CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-261007-WINDOWS-DACHA-64022-BRIDGE-EXACT-SOURCE-RCA-99783R1
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=windows-dacha-64022-bridge-exact-source-rca
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=29c3f3ddfe92bc5d9c1bb03713be42ea2a98feb62a5dfc18888c66feaec02ee3
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=66b16d6cb988213a72ed70a9ed3e7d0cce65c7f44b3752973ecd7e161e40042b
SANITIZED_OUTPUT_SHA256=66b16d6cb988213a72ed70a9ed3e7d0cce65c7f44b3752973ecd7e161e40042b
OUTPUT_BEGIN
WINDOWS_DACHA_64022_BRIDGE_EXACT_SOURCE_RCA=V1
MODE=read-only
NO_MUTATION=true
WINDOWS_LOCAL_INSPECT_RC=0
WINDOWS_EVIDENCE_PRESENT=true
WINDOWS_DACHA_64022_BRIDGE_EXACT_SOURCE_RCA=V1
MODE=read-only
NO_MUTATION=true
STARTUP_MATCH_COUNT=2
REC|STARTUP|IDX=1|SCRIPT_RESOLVED=true|ARGS_SANITIZED=-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "<BRIDGE_PATH>" -ListenPort 64022 -SocksPort 64020
REC|STARTUP|IDX=2|SCRIPT_RESOLVED=true|ARGS_SANITIZED=-NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "<BRIDGE_PATH>" -ListenPort 64022 -SocksPort 64020
BRIDGE_PATH_COUNT=1
REC|BRIDGE_FILE|BASENAME=bridge.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e|SIZE=5696|EXPECTED_SHA_MATCH=true
EXACT_BRIDGE_SHA_MATCH_COUNT=1
BRIDGE_LINE_COUNT=162
SRC|001|param([int]$ListenPort=64021,[int]$SocksPort=64020)
SRC|002|$ErrorActionPreference='Stop'
SRC|003|$src=@"
SRC|004|using System;
SRC|005|using System.IO;
SRC|006|using System.Net;
SRC|007|using System.Net.Sockets;
SRC|008|using System.Text;
SRC|009|using System.Threading.Tasks;
SRC|010|using System.Collections.Generic;
SRC|011|
SRC|012|public static class W2HttpSocksBridge {
SRC|013|  static int SocksPort;
SRC|014|
SRC|015|  static byte[] ReadHeaders(NetworkStream s, out int headerEnd) {
SRC|016|    var buf = new List<byte>(4096);
SRC|017|    int state=0;
SRC|018|    while (buf.Count < 65536) {
SRC|019|      int b=s.ReadByte();
SRC|020|      if (b < 0) break;
SRC|021|      buf.Add((byte)b);
SRC|022|      if (state==0 && b==13) state=1;
SRC|023|      else if (state==1 && b==10) state=2;
SRC|024|      else if (state==2 && b==13) state=3;
SRC|025|      else if (state==3 && b==10) { headerEnd=buf.Count; return buf.ToArray(); }
SRC|026|      else state=(b==13)?1:0;
SRC|027|    }
SRC|028|    headerEnd=buf.Count;
SRC|029|    return buf.ToArray();
SRC|030|  }
SRC|031|
SRC|032|  static TcpClient ConnectSocks(string host, int port) {
SRC|033|    var c=new TcpClient();
SRC|034|    c.Connect(IPAddress.Loopback,SocksPort);
SRC|035|    var s=c.GetStream();
SRC|036|    s.Write(new byte[]{5,1,0},0,3);
SRC|037|    byte[] r=new byte[2];
SRC|038|    if (s.Read(r,0,2)!=2 || r[0]!=5 || r[1]!=0) throw new IOException("SOCKS_GREETING");
SRC|039|    byte[] hb=Encoding.ASCII.GetBytes(host);
SRC|040|    if (hb.Length<1 || hb.Length>255) throw new IOException("SOCKS_HOST");
SRC|041|    using(var ms=new MemoryStream()) {
SRC|042|      ms.WriteByte(5); ms.WriteByte(1); ms.WriteByte(0); ms.WriteByte(3); ms.WriteByte((byte)hb.Length);
