利用_winreg模块在注册表中分析无线访问热点

 _winreg.OpenKey(key, sub_key, res, sam)     key是一个已经打开的键，或者是HKEY_CLASSES_ROOT、HKEY_CURRENT_USER、HKEY_LOCAL_MACHINE、HKEY_USERS、HKEY_PERFORMANCE_DATA、HKEY_CURRENT_CONFIG这些中的一个。

_winreg.EnumKey(key, index)  　　　　　　　枚举键，key is an already open key, or any one of the predefined HKEY_* constants.index is an integer that identifies the index of the key to retrieve.

 _winreg.EnumValue(key, index)　　　　　　 枚举一个一打开的注册表键值，返回元组

for i in range(1,6):
     print EnumValue(netKey,i)
'''
输出结果：
('Description', u'xiaoming', 1)
('Source', 8, 4)
('DnsSuffix', u'workgroup', 1)
('FirstNetwork', u'xiaoming', 1)
('DefaultGatewayMac', '\xb0\xd5\x9d0\x94\xa2', 3)
'''

 提取无线访问热点名称及Mac地址：

#coding=utf-8
from _winreg import *

def va12addr(val):
    addr=""
    for ch in val:
        addr += ("%02x " %ord(ch))
    addr = addr.strip(' ').replace(" ",":")[0:17]
    return addr

def printNets():
    net ="SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged"
    key = OpenKey(HKEY_LOCAL_MACHINE,net, 0, KEY_READ | KEY_WOW64_64KEY)
　　　　#我用的是32-bit Python on 64-bit Windows，所以要加KEY_READ | KEY_WOW64_64KEY这一参数，否则运行失败
    print '\n[+] Networks You have Joined.'　　　　　　　　　　　　　　　　　　
    for i in range(100):
        try:
            guid = EnumKey(key,i)
            #print guid
            netKey = OpenKey(key,str(guid))
            # for i in range(1,6):
            #     print EnumValue(netKey,i)
            (n,name,t) = EnumValue(netKey,1)
            (n,addr,t) = EnumValue(netKey,5)
            macAddr = va12addr(addr)
            netName = str(name)
            print '[+] '+netName +' '+macAddr
            CloseKey(netKey)
        except Exception ,e:
            print e
            pass

def main():
    printNets()
if __name__=='__main__':
    main()

 运行结果:

[+] Networks You have Joined.

[+] xiaoming b0:d5:9d:30:94:a2
[+] ahu.portal 48:fd:8e:30:5e:d6
[+] asdfghjkl e8:cd:2d:23:10:f7
[+] qizi? c2:14:3d:da:e1:07

参考资料：Violent Python A Cookbook for Hackers, Forensic Analysts, Penetration Testers and Security Engineers ,TJ O'Connor

　　　　http://stackoverflow.com/questions/28128446/how-do-i-use-python-to-retrieve-registry-values