[Plugins-writers] Sucking the Machine Name out of the Registry

Previous message: Jayanth Purushottam: "[Plugins-writers] Re: Yahoo! Messenger"
Next in thread: George Theall: "Re: [Plugins-writers] Sucking the Machine Name out of the Registry"
Reply: George Theall: "Re: [Plugins-writers] Sucking the Machine Name out of the Registry"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

john@private

I'm playing around with a plugin to grab the Windows machine name out of the 
registry.  I'm a bit new to NASL, and not much of a coder to be honest, but 
learning...

I took Renaud's plugin for winreg checking (10431) as a template and went 
after the 
HKLM\System\CurrentControlSet\Control\ComputerName\ComputerName\ComputerName 
key-item.  My question comes with how to display the results back through 
the reporting engine.

Currently, we don't get good results with the port 137 Netbios plugin due to 
some hit and miss on having port 137 available.  But all our registry 
munging works fine.  Rather than handling this with scripting after the 
Nessus report is exported, I thought a plugin would be better, and the 
registry is obviously the authoritative place to grab this information.

In the documentation under section 3.2.4 there is a "get_host_name", but I'm 
guessing this is a reverse DNS lookup, rather than an RPC call.

Any comments are appreciated.  I realize this probably involves storing the 
information in the KB, but not sure how we push information out to the 
report.

Draft script attached.

Thanks,

-John