Writeup 4 2020 - 之江杯 - 注册表分析

知识点

WiFi信息一般在这些注册表路径中：

• SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
• SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged
• SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed

其中Profiles下面每个子项里通常有：

• ProfileName：WiFi 名称
• Description：网络描述
• Managed：是否受管
• Category：网络类别

解题技巧

如果注册表已经导出成.reg文本，直接搜索ProfileName就能看到WiFi名。

... [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{6E6D2E56-BC24-47D5-8F55-8891506C0C3F}] "ProfileName"="OPPO Reno" "Description"="OPPO Reno" "Managed"=dword:00000000 "Category"=dword:00000000 "DateCreated"=hex:e4,07,0c,00,00,00,0d,00,11,00,38,00,0d,00,53,00 "NameType"=dword:00000047 "DateLastConnected"=hex:e4,07,0c,00,00,00,0d,00,11,00,38,00,0d,00,53,00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles\{9B5BA71F-779F-4CE6-A6D4-33C2FD55317A}] "ProfileName"="网络" "Description"="网络" "Managed"=dword:00000000 "Category"=dword:00000000 "DateCreated"=hex:e4,07,0c,00,00,00,0d,00,11,00,30,00,23,00,1f,01 "NameType"=dword:00000006 "DateLastConnected"=hex:e4,07,0c,00,00,00,0d,00,11,00,33,00,1a,00,c7,03 ...

Flag

flag{OPPOReno}