{"id":4726,"date":"2018-04-01T22:22:09","date_gmt":"2018-04-01T22:22:09","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=4726"},"modified":"2018-04-01T22:22:09","modified_gmt":"2018-04-01T22:22:09","slug":"regedit-exe-and-a-possible-race-condition","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/04\/01\/regedit-exe-and-a-possible-race-condition\/","title":{"rendered":"Regedit.exe and a possible race condition"},"content":{"rendered":"<p>Regedit.exe accepts two less known command line arguments:<\/p>\n<ul>\n<li>regserver<\/li>\n<li>unregserver<\/li>\n<\/ul>\n<p>When launched with any of these it will call the advpack.dll!RegInstallW function passing to it one of the section names (called RegExe or UnregExe respectively) that are defined inside the .inf file embedded directly in the regedit.exe file:<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/04\/regedit1.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter wp-image-4727\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/04\/regedit1.png\" alt=\"\" width=\"500\" height=\"280\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/04\/regedit1.png 840w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/04\/regedit1-300x168.png 300w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2018\/04\/regedit1-768x430.png 768w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>The extracted .inf file is first saved into a temporary file with a name %Temp%\\RGI&lt;random&gt;.tmp file.<\/p>\n<p>It is then interpreted like any standard .inf file.<\/p>\n<p>One can use these commands to do at least two things:<\/p>\n<ul>\n<li>unregister regedit file association &#8211; see the pasted info below; other than damage, it may render some system repair more difficult (.reg files can&#8217;t be used)<\/li>\n<li>attempt to exploit a race condition and swap the temporary .inf file with one of attackers&#8217;, forcing regedit.exe to run the .inf file of attackers&#8217; choice; it&#8217;s a tricky one to pull of, but the possibility exists<\/li>\n<\/ul>\n<p>The Regshot diff from running the regedit \/unregserver command on a test Windows 7 system is shown below:<\/p>\n<pre>----------------------------------\r\nKeys deleted:17\r\n----------------------------------\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.reg\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.reg\\PersistentHandler\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regedit\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regedit\\shell\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regedit\\shell\\open\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regedit\\shell\\open\\command\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\DefaultIcon\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\edit\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\edit\\command\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\open\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\open\\command\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\print\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\print\\command\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\ShellEx\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\ShellEx\\{8895b1c6-b41f-4c1c-a562-0d564250836f}\r\n\r\n----------------------------------\r\nValues deleted:14\r\n----------------------------------\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.reg\\PersistentHandler\\: \"{5e941d80-bf96-11cd-b579-08002b30bfeb}\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\.reg\\: \"regfile\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regedit\\shell\\open\\command\\: \"regedit.exe %1\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regedit\\: \"Registration Entries\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\edit\\command\\: *%SystemRoot%&amp;#x5C;system32&amp;#x5C;notepad.exe \"%1\"*\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\open\\command\\: \"regedit.exe \"%1\"\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\print\\command\\: *%SystemRoot%&amp;#x5C;system32&amp;#x5C;notepad.exe \/p \"%1\"*\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\open\\: \"Mer&amp;#x26;ge\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\shell\\open\\MUIVerb: \"@regedit.exe,-310\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\ShellEx\\{8895b1c6-b41f-4c1c-a562-0d564250836f}\\: \"{1531d583-8375-4d3f-b5fb-d23bbd169f22}\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\DefaultIcon\\: \"regedit.exe,1\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\EditFlags: 0x00100000\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\: \"Registration Entries\"\r\nHKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\regfile\\FriendlyTypeName: \"@regedit.exe,-309\"\r\n\r\n\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Regedit.exe accepts two less known command line arguments: regserver unregserver When launched with any of these it will call the advpack.dll!RegInstallW function passing to it one of the section names (called RegExe or UnregExe respectively) that are defined inside the &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2018\/04\/01\/regedit-exe-and-a-possible-race-condition\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[43,58],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4726"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=4726"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4726\/revisions"}],"predecessor-version":[{"id":4728,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/4726\/revisions\/4728"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=4726"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=4726"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=4726"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}