Lab 8.4: Registre Windows et Persistence

Objectifs d'Apprentissage

A la fin de ce laboratoire, vous serez capable de:

Naviguer et manipuler le registre Windows
Comprendre les cles importantes pour la securite
Detecter les modifications suspectes du registre
Identifier les mecanismes de persistence via registre

Duree Estimee

50 minutes

Prerequis

VM Windows 10/11
Droits administrateur
Lab 7.2 complete (persistence)

Contexte Professionnel

Le registre Windows est:

La base de donnees de configuration centrale
Une cible privilegiee pour la persistence des malwares
Un element cle a surveiller en securite

Etape 1.1: Structure du registre

Le registre est organise en ruches (hives):

Ruche	Alias	Contenu
HKEY_LOCAL_MACHINE	HKLM	Configuration systeme
HKEY_CURRENT_USER	HKCU	Configuration utilisateur courant
HKEY_USERS	HKU	Tous les profils utilisateurs
HKEY_CLASSES_ROOT	HKCR	Associations de fichiers
HKEY_CURRENT_CONFIG	HKCC	Configuration materielle actuelle

Etape 1.2: Acces via PowerShell

# Les ruches sont accessibles comme des lecteurs
Get-PSDrive -PSProvider Registry

# Navigation
Set-Location HKLM:\SOFTWARE
Get-ChildItem

# Retour
Set-Location C:\

Etape 1.3: Lire des valeurs

# Lire une cle entiere
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion"

# Lire une valeur specifique
(Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion").ProductName

# Valeur avec Get-ItemPropertyValue
Get-ItemPropertyValue "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" -Name ProductName

Etape 1.4: Modifier le registre

# Creer une cle
New-Item -Path "HKCU:\Software\LabTest" -Force

# Creer/modifier une valeur
Set-ItemProperty -Path "HKCU:\Software\LabTest" -Name "TestValue" -Value "Hello World"
Set-ItemProperty -Path "HKCU:\Software\LabTest" -Name "TestNumber" -Value 42 -Type DWord

# Verifier
Get-ItemProperty "HKCU:\Software\LabTest"

# Supprimer
Remove-ItemProperty -Path "HKCU:\Software\LabTest" -Name "TestValue"
Remove-Item -Path "HKCU:\Software\LabTest" -Recurse

Question 1: Pourquoi utilise-t-on -Type DWord pour les nombres?

Partie 2: Cles de Securite Importantes

Etape 2.1: Cles Run (Auto-demarrage)

Ces cles executent des programmes automatiquement:

# Afficher toutes les cles Run
Write-Host "=== CLES RUN ===" -ForegroundColor Cyan

$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunServices",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce"
)

foreach ($key in $runKeys) {
    Write-Host "`n$key" -ForegroundColor Yellow
    if (Test-Path $key) {
        Get-ItemProperty $key | Format-List
    } else {
        Write-Host "  (n'existe pas)"
    }
}

Etape 2.2: Cles de services

# Services enregistres
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" | 
    Select-Object -First 10 |
    ForEach-Object {
        $svc = Get-ItemProperty $_.PSPath
        [PSCustomObject]@{
            Name = $_.PSChildName
            DisplayName = $svc.DisplayName
            ImagePath = $svc.ImagePath
            Start = $svc.Start
        }
    } | Format-Table -AutoSize

Etape 2.3: Cles de securite

# Parametres de securite LSA
Write-Host "=== LSA Security ===" -ForegroundColor Cyan
Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -ErrorAction SilentlyContinue

# RunAsPPL (protection LSASS)
$runAsPPL = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "RunAsPPL" -ErrorAction SilentlyContinue
if ($runAsPPL.RunAsPPL -eq 1) {
    Write-Host "LSA Protection: ACTIVE" -ForegroundColor Green
} else {
    Write-Host "LSA Protection: INACTIVE" -ForegroundColor Red
}

# WDigest (credentials en clair)
Write-Host "`n=== WDigest ===" -ForegroundColor Cyan
$wdigest = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest" -Name "UseLogonCredential" -ErrorAction SilentlyContinue
if ($wdigest.UseLogonCredential -eq 1) {
    Write-Host "WDigest credentials en clair: ACTIVE (DANGER!)" -ForegroundColor Red
} else {
    Write-Host "WDigest credentials en clair: DESACTIVE" -ForegroundColor Green
}

Etape 2.4: Associations de fichiers

# Verifier les associations (utilisees pour hijacking)
Write-Host "=== Associations dangereuses ===" -ForegroundColor Cyan

$extensions = @(".exe", ".bat", ".cmd", ".ps1", ".vbs", ".js")

foreach ($ext in $extensions) {
    $assoc = (Get-ItemProperty "HKCR:\$ext" -ErrorAction SilentlyContinue).'(default)'
    if ($assoc) {
        $command = (Get-ItemProperty "HKCR:\$assoc\shell\open\command" -ErrorAction SilentlyContinue).'(default)'
        Write-Host "$ext -> $assoc -> $command"
    }
}

