MythicAgents / Apollo

A .NET Framework 4.0 Windows Agent
BSD 3-Clause "New" or "Revised" License
432 stars 90 forks source link

fixing reg_write_value #122

Closed Eternalcirno closed 1 year ago

Eternalcirno commented 1 year ago

reg_write_value command in apollo was unable to write to registry keys, kept getting unauthorized errors. Turns out to make the opened registry keys writable, a boolean value needs to be included as an argument. Since the reg_write_value uses the GetRegistryKey function to open the subkeys, we should ideally have write access to the opened subkeys, hence the change

Reference: https://learn.microsoft.com/en-us/dotnet/api/microsoft.win32.registrykey.opensubkey?view=net-7.0#microsoft-win32-registrykey-opensubkey(system-string-system-boolean)