Can't add REG_MULTI_SZ registry values using reg.py

[gabrielg5]

Configuration

impacket version: 0.11.0 Python version: N/A Target OS: Windows

There's no way to add multi string keys in the registry using reg.py example.

According to MS documentation https://learn.microsoft.com/en-us/windows/win32/sysinfo/registry-value-types value should be

A sequence of null-terminated strings, terminated by an empty string (\0).

Here it can be seen how winreg is handling it -> https://github.com/python/cpython/blob/main/PC/winreg.c#L660

I guess we should define a syntax on how different strings will be passed to the script.

Additional context

As a side note, reading MULTI_SZ keys is ommiting the separation. For example

└─$ python reg.py <domain>/<user>@<target> query -keyName "HKCU\TEST" -v multi
Impacket v0.12.0.dev1+20240318.182010.0d2b72ae - Copyright 2023 Fortra

Password:
HKCU\TEST
        multi   REG_MULTI_SZ     line 1line 2line3

[Marshall-Hallenbeck]

Hey just noticed this from the other issue I was tagged in. If I'm not understanding it, ignore me, but you can pass them in as a list (including data with spaces, just quote it) and parse it with argparse with the "nargs" set to "+" (or * if you want to be able to accept no data as well): https://docs.python.org/3/library/argparse.html#nargs

An example command would look like: python reg.py <domain>/<user>@<target> add -keyName <whatever> -v <whatever> -vt REG_MULTI_SZ -vd First Second 'Multi Space' Fourth

This will be a list like: ['First', 'Second' 'Multi Space', 'Fourth'] which you can then concat together with NULL strings inbetween and an empty string at the end (going off of the documentation that's what it wants).

[mubix]

An example command would look like: python reg.py <domain>/<user>@<target> add -keyName <whatever> -v <whatever> -vt REG_MULTI_SZ -vd First Second 'Multi Space' Fourth

Really like this format. @Marshall-Hallenbeck 👍

[p0dalirius]

For clarity I would have used this format:

python reg.py "<domain>/<user>@<target>" add -keyName "<whatever>" -v "<whatever>" -vt "REG_MULTI_SZ" -vd "First" -vd "Second" -vd "Multi Space" -vd "Fourth"

In my opinion this would be clearer in the command line syntax. We could use the parseargs append action, and the following line:

https://github.com/fortra/impacket/blob/269ce69872f0e8f2188a80addb0c39fedfa6dcb8/examples/reg.py#L562-L563

Would become:

    add_parser.add_argument('-vd', action='append', metavar="VALUEDATA", required=False, help='Specifies the registry '
                           'value data that is to be set.', default=[''])

What do you think?