SRC|043|      ms.Write(hb,0,hb.Length); ms.WriteByte((byte)((port>>8)&255)); ms.WriteByte((byte)(port&255));
SRC|044|      var q=ms.ToArray(); s.Write(q,0,q.Length);
SRC|045|    }
SRC|046|    byte[] h4=new byte[4];
SRC|047|    if (s.Read(h4,0,4)!=4 || h4[0]!=5 || h4[1]!=0) throw new IOException("SOCKS_CONNECT");
SRC|048|    int remain=0;
SRC|049|    if (h4[3]==1) remain=4+2;
SRC|050|    else if (h4[3]==4) remain=16+2;
SRC|051|    else if (h4[3]==3) {
SRC|052|      int len=s.ReadByte(); if(len<0) throw new IOException("SOCKS_REPLY");
SRC|053|      remain=len+2;
SRC|054|    } else throw new IOException("SOCKS_ATYP");
SRC|055|    byte[] junk=new byte[remain];
SRC|056|    int off=0;
SRC|057|    while(off<remain) { int n=s.Read(junk,off,remain-off); if(n<=0) throw new IOException("SOCKS_REPLY_EOF"); off+=n; }
SRC|058|    return c;
SRC|059|  }
SRC|060|
SRC|061|  static void ParseHostPort(string target, int defPort, out string host, out int port) {
SRC|062|    host=target; port=defPort;
SRC|063|    if(target.StartsWith("[")) {
SRC|064|      int e=target.IndexOf(']');
SRC|065|      if(e>0) {
SRC|066|        host=target.Substring(1,e-1);
SRC|067|        if(e+1<target.Length && target[e+1]==':') int.TryParse(target.Substring(e+2),out port);
SRC|068|      }
SRC|069|      return;
SRC|070|    }
SRC|071|    int k=target.LastIndexOf(':');
SRC|072|    if(k>0 && target.IndexOf(':')==k) {
SRC|073|      int p;
SRC|074|      if(int.TryParse(target.Substring(k+1),out p)) { host=target.Substring(0,k); port=p; }
SRC|075|    }
SRC|076|  }
SRC|077|
SRC|078|  static void Relay(TcpClient a, TcpClient b) {
SRC|079|    var sa=a.GetStream(); var sb=b.GetStream();
SRC|080|    var t1=sa.CopyToAsync(sb);
SRC|081|    var t2=sb.CopyToAsync(sa);
SRC|082|    try { Task.WaitAny(t1,t2); } catch {}
SRC|083|    try { a.Close(); } catch {}
SRC|084|    try { b.Close(); } catch {}
SRC|085|  }
SRC|086|
SRC|087|  static void Handle(TcpClient client) {
SRC|088|    TcpClient upstream=null;
SRC|089|    try {
SRC|090|      var cs=client.GetStream();
SRC|091|      int hend;
SRC|092|      byte[] raw=ReadHeaders(cs,out hend);
SRC|093|      if(raw.Length==0) return;
SRC|094|      string header=Encoding.ASCII.GetString(raw,0,hend);
SRC|095|      string[] lines=header.Split(new string[]{"\r\n"},StringSplitOptions.None);
SRC|096|      string[] first=lines[0].Split(new char[]{' '},3);
SRC|097|      if(first.Length<3) return;
SRC|098|      string method=first[0], target=first[1], version=first[2];
SRC|099|      string host=null; int port=80;
SRC|100|
SRC|101|      if(method.Equals("CONNECT",StringComparison.OrdinalIgnoreCase)) {
SRC|102|        ParseHostPort(target,443,out host,out port);
SRC|103|        upstream=ConnectSocks(host,port);
SRC|104|        byte[] ok=Encoding.ASCII.GetBytes("HTTP/1.1 200 Connection Established\r\nProxy-Agent: Workers2\r\n\r\n");
SRC|105|        cs.Write(ok,0,ok.Length);
SRC|106|        Relay(client,upstream);
SRC|107|        return;
SRC|108|      }
SRC|109|
SRC|110|      Uri u;
SRC|111|      string path=target;
SRC|112|      if(Uri.TryCreate(target,UriKind.Absolute,out u)) {
