[Solved]How to call WinApi function to change the owner of a registry key

[Zero Ray]

How do I call the SetNamedSecurityInfo_ function to change the owner of a registry key to SYSTEM?

Solved

Example

Code: Select all

EnableExplicit

#SE_REGISTRY_KEY = $4
#OWNER_SECURITY_INFORMATION = $1

Define SECURITY_NT_AUTHORITY.SID_IDENTIFIER_AUTHORITY, *pSid, tmp.i

SECURITY_NT_AUTHORITY\Value[5] = 5

If AllocateAndInitializeSid_(@SECURITY_NT_AUTHORITY, 1, 18, 0, 0, 0, 0, 0, 0, 0, @*pSid)
  RtlAdjustPrivilege_(18, 1, 0, @tmp)
  Debug SetNamedSecurityInfo_("MACHINE\SOFTWARE\ExampleRegKey", #SE_REGISTRY_KEY, #OWNER_SECURITY_INFORMATION, *pSid, #Null, #Null, #Null)
  RtlAdjustPrivilege_(18, 0, 0, @tmp)
  FreeSid_(*pSid)
EndIf

[jacdelad]

https://learn.microsoft.com/de-de/windo ... urityinfoa

Need more help?

[Zero Ray]

Can you give some examples?