Partie 3: Detection de Persistence

Etape 3.1: Script de detection complet

<#
.SYNOPSIS
    Detection des mecanismes de persistence via registre
#>

Write-Host @"
==============================================
     DETECTION PERSISTENCE REGISTRE
==============================================
"@ -ForegroundColor Cyan

$findings = @()

# 1. Cles Run
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

Write-Host "`n[1/5] Analyse des cles Run..." -ForegroundColor Yellow

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $props = Get-ItemProperty $key -ErrorAction SilentlyContinue
        $props.PSObject.Properties | Where-Object {
            $_.Name -notmatch "^PS"
        } | ForEach-Object {
            $value = $_.Value
            
            # Criteres de suspicion
            $suspicious = $false
            $reasons = @()
            
            if ($value -match "\\Temp\\|\\AppData\\Local\\Temp") {
                $suspicious = $true
                $reasons += "Chemin Temp"
            }
            if ($value -match "-[Ee]ncoded|-[Ww]indowStyle\s+[Hh]idden") {
                $suspicious = $true
                $reasons += "Arguments suspects"
            }
            if ($value -match "powershell.*-[Cc]ommand") {
                $suspicious = $true
                $reasons += "PowerShell inline"
            }
            
            $findings += [PSCustomObject]@{
                Type = "Run Key"
                Location = $key
                Name = $_.Name
                Value = $value.Substring(0, [Math]::Min(80, $value.Length))
                Suspicious = $suspicious
                Reasons = ($reasons -join ", ")
            }
        }
    }
}

# 2. Services dans des chemins suspects
Write-Host "[2/5] Analyse des services..." -ForegroundColor Yellow

Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Services" -ErrorAction SilentlyContinue | ForEach-Object {
    $svc = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
    if ($svc.ImagePath -match "\\Temp\\|\\AppData\\|\\Downloads\\") {
        $findings += [PSCustomObject]@{
            Type = "Service"
            Location = $_.PSPath
            Name = $_.PSChildName
            Value = $svc.ImagePath
            Suspicious = $true
            Reasons = "Chemin suspect"
        }
    }
}

# 3. Shell Extensions
Write-Host "[3/5] Analyse des Shell Extensions..." -ForegroundColor Yellow

$shellExt = @(
    "HKCU:\Software\Classes\*\shellex\ContextMenuHandlers",
    "HKLM:\Software\Classes\*\shellex\ContextMenuHandlers"
)

foreach ($key in $shellExt) {
    if (Test-Path $key) {
        Get-ChildItem $key -ErrorAction SilentlyContinue | ForEach-Object {
            $handler = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
            $clsid = $handler.'(default)'
            
            if ($clsid -and $clsid -match "^\{") {
                # Verifier si le CLSID existe
                $clsidPath = "HKCR:\CLSID\$clsid"
                if (-not (Test-Path $clsidPath)) {
                    $findings += [PSCustomObject]@{
                        Type = "Shell Extension"
                        Location = $_.PSPath
                        Name = $_.PSChildName
                        Value = $clsid
                        Suspicious = $true
                        Reasons = "CLSID manquant"
                    }
                }
            }
        }
    }
}

# 4. AppInit_DLLs
Write-Host "[4/5] Verification AppInit_DLLs..." -ForegroundColor Yellow

$appInit = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows" -Name "AppInit_DLLs" -ErrorAction SilentlyContinue
if ($appInit.AppInit_DLLs) {
    $findings += [PSCustomObject]@{
        Type = "AppInit_DLLs"
        Location = "HKLM:\...\Windows"
        Name = "AppInit_DLLs"
        Value = $appInit.AppInit_DLLs
        Suspicious = $true
        Reasons = "DLL injection au demarrage"
    }
}

# 5. Image File Execution Options (Debugger)
Write-Host "[5/5] Verification IFEO..." -ForegroundColor Yellow

Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" -ErrorAction SilentlyContinue | ForEach-Object {
    $ifeo = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
    if ($ifeo.Debugger) {
        $findings += [PSCustomObject]@{
            Type = "IFEO Debugger"
            Location = $_.PSPath
            Name = $_.PSChildName
            Value = $ifeo.Debugger
            Suspicious = $true
            Reasons = "Debugger defini"
        }
    }
}

# Rapport
Write-Host "`n==============================================`n" -ForegroundColor Cyan

$suspiciousFindings = $findings | Where-Object { $_.Suspicious }

if ($suspiciousFindings.Count -eq 0) {
    Write-Host "[OK] Aucune persistence suspecte detectee" -ForegroundColor Green
} else {
    Write-Host "[!] $($suspiciousFindings.Count) element(s) suspect(s) detecte(s):" -ForegroundColor Red
    $suspiciousFindings | Format-Table Type, Name, Reasons -AutoSize
    
    Write-Host "`nDetails:" -ForegroundColor Yellow
    $suspiciousFindings | ForEach-Object {
        Write-Host "`n  Type: $($_.Type)" -ForegroundColor Cyan
        Write-Host "  Nom: $($_.Name)"
        Write-Host "  Valeur: $($_.Value)"
        Write-Host "  Raisons: $($_.Reasons)" -ForegroundColor Yellow
    }
}

# Resume des entrees normales
Write-Host "`n==============================================`n" -ForegroundColor Cyan
$normalFindings = $findings | Where-Object { -not $_.Suspicious }
Write-Host "Entrees normales detectees: $($normalFindings.Count)"

Question 2: Le script a-t-il detecte des elements suspects sur votre VM?

