So in this demo,
we will download RegRipper from GitHub and run it against the
SYSTEM registry hive to profile the system.
RegRipper plugins is where all the action is happening,
and we will go over the plugin structure,
and I will also show you how to create plugin profiles,
which is basically executing more than one plugin against a registry hive.
For this demo,
we will be performing analysis on a Windows 10 system that was
reported to be behaving suspiciously by the user.
Welcome to the demo environment.
To make things simple,
I have copied the registry hives from the user system to this location.
Here, we have the SAM, SYSTEM, SECURITY, SOFTWARE, and NTUSER.DAT hives.
Now, let's open the browser and download RegRipper.
It is available at github.com/keydet89.
You can see here, RegRipper3.0 is the latest one, released in May 2020.
Harlan is very active with plugins development,
so it is a good idea to keep checking here and updating your copy.
As for documentation, there isn't much available here,
but honestly,
it's not really required as the RegRipper plugins are
returned really comprehensively.
So let's download it now.
I will save it on my desktop, and now we can extract it here.
There is no installation for RegRipper as it has
been compiled into a portable EXE.
RegRipper comes with two utilities, GUI and command line.
Rr.exe is the GUI utility, and rip.exe is the common‑line utility.
You can use either of these.
Now, let's open Command Prompt.
This is a nice little trick.
If you want to open the Command Prompt from your
current location In File Explorer, just type cmd and hit Enter.
Rip.exe will show you the help,
so the important switches are ‑r for registry hive
and ‑p for the plugin to be used.
So whenever you begin analyzing data from any system,
first step is to make sure you have data from the right system.
This can be done by checking the hostname from the Windows registry.
So let's rip again and ‑r for registry hive,
and this is the location of the hive, Desktop,
Case Evidence, and then SYSTEM registry hive,
‑p, and then compname plugin.
The ComputerName and Hostname values are given as output,
so we can confirm that we have acquired data from the right system.
Now,
let's go back to the plugins folder in RegRipper and open
the plugin compname.pl that we just used.
So the plugins for RegRipper are returning Perl and follow a similar format.
There is a description and change log at the start of the plugin.
Every plugin uses a different hive and registry keys depending on the purpose.
So in this case,
it uses the SYSTEM_Hive and the registry keys used
by this plugin are ControlSet001, Control\\ComputerName,
and the other one is Services\\Tcpip\\Parameters.
Now, let's get back to our command line,
and I will again use rip.exe and use the ‑l option that
will list all the available plugins.
So here, it has 251 plugins.
These are the same plugins that we saw in the plugins directory.
Now, I can also add ‑c here to export the list of plugins to a CSV file,
plugins.csv.
So let's open the file plugins.csv, and here,
all the information regarding the plugins is available,
nicely formatted.
We have the plugin name, version, the registry hive it uses,
and a short description of the plugin,
but we do not have the registry keys that each of the plugin uses.
So if you want to map the plugins to registry keys,
there is a good resource on the internet,
just google Hexacorn RegRipper keys, open this link,
and click Buy Plugin File Name.
Here,
they have already mapped all of the RegRripper
plugins to the exact registry keys, so let's search for the plugin compname.pl.
Here, you can see these are the two or registry keys the plugin compname uses.
This resource comes in very handy when you are aware of the registry key
and want to know if there is a RegRipper plugin for it.
As I said before, RegRipper also comes with a GUI utility, just open rr.exe.
This is pretty simple to use.
Just load the registry hive that you want to analyze,
which is the SYSTEM_Hive here, and the output file location,
and name it SYSTEM_Hive, and just click on Rip!
What this does is, first,
detect the type of registry hive we have given as input.
For example, here, since it is a SYSTEM_Hive,
it will only execute the plugins related to SYSTEM_Hive.
As you can see,
it is going to take some time since there are over 50
plugins only related to SYSTEM registry hive.
Once this is done, we can go back and open the output file SYSTEM_Hive,
which is in text format.
So basically,
this is the output from all the plugins that were run
sequentially against the SYSTEM_Hive.
Let's again search for compname plugin.
And here, we can see the same hostname we saw previously.
So we also have a command for the same function.
The equivalent command for this is rip.exe ‑r,
then the SYSTEM_Hive, and then ‑f for system profile.
This command will get you the exact same output we got from the GUI
utility by running all the system‑related plugins.
So what exactly are plugin profiles?
Profiles are the flat files that are available in the plugins directory.
These are predefined profiles in RegRipper,
but we can also create our own profiles with a customized set of plugins.
Let's open the system profile.
Here,
you can see it only contains the name of all the plugins
that need to be executed by RegRipper.
So let's go ahead and create a plugin profile.
Let's add a few plugins here, compname, ips,
environment, macaddr, shutdown, networksetup2,
rdpport.
Now, we have to save it in the plugins directory.
I'll name this as mysystem.
Now, let's run this profile on this SYSTEM registry hive.
I'll add ‑f and then the profile name mysystem.
So RegRipper will execute all of the plugins in sequential order.
First is the Hostname and ComputerName.
The next plugin, ips, will get the IP address of the system.
Then the environment plugin will get all the
environment variables on the system.
Macaddr plugin will give you the mac address of the internet network interface.
Shutdown plugin will give you the last shutdown time of the system.
Networksetup2 plugin is an important one.
As you can see, the different types of network adaptors present on the system.
And finally,
the plugin rdpport will check the RDP port that is enabled on the system,
which here is 3389.
So now, we have profiled the system,
but we also need to find the Windows version on the system,
so now we will use this SOFTWARE registry hive,
and use the plugin winver, and execute it.
Winver plugin, not only gives us the Windows OS version,
but also the install date for the system.
So in this way,
we can use RegRipper to profile the system before beginning the analysis.