has sufficient credentials to access.'; log_msg = "the system root does not have an accessible SMB share"; } else # if(r == -1) { report = ' The SMB account used for this test does not have sufficient privileges to enumerate the registry for information required to conduct local vulnerability checks on the remote host. As a result, and most SMB checks have been disabled. Solution : Configure the account you are using to get the ability to connect to '; if(!isnull(share) && strlen(share)) { report += share; } else { report += 'ADMIN$'; } log_msg = "the account used does not have sufficient privileges to read " + "all the required registry entries"; } lcx::log_issue(type:lcx::ISSUES_ERROR, proto:lcx::PROTO_SMB, msg:log_msg, port:port, user:login); security_note(port:0, extra:report); RegCloseKey(handle:handle); NetUseDel(); exit(1); } # Make sure it is a 32bits system arch = ''; key_h = RegOpenKey(handle:handle, key:"SYSTEM\CurrentControlSet\Control\Session Manager\Environment", mode:MAXIMUM_ALLOWED); if(!isnull(key_h)) { item = RegQueryValue(handle:key_h, item:"PROCESSOR_ARCHITECTURE"); if(!isnull(item)) { arch = item[1]; if("64" >< arch) arch = "x64"; else arch = "x86"; set_kb_item(name:"SMB/ARCH", value:arch); } RegCloseKey(handle:key_h); } if("x86" >!< arch && vers !~ "^(1[0-9]|[6-9]\.|5\.2)" ) { RegCloseKey(handle:handle); NetUseDel(); exit(1); } crawl_for_version(key:"SOFTWARE\Microsoft\Active Setup\Installed Components", level:0, maxlevel:2, allow:TRUE); foreach var k (keys(Versions)) { s = str_replace(find:"\", replace:"/", string:k); if(!isnull(Versions[k])) set_kb_item(name:"SMB/Registry/HKLM/" + s + "/Version", value:Versions[k]); } # # Check for common registry values other plugins are likely to look at # key = "SYSTEM\CurrentControlSet\Control\ProductOptions"; item = "ProductType"; value = get_key(key:key, item:item); if(value ) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Control/ProductOptions", value:value); key = "SYSTEM\CurrentControlSet\Services\W3SVC"; item = "ImagePath"; value = get_key(key:key, item:item); if(value ) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Services/W3SVC/ImagePath", value:value); key = "SOFTWARE\Microsoft\DataAccess"; item = "Version"; value = get_key(key:key, item:item); if(value ) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/DataAccess/Version", value:value); key = "SYSTEM\CurrentControlSet\Control\LSA"; item = "RestrictAnonymous"; data = get_key(key:key, item:item); if(!isnull(data) ) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Control/LSA/RestrictAnonymous", value:data); key = "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"; item = "FeatureSettingsOverride"; data = get_key(key:key, item:item); if(!isnull(data) ) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Control/Session Manager/Memory Management/FeatureSettingsOverride", value:data); key = "SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management"; item = "FeatureSettingsOverrideMask"; data = get_key(key:key, item:item); if(!isnull(data) ) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Control/Session Manager/Memory Management/FeatureSettingsOverrideMask", value:data); key = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization"; item = "MinVmVersionForCpuBasedMitigations"; data = get_key(key:key, item:item); if(!isnull(data) ) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Virtualization/MinVmVersionForCpuBasedMitigations", value:data); key = "HARDWARE\DESCRIPTION\System\CentralProcessor\0"; item = "ProcessorNameString"; data = get_key(key:key, item:item); if(!isnull(data)) { replace_kb_item(name:"SMB/processor_info", value:data); replace_kb_item(name:"SMB/Registry/HKLM/HARDWARE/DESCRIPTION/System/CentralProcessor/0/Processor", value:data); if("Intel" >< data) { intel_cpu = pregmatch(string:data, pattern:"CPU\s+([\w\-]+)"); if(!isnull(intel_cpu) && !isnull(intel_cpu[1])) replace_kb_item(name:"SMB/intel_cpu", value:intel_cpu[1]); } } key = "SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName\"; item = 'ComputerName'; data = get_key(key:key, item:item); if(!isnull(data)) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Control/ComputerName/ComputerName/ComputerName", value:data); key = "SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\"; item = 'Domain'; data = get_key(key:key, item:item); if(!empty_or_null(data)) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Services/Tcpip/Parameters/Domain", value:data); # Exchange