runtime: publish SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SANITIZED-SOURCE-99758R1
This commit is contained in:
homelab-runtime-publisher
File diff suppressed because one or more lines are too long
@@ -0,0 +1,208 @@
|
|||||||
|
CHAT_OUTPUT_BEGIN
|
||||||
|
COMMAND_ID=SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SANITIZED-SOURCE-99758R1
|
||||||
|
STATUS=OK
|
||||||
|
RC=0
|
||||||
|
HOST=pve01
|
||||||
|
MODE=read-only
|
||||||
|
COMPONENT=windows-dacha-watchdog-sanitized-source
|
||||||
|
REFERENCE_REGISTER_CHECK=OK
|
||||||
|
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
|
||||||
|
ERROR_REGISTER_CHECK=OK
|
||||||
|
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
|
||||||
|
COMMAND_SHA256=82372359d1dfece3cca84734e47b1a82a17c43fb88ef3c8c418ee0f99f500497
|
||||||
|
DUPLICATE_FAILED_COMMAND_BLOCKED=false
|
||||||
|
EXECUTION_STARTED=true
|
||||||
|
CHANGE_DECLARED=false
|
||||||
|
RESULT_CONTRACT_VALID=true
|
||||||
|
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
|
||||||
|
RESULT_CONTRACT_ERROR=NONE
|
||||||
|
COMMAND_RC=0
|
||||||
|
CHANGES_MADE=false
|
||||||
|
ROLLBACK_STARTED=false
|
||||||
|
ROLLBACK_RESTORED=null
|
||||||
|
MUTATION_OUTCOME=NO_MUTATION
|
||||||
|
SANITIZED=yes
|
||||||
|
SECRETS_INCLUDED=no
|
||||||
|
PRIVATE_ADDRESSES_INCLUDED=no
|
||||||
|
RAW_EVIDENCE_SHA256=07576991b3bcf03a1f05666fc4f906e8ce3bab611b76ac9d0e0cd4f2ff28da02
|
||||||
|
SANITIZED_OUTPUT_SHA256=07576991b3bcf03a1f05666fc4f906e8ce3bab611b76ac9d0e0cd4f2ff28da02
|
||||||
|
OUTPUT_BEGIN
|
||||||
|
WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE=V1
|
||||||
|
MODE=read-only
|
||||||
|
NO_MUTATION=true
|
||||||
|
WINDOWS_LOCAL_INSPECT_RC=0
|
||||||
|
WINDOWS_EVIDENCE_PRESENT=true
|
||||||
|
WATCHDOG_SHORTCUT_MATCH_COUNT=1
|
||||||
|
WATCHDOG_PS1_RESOLVED=true
|
||||||
|
WATCHDOG_PS1_BASENAME=watchdog.ps1
|
||||||
|
WATCHDOG_PS1_SIZE=5001
|
||||||
|
WATCHDOG_LINE_COUNT=169
|
||||||
|
SANITIZED_SOURCE_BEGIN
|
||||||
|
SRC|001|$ErrorActionPreference='SilentlyContinue'
|
||||||
|
SRC|003|$HostKey='<HOSTKEY>'
|
||||||
|
SRC|004|$PlinkPath='<PATH> Files\PuTTY\plink.exe'
|
||||||
|
SRC|005|$Target='<IP>'
|
||||||
|
SRC|006|$FailureStreak=0
|
||||||
|
SRC|008|function Get-Listeners {
|
||||||
|
SRC|009| try {
|
||||||
|
SRC|010| return @(Get-NetTCPConnection -State Listen -LocalPort 64020 -ErrorAction SilentlyContinue)
|
||||||
|
SRC|011| } catch {
|
||||||
|
SRC|012| return @()
|
||||||
|
SRC|013| }
|
||||||
|
SRC|014|}
|
||||||
|
SRC|016|function Get-ProcessCommandLine([int]$processId) {
|
||||||
|
SRC|017| try {
|
||||||
|
SRC|018| $proc = Get-CimInstance Win32_Process -Filter "ProcessId=$processId"
