Mailing List Archive

Hi All,
Can anyone give me some tips on reading registry keys from Windows
boxes using NASL? I am wanting to check machines to see if they have a
specific patch installed. I know the registry key I need and the actual
item name, but I cannot get it to return the value of the item.

The script is functioning as it returns the text etc to the report but
I cannot get the value held in the registry key item. Here is the code
I am using if it helps. I have left of the description section since
it's not part of the problem.

Any suggestions would be greatly appreciated.

Leigh

<----------- Code Start Here -------------------->

include("smb_func.inc");

name = kb_smb_name();
login = kb_smb_login();
pass = kb_smb_password();
domain = kb_smb_domain();
port = kb_smb_transport();

if ( ! get_port_state(port) ) exit(1);
soc = open_sock_tcp(port);
if ( ! soc ) exit(1);

session_init(socket:soc, hostname:name);
r = NetUseAdd(login:login, password:pass, domain:domain,
share:"IPC$");
if ( r != 1 ) exit(1);

hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
if ( isnull(hklm) )
{
NetUseDel();
exit(1);
}

vuln = 0;

key = "SOFTWARE\Microsoft\Updates\Windows XP\SP3\KB912919";
item = "InstalledDate";

key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
report = "MicroSoft Security Patch KB912919 Check: " + key_h;
security_note(port:port, data:report);
if ( ! isnull(key_h) )
{
value = RegQueryValue(handle:key_h, item:item);

if (!isnull (value))
{
vuln = 1;
report = "Security Patch Install Date is: " + value;
security_note(port:port, data:report);
} else {
report = "Patch Install Date Not Available;";
security_note(port:port, data:report);
}

RegCloseKey (handle:key_h);
}

_______________________________________________
Plugins-writers mailing list
Plugins-writers@list.nessus.org
http://mail.nessus.org/mailman/listinfo/plugins-writers