detection # # - 2010 (14), 2013 (15), and 2016 (15.1) exchange_found = FALSE; exchange_versions = make_list("14", "15"); # Needed to support the CU model for 2016, aka 15.1 major = 0; minor = 0; foreach version (exchange_versions) { key = "SOFTWARE\Microsoft\ExchangeServer\v" + version + "\Setup"; # check for subscription edition in display k var software_name_key = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Exchange v" + version ; item = "MsiInstallPath"; value = get_key(key:key, item:item); var software_name = get_key(key:software_name_key, item:"DisplayName"); if(value ) { set_kb_item(name:"SMB/Exchange/Path", value:value); if (!empty_or_null(software_name)) set_kb_item(name:"SMB/Exchange/DisplayName", value:software_name); if(version != "15") { item = "MsiProductMajor"; value = get_key(key:key, item:item); if(value) { value = value*10; set_kb_item(name:"SMB/Exchange/Version", value:value); item = "MsiProductMinor"; value = get_key(key:key, item:item); if(value ) set_kb_item(name:"SMB/Exchange/SP", value:value); } } if(version == "15") { item = "MsiProductMajor"; major = get_key(key:key, item:item); if(major) { major = major * 10; item = "MsiProductMinor"; minor = get_key(key:key, item:item); if(minor && 'Subscription Edition' >< software_name) major = major + minor + 1; # set to 153 for subscription Edition else major = major + minor; set_kb_item(name:"SMB/Exchange/Version", value:major); } } exchange_found = TRUE; break; } } # - versions 2007 and older. if(!exchange_found) { key = "SOFTWARE\Microsoft\Exchange\Setup"; item = "Services"; value = get_key(key:key, item:item); if(value) { set_kb_item(name:"SMB/Exchange/Path", value:value); item = "Services Version"; value = get_key(key:key, item:item); if(value) { set_kb_item(name:"SMB/Exchange/Version", value:value); item = "ServicePackNumber"; value = get_key(key:key, item:item); if(value) set_kb_item(name:"SMB/Exchange/SP", value:value); } else { item = "MsiProductMajor"; value = get_key(key:key, item:item); if(value) { value = value*10; set_kb_item(name:"SMB/Exchange/Version", value:value); item = "MsiProductMinor"; value = get_key(key:key, item:item); if(value) set_kb_item(name:"SMB/Exchange/SP", value:value); } } item = "Web Connector"; value = get_key(key:key, item:item); if(value ) set_kb_item(name:"SMB/Exchange/OWA", value:TRUE); } } key = "SYSTEM\CurrentControlSet\Services\DHCPServer"; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h)) { set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Services/DHCPServer", value:1); RegCloseKey(handle:key_h); } key = "SYSTEM\CurrentControlSet\Services\SMTPSVC"; item = "DisplayName"; value = get_key(key:key, item:item); if(value) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Services/SMTPSVC/DisplayName", value:value); key = "SYSTEM\CurrentControlSet\Services\SNMP"; item = "DisplayName"; value = get_key(key:key, item:item); if(value) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Services/SNMP/DisplayName", value:value); key = "SYSTEM\CurrentControlSet\Services\WINS"; item = "DisplayName"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Services/WINS/DisplayName", value:data); key = "SYSTEM\CurrentControlSet\Services\DNS"; item = "DisplayName"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SYSTEM/CurrentControlSet/Services/DNS/DisplayName", value:data); key = "SOFTWARE\Microsoft\DirectX"; item = "Version"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/DirectX/Version", value:data); # Check Visio version visio_keys = make_array( "10.0", "SOFTWARE\Microsoft\Visio\Installer", "11.0", "SOFTWARE\Microsoft\Office\11.0\Visio", "12.0", "SOFTWARE\Microsoft\Office\12.0\Visio\InstallRoot", "14.0", "SOFTWARE\Microsoft\Office\14.0\Visio\InstallRoot", "15.0", "SOFTWARE\Microsoft\Office\15.0\Visio\InstallRoot", "16.0", "SOFTWARE\Microsoft\Office\16.0\Visio\InstallRoot" ); visio_items = make_array( "10.0", "Visio10InstallLocation", "11.0", "CurrentlyRegisteredVersion", "12.0", "Path", "14.0", "Path", "15.0", "Path", "16.0", "Path" ); foreach var ver (keys(visio_keys)) { key = visio_keys[ver]; value = get_key(key:key, item:visio_items[ver]); if(value) { if('11.0' >< ver) { visio_path = NULL; key = "SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot"; item = "Path"; value = get_key(key:key, item:item); if(value) { if(egrep(pattern:'^.*OFFICE11.*', string:value)) value = ereg_replace(pattern:'^(.