diff --git a/winPEAS/winPEASexe/winPEAS/KnownFileCreds/Putty.cs b/winPEAS/winPEASexe/winPEAS/KnownFileCreds/Putty.cs index 9d9b0d4..d64ef80 100644 --- a/winPEAS/winPEASexe/winPEAS/KnownFileCreds/Putty.cs +++ b/winPEAS/winPEASexe/winPEAS/KnownFileCreds/Putty.cs @@ -88,6 +88,10 @@ namespace winPEAS.KnownFileCreds if (SID.StartsWith("S-1-5") && !SID.EndsWith("_Classes")) { string[] subKeys = RegistryHelper.GetRegSubkeys("HKU", string.Format("{0}\\Software\\SimonTatham\\PuTTY\\Sessions\\", SID)); + if (subKeys.Length == 0) + { + subKeys = RegistryHelper.GetRegSubkeys("HKU", string.Format("{0}\\Software\\SimonTatham\\PuTTY\\Sessions", SID)); + } foreach (string sessionName in subKeys) { @@ -129,6 +133,10 @@ namespace winPEAS.KnownFileCreds else { string[] subKeys = RegistryHelper.GetRegSubkeys("HKCU", "Software\\SimonTatham\\PuTTY\\Sessions\\"); + if (subKeys.Length == 0) + { + subKeys = RegistryHelper.GetRegSubkeys("HKCU", "Software\\SimonTatham\\PuTTY\\Sessions"); + } RegistryKey selfKey = Registry.CurrentUser.OpenSubKey(@"Software\\SimonTatham\\PuTTY\\Sessions"); // extract own Sessions registry keys if (selfKey != null) @@ -198,6 +206,10 @@ namespace winPEAS.KnownFileCreds if (SID.StartsWith("S-1-5") && !SID.EndsWith("_Classes")) { Dictionary hostKeys = RegistryHelper.GetRegValues("HKU", string.Format("{0}\\Software\\SimonTatham\\PuTTY\\SshHostKeys\\", SID)); + if ((hostKeys == null) || (hostKeys.Count == 0)) + { + hostKeys = RegistryHelper.GetRegValues("HKU", string.Format("{0}\\Software\\SimonTatham\\PuTTY\\SshHostKeys", SID)); + } if ((hostKeys != null) && (hostKeys.Count != 0)) { Dictionary putty_ssh = new Dictionary @@ -216,6 +228,10 @@ namespace winPEAS.KnownFileCreds else { Dictionary hostKeys = RegistryHelper.GetRegValues("HKCU", "Software\\SimonTatham\\PuTTY\\SshHostKeys\\"); + if ((hostKeys == null) || (hostKeys.Count == 0)) + { + hostKeys = RegistryHelper.GetRegValues("HKCU", "Software\\SimonTatham\\PuTTY\\SshHostKeys"); + } if ((hostKeys != null) && (hostKeys.Count != 0)) { Dictionary putty_ssh = new Dictionary();