keydet89/regripper4.0

RegRipper4.0

regripper4.0's Issues

Strange error message when running "rip.exe -l -c" on Windows

Hi Harlan,

FYI, this is a bit odd, but when I run "rip.exe -l -c" on my Windows system, the following error gets printed whenever rip attempts to display a CSV line associated with the "sourcelist.pl" plugin. For example:

PS C:\Tools\keydet89\RegRipper4.0> .\rip.exe -l -c
Plugin,Version,Hive,MITRE ATT&CK,Category,Description
activesetup,20201230,software ntuser.dat,T1547,persistence,Get Active Setup StubPath values
...
smb,20220101,system,T1562,defense evasion,Get SMB server settings (v1; v2; v3)

Bareword found where operator expected at C:\Tools\keydet89\RegRipper4.0\plugins\sourcelist.pl line 42, near ")
::rptMsg"
(Missing operator before ::rptMsg?)
Error: syntax error at C:\Tools\keydet89\RegRipper4.0\plugins\sourcelist.pl line 42, near ")
::rptMsg"
Global symbol "$hive" requires explicit package name at C:\Tools\keydet89\RegRipper4.0\plugins\sourcelist.pl line 47.
syntax error at C:\Tools\keydet89\RegRipper4.0\plugins\sourcelist.pl line 88, near "}"
Compilation failed in require at C:\Tools\keydet89\RegRipper4.0\rip.exe line 107.**

sourcerouting,20210212,System,T1203,execution,Get Source Routing setting
...
zerologon,20200922,System,,config,Check Registry setting to protect against ZeroLogon exploit

Was the "installedcomp.pl" plugin actually intended to be distributed with RR4.0?

Hi Harlan,

Just checking in to see if you actually intended to remove the plugin "installedcomp.pl" from RR4.0, but accidentally did not?

I ask because "installedcomp.pl" is the only RR4.0 plugin that doesn't have a MITRE reference within it.

I also see another plugin named "activesetup.pl" which includes the following note within its change history "- Near-complete overhaul of installedcomp.pl plugin".

Regards!

Getting error message "Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE" when using several RR 4.0 plugins that use the module "utf8_heavy.pl"

Hello, FYI, I'm getting the following error message whenever I run any RegRipper 4.0 plugin which calls the associated Perl module:

Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

Is this due to an error in the Perl module, a problem with the registry data that I'm feeding the RR 4.0 plugins that use the module, a bug in the either the Perl module or RR 4.0 plugins that might need to be fixed, not a bug at all, or something else? Many thanks!

Here are some example runs using the plugin named "fileless.pl":

---

C:\keydet89\RegRipper4.0>rip.exe -r D:\Artifacts\RegFiles\SECURITY -p fileless
Launching fileless v.20200911
fileless v.20200911
(All) Scans a hive file looking for fileless malware entries
MITRE: T1059.001 (persistence)

Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

---

C:\keydet89\RegRipper4.0>rip.exe -r D:\Artifacts\RegFiles\SYSTEM -p fileless
Launching fileless v.20200911
fileless v.20200911
(All) Scans a hive file looking for fileless malware entries
MITRE: T1059.001 (persistence)

Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

---

C:\keydet89\RegRipper4.0>rip.exe -r D:\Artifacts\RegFiles\SAM -p fileless
Launching fileless v.20200911
fileless v.20200911
(All) Scans a hive file looking for fileless malware entries
MITRE: T1059.001 (persistence)

Use of uninitialized value $list in pattern match (m//) at PERL2EXE_STORAGE/utf8_heavy.pl line 399.

---

However, please note that this same error message pops up when using other plugins that also end up using this same module. This isn't a big issue, it's just merely an annoyance, so this is a low priority for any potential fix. Regards! Thanks for building such an awesome tool!

Regripper4.0 plugin "eventsasp.pl" is missing a Short Description

FYI, the Regripper 4.0 plugin named "eventsasp.pl" is missing a Short Description.

sub getShortDescr {
return "";
}

That is to say, the return value of its "getShortDescr" subroutine is currently blank. Instead, it should probably return something along the lines of, "Get the SOFTWARE hive keys associated with the Event Viewer Online Help system" (or similar).