Re: [Plugins-writers] Re: plugin that displays contents of Run, RunOnce, etc

Previous message: Scott Sibert: "[Plugins-writers] Re: plugin that displays contents of Run, RunOnce, etc"
In reply to: Scott Sibert: "[Plugins-writers] Re: plugin that displays contents of Run, RunOnce, etc"
Next in thread: Scott Sibert: "Re: [Plugins-writers] Re: plugin that displays contents of Run, RunOnce, etc"
Reply: Scott Sibert: "Re: [Plugins-writers] Re: plugin that displays contents of Run, RunOnce, etc"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

deraison@private

On Fri, Sep 17, 2004 at 09:11:57AM -0400, Scott Sibert wrote:
> I just saw Renaud's email helping someone read a network registry
> folder.  I'm going to take his example and try to modify it for the
> Run and RunOnce folders.  I don't know nasl but I've done a lot of
> programming in the past.

If can wait a little, I was hoping to write a plugin which would gather
various information about the remote host and display it in one alert
(see it as an "ID card" of the remote Windows host) 

For instance, the plugin would display :

- HostName
- Windows Version
- Service Pack

- Version of :
	WinWord.exe
 	Excel.exe
	PowerPoint.exe

	Mozilla
	FireFox
	Thunderbird
	Opera

	(probably other)

- Content of some keys :

	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
		- item:value
		- item:value
		- ...
	HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
		- item:value
		- item:value
		- ...

	HKLM\SOFTWARE
		- item
		- item

- List of installed hotfixes :	
		Q12345
		Q12356
		...

The idea is to have a single plugin doing a lot of registry digging,
store the results in the KB, then let all the other plugins use 
the results (like I already did with smb_hotfixes.nasl /
smb_hotfixes.inc which divided the number of connections to port 139 
by a factor of 2).

				-- Renaud
_______________________________________________
Plugins-writers mailing list
Plugins-writers@private
http://mail.nessus.org/mailman/listinfo/plugins-writers