SRC|113|        host=u.Host; port=u.IsDefaultPort ? (u.Scheme=="https"?443:80) : u.Port;
SRC|114|        path=String.IsNullOrEmpty(u.PathAndQuery)?"/":u.PathAndQuery;
SRC|115|      } else {
SRC|116|        foreach(string line in lines) {
SRC|117|          if(line.StartsWith("Host:",StringComparison.OrdinalIgnoreCase)) {
SRC|118|            string hv=line.Substring(5).Trim();
SRC|119|            ParseHostPort(hv,80,out host,out port);
SRC|120|            break;
SRC|121|          }
SRC|122|        }
SRC|123|      }
SRC|124|      if(String.IsNullOrEmpty(host)) return;
SRC|125|      upstream=ConnectSocks(host,port);
SRC|126|      var us=upstream.GetStream();
SRC|127|      var sb=new StringBuilder();
SRC|128|      sb.Append(method).Append(" ").Append(path).Append(" ").Append(version).Append("\r\n");
SRC|129|      for(int i=1;i<lines.Length;i++) {
SRC|130|        string line=lines[i];
SRC|131|        if(line.Length==0) continue;
SRC|132|        if(line.StartsWith("Proxy-Connection:",StringComparison.OrdinalIgnoreCase)) continue;
SRC|133|        sb.Append(line).Append("\r\n");
SRC|134|      }
SRC|135|      sb.Append("\r\n");
SRC|136|      byte[] nh=Encoding.ASCII.GetBytes(sb.ToString());
SRC|137|      us.Write(nh,0,nh.Length);
SRC|138|      Relay(client,upstream);
SRC|139|    } catch {
SRC|140|      try {
SRC|141|        byte[] er=Encoding.ASCII.GetBytes("HTTP/1.1 502 Bad Gateway\r\nContent-Length:0\r\nConnection: close\r\n\r\n");
SRC|142|        client.GetStream().Write(er,0,er.Length);
SRC|143|      } catch {}
SRC|144|      try { client.Close(); } catch {}
SRC|145|      try { if(upstream!=null) upstream.Close(); } catch {}
SRC|146|    }
SRC|147|  }
SRC|148|
SRC|149|  public static void Run(int listenPort, int socksPort) {
SRC|150|    SocksPort=socksPort;
SRC|151|    var l=new TcpListener(IPAddress.Loopback,listenPort);
SRC|152|    l.Start();
SRC|153|    while(true) {
SRC|154|      TcpClient c=l.AcceptTcpClient();
SRC|155|      Task.Run(()=>Handle(c));
SRC|156|    }
SRC|157|  }
SRC|158|}
SRC|159|"@
SRC|160|Add-Type -TypeDefinition $src -Language CSharp
SRC|161|[W2HttpSocksBridge]::Run($ListenPort,$SocksPort)
SRC|162|
PORT64022_LISTENER_COUNT=1
PORT64022_OWNER_PID_COUNT=1
OWNER_NAME=powershell.exe
OWNER_SESSION_ID=1
OWNER_COMMAND_SANITIZED="<PATH>" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "<BRIDGE_PATH>" -ListenPort 64022 -SocksPort 64020
OWNER_CMD_HAS_BRIDGE=true
OWNER_CMD_HAS_64020=true
OWNER_CMD_HAS_64022=true
REC|PROTOCOL|MODE=SOCKS5|IOBIT_RC=28|GOOGLE_RC=28
REC|PROTOCOL|MODE=SOCKS4A|IOBIT_RC=28|GOOGLE_RC=28
REC|PROTOCOL|MODE=HTTP|IOBIT_RC=0|GOOGLE_RC=0
CONTROL_64020_IOBIT_RC=0
CONTROL_64020_GOOGLE_RC=0
WINDOWS_64022_EXACT_SOURCE_COMPLETE=true
PVE_UNIT_ACTIVE=active
PVE_UNIT_ENABLED=enabled
PVE64020_LISTENER_COUNT=1
DECISION=HOLD_WINDOWS_64022_EXACT_BRIDGE_SOURCE_INCOMPLETE
NEXT_GATE=NO_MUTATION_UNTIL_EXACT_BRIDGE_PROVEN
TASK_RESULT=WINDOWS_DACHA_64022_BRIDGE_EXACT_SOURCE_RCA
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261007-WINDOWS-DACHA-64022-BRIDGE-EXACT-SOURCE-RCA-99783R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}

OUTPUT_END
CHAT_OUTPUT_END