Partie 4: Exercice Pratique

Etape 4.1: Creer une persistence de test

# ATTENTION: A des fins de test uniquement!
# Creez une entree Run pour comprendre le mecanisme

# Creer une entree inoffensive
Set-ItemProperty `
    -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" `
    -Name "LabTestPersistence" `
    -Value "cmd.exe /c echo Test de persistence > C:\Temp\persistence_test.txt"

Write-Host "Entree de test creee" -ForegroundColor Yellow

Etape 4.2: Detecter la persistence

# Executez le script de detection
# Votre entree devrait etre detectee

# Verifier manuellement
Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Select-Object LabTestPersistence

Etape 4.3: Nettoyer

# Supprimer l'entree de test
Remove-ItemProperty `
    -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" `
    -Name "LabTestPersistence" `
    -ErrorAction SilentlyContinue

Write-Host "Nettoyage termine" -ForegroundColor Green

Partie 5: Sauvegarde et Restauration

Etape 5.1: Exporter une cle

# Exporter une cle
$exportPath = "$env:USERPROFILE\Desktop\backup_run_keys.reg"
reg export "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" $exportPath /y

Write-Host "Cle exportee vers: $exportPath" -ForegroundColor Green

Etape 5.2: Script de sauvegarde automatique

# Sauvegarde des cles de securite importantes
$backupFolder = "$env:USERPROFILE\Desktop\RegistryBackup_$(Get-Date -Format 'yyyyMMdd')"
New-Item -Path $backupFolder -ItemType Directory -Force | Out-Null

$keysToBackup = @(
    @{Path = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"; Name = "HKLM_Run"},
    @{Path = "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"; Name = "HKCU_Run"},
    @{Path = "HKLM\SYSTEM\CurrentControlSet\Control\Lsa"; Name = "LSA"},
    @{Path = "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"; Name = "Windows"}
)

foreach ($key in $keysToBackup) {
    $file = Join-Path $backupFolder "$($key.Name).reg"
    reg export $key.Path $file /y 2>$null
    if ($?) {
        Write-Host "[OK] $($key.Name)" -ForegroundColor Green
    } else {
        Write-Host "[ERREUR] $($key.Name)" -ForegroundColor Red
    }
}

Write-Host "`nSauvegarde terminee: $backupFolder" -ForegroundColor Cyan

Livrables

Reponses aux 2 questions
Captures d'ecran:
- Navigation dans le registre
- Script de detection execute
- Persistence de test creee et detectee
Script de detection personnalise
Rapport (1 page):
- Cles de registre importantes
- Risques identifies
- Recommandations de surveillance

Criteres d'Evaluation

Critere	Points
Navigation registre	20%
Cles de securite	25%
Script de detection	35%
Exercice pratique	20%

Commandes de Reference

# Lecture
Get-ItemProperty "HKLM:\chemin"
Get-ItemPropertyValue "HKLM:\chemin" -Name "valeur"

# Ecriture
Set-ItemProperty -Path "chemin" -Name "nom" -Value "valeur"
New-Item -Path "chemin" -Force

# Suppression
Remove-ItemProperty -Path "chemin" -Name "nom"
Remove-Item -Path "chemin" -Recurse

# Export (via reg.exe)
reg export "HKLM\chemin" fichier.reg /y
reg import fichier.reg

Ressources

Lab developpe dans le cadre du cours Systemes d'Exploitation - MODULE 8

Objectifs d'Apprentissage​

Duree Estimee​

Prerequis​

Contexte Professionnel​

Partie 1: Navigation dans le Registre​

Etape 1.1: Structure du registre​

Etape 1.2: Acces via PowerShell​

Etape 1.3: Lire des valeurs​

Etape 1.4: Modifier le registre​

Partie 2: Cles de Securite Importantes​

Etape 2.1: Cles Run (Auto-demarrage)​

Etape 2.2: Cles de services​

Etape 2.3: Cles de securite​

Etape 2.4: Associations de fichiers​

Partie 3: Detection de Persistence​

Etape 3.1: Script de detection complet​

Partie 4: Exercice Pratique​

Etape 4.1: Creer une persistence de test​

Etape 4.2: Detecter la persistence​

Etape 4.3: Nettoyer​

Partie 5: Sauvegarde et Restauration​

Etape 5.1: Exporter une cle​

Etape 5.2: Script de sauvegarde automatique​

Livrables​

Criteres d'Evaluation​

Commandes de Reference​

Ressources​