|
||||||
|
SRC|019| if ($proc) { return [string]$proc.CommandLine }
|
||||||
|
SRC|020| } catch {}
|
||||||
|
SRC|021| return ''
|
||||||
|
SRC|022|}
|
||||||
|
SRC|024|function Test-ExactOwner([int]$processId) {
|
||||||
|
SRC|025| $commandLine = Get-ProcessCommandLine $processId
|
||||||
|
SRC|026| if ([string]::IsNullOrWhiteSpace($commandLine)) { return $false }
|
||||||
|
SRC|028| return (
|
||||||
|
SRC|029| $commandLine -match '(?i)\bplink(\.exe)?\b' -and
|
||||||
|
SRC|030| $commandLine -match '(?i)-L\s+127\.0\.0\.1:64020:127\.0\.0\.1:64020' -and
|
||||||
|
SRC|031| $commandLine -match '(?i)root@192\.168\.50\.11' -and
|
||||||
|
SRC|032| $commandLine -match [regex]::Escape($HostKey)
|
||||||
|
SRC|033| )
|
||||||
|
SRC|034|}
|
||||||
|
SRC|036|function Test-Tcp22 {
|
||||||
|
SRC|037| $client = $null
|
||||||
|
SRC|038| try {
|
||||||
|
SRC|039| $client = New-Object Net.Sockets.TcpClient
|
||||||
|
SRC|040| $task = $client.ConnectAsync($Target, 22)
|
||||||
|
SRC|041| if (-not $task.Wait(1800)) { return $false }
|
||||||
|
SRC|042| return $client.Connected
|
||||||
|
SRC|043| } catch {
|
||||||
|
SRC|044| return $false
|
||||||
|
SRC|045| } finally {
|
||||||
|
SRC|046| try { if ($client) { $client.Close() } } catch {}
|
||||||
|
SRC|047| }
|
||||||
|
SRC|048|}
|
||||||
|
SRC|050|function Test-Tcp64020 {
|
||||||
|
SRC|051| $client = $null
|
||||||
|
SRC|052| try {
|
||||||
|
SRC|053| $client = New-Object Net.Sockets.TcpClient
|
||||||
|
SRC|054| $task = $client.ConnectAsync('<IP>', 64020)
|
||||||
|
SRC|055| if (-not $task.Wait(1200)) { return $false }
|
||||||
|
SRC|056| return $client.Connected
|
||||||
|
SRC|057| } catch {
|
||||||
|
SRC|058| return $false
|
||||||
|
SRC|059| } finally {
|
||||||
|
SRC|060| try { if ($client) { $client.Close() } } catch {}
|
||||||
|
SRC|061| }
|
||||||
|
SRC|062|}
|
||||||
|
SRC|064|function Test-Socks {
|
||||||
|
SRC|065| $curl = (Get-Command curl.exe -ErrorAction SilentlyContinue).Source
|
||||||
|
SRC|066| if (-not $curl) { return $false }
|
||||||
|
SRC|068| try {
|
||||||
|
SRC|069| $code = ((& $curl '-sS' '-o' 'NUL' '--connect-timeout' '4' '--max-time' '10' '-w' '%{http_code}' '--socks5-hostname' '<IP>:64020' 'https://api.telegram.org' 2>$null) | Out-String).Trim()
|
||||||
|
SRC|070| return ($LASTEXITCODE -eq 0 -and $code -match '^[1-5][0-9][0-9]$' -and $code -ne '000')
|
||||||
|
SRC|071| } catch {
|
||||||
|
SRC|072| return $false
|
||||||
|
SRC|073| }
|
||||||
|
SRC|074|}
|
||||||
|
SRC|076|function Get-ExactPlinkPids {
|
||||||
|
SRC|077| $result = New-Object 'System.Collections.Generic.List[int]'
|
||||||
|
SRC|078| try {
|
||||||
|