*)OFFICE11.*', string:value, replace:"\1"); visio_path = value; } if(isnull(visio_path)) { key = "SOFTWARE\Microsoft\Office\11.0\InfoPath\InstallRoot"; item = "Path"; value = get_key(key:key, item:item); if(value) { if(egrep(pattern:'^.*OFFICE11.*', string:value)) value = ereg_replace(pattern:'^(.*)OFFICE11.*', string:value, replace:"\1"); visio_path = value; } } if(!isnull(visio_path)) { set_kb_item(name:"SMB/Office/Visio/11.0/VisioPath", value:visio_path); replace_kb_item(name:"SMB/Office/Visio/Installed", value:TRUE); } } else { set_kb_item(name:"SMB/Office/Visio/"+ver+"/VisioPath", value:value); replace_kb_item(name:"SMB/Office/Visio/Installed", value:TRUE); } } } # Check Office products office_products = make_list("Outlook", "Word", "Excel", "Powerpoint", "Publisher", "Access", "InfoPath"); # Grab info about service pack upgrades, if available. foreach version (OFFICE_MAJOR_VERS) { key = "SOFTWARE\Microsoft\Office\" + version + "\Common\ProductVersion"; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h)) { item = RegQueryValue(handle:key_h, item:"LastProduct"); if(!isnull(item)) { last_product = item[1]; set_kb_item(name:"SMB/Office/"+version+"/LastProduct", value:last_product); } RegCloseKey(handle:key_h); } # Determine the Bitness of Office key = "SOFTWARE\Microsoft\Office\" + version + "\Outlook"; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h)) { item = RegQueryValue(handle:key_h, item:"Bitness"); if(!isnull(item)) { bitness = item[1]; set_kb_item(name:"SMB/Office/"+version+"/Bitness", value:bitness); } RegCloseKey(handle:key_h); } if(empty_or_null(get_kb_item("SMB/Office/"+version+"/Bitness"))) { key = "SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Microsoft\Office\" + version + "\Outlook"; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h)) { item = RegQueryValue(handle:key_h, item:"Bitness"); if(!isnull(item)) { bitness = item[1]; set_kb_item(name:"SMB/Office/"+version+"/Bitness", value:bitness); } RegCloseKey(handle:key_h); } } } var product, version; foreach product (office_products) { foreach version (OFFICE_MAJOR_VERS) { key = "SOFTWARE\Microsoft\Office\" + version + "\" + product + "\InstallRoot"; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h) ) { path = RegQueryValue(handle:key_h, item:"Path"); if(!isnull(path)) set_kb_item(name:"SMB/Office/"+product+"/"+version+"/Path", value:path[1]); RegCloseKey(handle:key_h); #break; # -> next product } } } # Check Office Viewers key = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90840409-6000-11D3-8CFE-0150048383C9}"; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h) ) { version = RegQueryValue(handle:key_h, item:"DisplayVersion"); if(!isnull(version)) { version = ereg_replace(pattern:"^([0-9]+\.[0-9]+)\..*", string:version[1], replace:"\1"); path = RegQueryValue(handle:key_h, item:"Path"); if(!isnull(path)) set_kb_item(name:"SMB/Office/ExcelViewer/"+version+"/Path", value:path[1]); RegCloseKey(handle:key_h); } } key = "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90850409-6000-11D3-8CFE-0150048383C9}"; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h) ) { version = RegQueryValue(handle:key_h, item:"DisplayVersion"); if(!isnull(version)) { version = ereg_replace(pattern:"^([0-9]+\.[0-9]+)\..*", string:version[1], replace:"\1"); path = RegQueryValue(handle:key_h, item:"Path"); if(!isnull(path)) set_kb_item(name:"SMB/Office/WordViewer/"+version+"/Path", value:path[1]); RegCloseKey(handle:key_h); } } key = "SOFTWARE\Microsoft\Internet Explorer"; item = "svcVersion"; data = get_key(key:key, item:item); if(!data) { item = "Version"; data = get_key(key:key, item:item); } if(data) set_kb_item(name:"SMB/IE/Version", value:data); key = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"; item = "Shell"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/Winlogon/Shell", value:data); data = get_kb_item("SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/ProgramFilesDir"); if(!data) { key = "SOFTWARE\Microsoft\Windows\CurrentVersion"; item = "ProgramFilesDir"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/ProgramFilesDir", value:data); } data = get_kb_item("SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/ProgramFilesDirx86"); if(!data) { key = "SOFTWARE\Microsoft\Windows\CurrentVersion"; item = "ProgramFilesDir (x86)"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/ProgramFilesDirx86", value:data); } key = "SOFTWARE\Microsoft\Windows\CurrentVersion"; item = "CommonFilesDir"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/CommonFilesDir", value:data); key = "SOFTWARE\Microsoft\Windows\CurrentVersion"; item = "CommonFilesDir (x86)"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/CommonFilesDirx86", value:data); key = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList"; item = "ProgramData"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows NT/CurrentVersion/ProfileList/ProgramData", value:data); # Works detection. key = "SOFTWARE\Microsoft\Works"; key_h = RegOpenKey(handle:handle, key:key, mode:MAXIMUM_ALLOWED); if(!isnull(key_h)) { version = NULL; info = RegQueryInfoKey(handle:key_h); for (i=0; i< install_type_data) set_kb_item(name:"SMB/ServerCore", value:TRUE); else set_kb_item(name:"SMB/ServerCore", value:FALSE); } else { # ServerCore is always present and set to 1 even in the full server install. # Both Server-Gui-Mgmt and Server-Gui-Shell are optional and may not be present. # If all 3 are present then Server Core is not configured, but the full server. # If NanoServer is present than it is a Nano install. # Nano is only for 2016 and newer. # check for keys under ServerLevels key = "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels"; item = "ServerCore"; core_data = get_key(key:key, item:item); if(core_data == 1) { # we check for the other registry registry entries items = make_list("Server-Gui-Mgmt", "Server-Gui-Shell"); i = 0; data = NULL; foreach item (items) { data = get_key(key:key, item:item); if(isnull(data)) break; else if(data == 1) i++; } if(i < 2) set_kb_item(name:"SMB/ServerCore", value:TRUE); else set_kb_item(name:"SMB/ServerCore", value:FALSE); } } if("Server 2012" >!< productname) { item="NanoServer"; data = get_key(key:key, item:item); if(data == 1) set_kb_item(name:"SMB/NanoServer", value:TRUE); else set_kb_item(name:"SMB/NanoServer", value:FALSE); } } key = "SOFTWARE\Microsoft\Fpc"; item = "InstallDirectory"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Fpc", value:data); key = "SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}"; item = "IsInstalled"; data = get_key(key:key, item:item); if(data) { item = "Version"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/WindowsMediaPlayer", value:data); } key = "SOFTWARE\Microsoft\MediaPlayer"; item = "Installation Directory"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/WindowsMediaPlayer_path", value:data); key = "SOFTWARE\Microsoft\Shared Tools\Web Server Extensions\5.0"; item = "Location"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"Frontpage/2002/path", value:data); key = "SOFTWARE\Microsoft\Internet Explorer"; item = "Version"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Internet Explorer/Version", value:data); key = "SOFTWARE\Microsoft\Internet Explorer\Version Vector"; item = "IE"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Internet Explorer/Version Vector/IE", value:data); key = "SOFTWARE\Policies\Microsoft\Internet Explorer\Main"; item = "NotifyDisableIEOptions"; data = get_key(key:key, item:item); if(!isnull(data)) set_kb_item(name:"SMB/InternetExplorerDisabled", value:TRUE); else set_kb_item(name:"SMB/InternetExplorerDisabled", value:FALSE); key = "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings"; item = "MinorVersion"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Internet Settings/MinorVersion", value:data); key = "SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{03D9F3F2-B0E3-11D2-B081-006008039BF0}"; item = "Compatibility Flags"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Internet Explorer/ActiveX Compatibility/{03D9F3F2-B0E3-11D2-B081-006008039BF0}", value:data); key = "SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00000566-0000-0010-8000-00AA006D2EA4}"; item = "Compatibility Flags"; data = get_key(key:key, item:item); if(data) set_kb_item(name:"SMB/Registry/HKLM/SOFTWARE/Microsoft/Internet Explorer/ActiveX Compatibility/{00000566-0000-0010-8000-00AA006D2EA4}/Compatibility Flags", value:data); key = "SOFTWARE\Microsoft\MSSQLServer\SQLServerAgent\SubSystems"; item = "CmdExec"; data = get_key(key:key, item:item); if(data ) { path = ereg_replace(pattern:"^([A-Za-z]:.*)\\sqlcmdss\.(DLL|dll).*", replace:"\1", string:data); if(path) set_kb_item (name:"MSSQL/Path", value:path); } set_kb_item(name:"SMB/Registry/Enumerated", value:TRUE); NetUseDel(close:TRUE);

Query Builder