利用_winreg模块在注册表中分析无线访问热点

_winreg.OpenKey(key, sub_key, res, sam)     key是一个已经打开的键，或者是HKEY_CLASSES_ROOT、HKEY_CURRENT_USER、HKEY_LOCAL_MACHINE、HKEY_USERS、HKEY_PERFORMANCE_DATA、HKEY_CURRENT_CONFIG这些中的一个。

_winreg.EnumKey(key, index)  　　　　　　　枚举键，key is an already open key, or any one of the predefined HKEY_* constants.index is an integer that identifies the index of the key to retrieve.

_winreg.EnumValue(key, index)　　　　　　 枚举一个一打开的注册表键值，返回元组

for i in range(1,6):
     print EnumValue(netKey,i)
'''
输出结果：
('Description', u'xiaoming', 1)
('Source', 8, 4)
('DnsSuffix', u'workgroup', 1)
('FirstNetwork', u'xiaoming', 1)
('DefaultGatewayMac', '\xb0\xd5\x9d0\x94\xa2', 3)
'''

提取无线访问热点名称及Mac地址：

 #coding=utf-8
 from _winreg import *

 def va12addr(val):
     addr=""
     for ch in val:
         addr += ("%02x " %ord(ch))
     addr = addr.strip(' ').replace(" ",":")[0:17]
     return addr

 def printNets():
     net ="SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged"
     key = OpenKey(HKEY_LOCAL_MACHINE,net, 0, KEY_READ | KEY_WOW64_64KEY)
　　　　#我用的是32-bit Python on 64-bit Windows，所以要加KEY_READ | KEY_WOW64_64KEY这一参数，否则运行失败
     print '\n[+] Networks You have Joined.'　　　　　　　　　　　　　　　　　　
     for i in range(100):
         try:
             guid = EnumKey(key,i)
             #print guid
             netKey = OpenKey(key,str(guid))
             # for i in range(1,6):
             #     print EnumValue(netKey,i)
             (n,name,t) = EnumValue(netKey,1)
             (n,addr,t) = EnumValue(netKey,5)
             macAddr = va12addr(addr)
             netName = str(name)
             print '[+] '+netName +' '+macAddr
             CloseKey(netKey)
         except Exception ,e:
             print e
             pass

 def main():
     printNets()
 if __name__=='__main__':
     main()

运行结果:

[+] Networks You have Joined.

[+] xiaoming b0:d5:9d:30:94:a2
[+] ahu.portal 48:fd:8e:30:5e:d6
[+] asdfghjkl e8:cd:2d:23:10:f7
[+] qizi? c2:14:3d:da:e1:07

参考资料：Violent Python A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers ,TJ O'Connor

　　　　http://stackoverflow.com/questions/28128446/how-do-i-use-python-to-retrieve-registry-values