shadowbrokers-exploits/windows/Resources/Dsz/Commands/CommandLine/RegistryDelete_Command.xml
2017-04-14 11:45:07 +02:00

78 lines
2.4 KiB
XML

<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<Plugin providerName='Tasking/Mcl_Cmd_RegistryKeys_Tasking.pyo' providerType='script'>
<Command id="1" name="RegistryDelete">
<Input>
<Option name="hive" optional="false">
<Help>Which hive to use</Help>
<Help>U - HKEY_USERS</Help>
<Help>L - HKEY_LOCAL_MACHINE</Help>
<Help>C - HKEY_CURRENT_USER</Help>
<Help>G - HKEY_CURRENT_CONFIG</Help>
<Help>R - HKEY_CLASSES_ROOT</Help>
<Argument name="h" optional="false">
<Value string="u">
<Set data="hive" value="1" />
</Value>
<Value string="l">
<Set data="hive" value="2" />
</Value>
<Value string="c">
<Set data="hive" value="3" />
</Value>
<Value string="g">
<Set data="hive" value="4" />
</Value>
<Value string="r">
<Set data="hive" value="5" />
</Value>
</Argument>
</Option>
<Option name="key" optional="false">
<Help>The key for deletion</Help>
<Argument data="key" name="k" optional="false" />
</Option>
<Option name="value" optional="true" group="type">
<Help>The value to delete. An empty string deletes the (Default) value.</Help>
<Argument data="value" name="v" optional="false" />
</Option>
<Option name="recursive" optional="true" group="type">
<Help>Also delete any subkeys</Help>
<Set data="recursive" value="true" />
</Option>
<Option name='target' optional='true'>
<Argument name='machine' data='remote' />
</Option>
<Option name='wow64' optional='true' group='wow'>
<Help>On 64-bit Windows, work on the 64-bit Software keys</Help>
<Set data="wowtype" value="1" />
</Option>
<Option name='wow32' optional='true' group='wow'>
<Help>On 64-bit Windows, work on the 32-bit Software keys</Help>
<Set data="wowtype" value="2" />
</Option>
<Option name='method' optional='true'>
<Help>Specifies file access method - will use current default if not specified.</Help>
<Argument name='method' data='method'/>
</Option>
</Input>
<Output>
<Data name="hive" type="uint8_t" default="0" />
<Data name="key" type="string" />
<Data name="value" type="string" />
<Data name="recursive" type="bool" default="false" />
<Data name='remote' type='string' />
<Data name='wowtype' type='uint8_t' />
<Data name='method' type='string'/>
</Output>
</Command>
</Plugin>