SRC|079| foreach ($proc in (Get-CimInstance Win32_Process -Filter "Name='plink.exe'" -ErrorAction SilentlyContinue)) {
|
||||||
|
SRC|080| if (Test-ExactOwner ([int]$proc.ProcessId)) {
|
||||||
|
SRC|081| $result.Add([int]$proc.ProcessId)
|
||||||
|
SRC|082| }
|
||||||
|
SRC|083| }
|
||||||
|
SRC|084| } catch {}
|
||||||
|
SRC|085| return @($result | Sort-Object -Unique)
|
||||||
|
SRC|086|}
|
||||||
|
SRC|088|function Start-Route {
|
||||||
|
SRC|089| if (-not (Test-Path -LiteralPath $PlinkPath -PathType Leaf)) { return $false }
|
||||||
|
SRC|090| if (-not (Test-Tcp22)) { return $false }
|
||||||
|
SRC|092| $proc = $null
|
||||||
|
SRC|093| try {
|
||||||
|
SRC|094| $psi = New-Object Diagnostics.ProcessStartInfo
|
||||||
|
SRC|095| $psi.FileName = $PlinkPath
|
||||||
|
SRC|096| $psi.UseShellExecute = $false
|
||||||
|
SRC|097| $psi.CreateNoWindow = $true
|
||||||
|
SRC|098| $psi.Arguments = "-batch -agent -noshare -no-antispoof -ssh -4 -P 22 -hostkey <HOSTKEY_OR_VAR> -N -L <IP>:64020:<IP>:64020 <USER>@<IP>"
|
||||||
|
SRC|099| $proc = [Diagnostics.Process]::Start($psi)
|
||||||
|
SRC|100| } catch {
|
||||||
|
SRC|101| return $false
|
||||||
|
SRC|102| }
|
||||||
|
SRC|104| if ($null -eq $proc) { return $false }
|
||||||
|
SRC|106| for ($i = 1; $i -le 30; $i++) {
|
||||||
|
SRC|107| Start-Sleep -Milliseconds 500
|
||||||
|
SRC|108| $rows = Get-Listeners
|
||||||
|
SRC|109| $owners = @($rows | ForEach-Object { $_.OwningProcess } | Where-Object { $_ -gt 0 } | Sort-Object -Unique)
|
||||||
|
SRC|111| if ($owners.Count -eq 1 -and $owners[0] -eq $proc.Id -and (Test-Tcp64020)) {
|
||||||
|
SRC|112| return $true
|
||||||
|
SRC|113| }
|
||||||
|
SRC|115| try {
|
||||||
|
SRC|116| if ($proc.HasExited) { break }
|
||||||
|
SRC|117| } catch {}
|
||||||
|
SRC|118| }
|
||||||
|
SRC|120| try {
|
||||||
|
SRC|121| if (-not $proc.HasExited) {
|
||||||
|
SRC|122| Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
|
||||||
|
SRC|123| }
|
||||||
|
SRC|124| } catch {}
|
||||||
|
SRC|126| return $false
|
||||||
|
SRC|127|}
|
||||||
|
SRC|129|while ($true) {
|
||||||
|
SRC|130| $rows = Get-Listeners
|
||||||
|
SRC|131| $owners = @($rows | ForEach-Object { $_.OwningProcess } | Where-Object { $_ -gt 0 } | Sort-Object -Unique)
|
||||||
|
SRC|133| if ($rows.Count -eq 0) {
|
||||||
|
SRC|134| $FailureStreak = 0
|
||||||
|
SRC|136| foreach ($staleProcessId in (Get-ExactPlinkPids)) {
|
||||||
|
SRC|137| try {
|
||||||
|
SRC|138| Stop-Process -Id $staleProcessId -Force -ErrorAction SilentlyContinue
|
||||||
|
SRC|139| } catch {}
|
||||||
|
SRC|140| }
|
||||||
|
SRC|142| Start-Route | Out-Null
|
||||||
|
SRC|143| }
|
||||||
|
SRC|144| elseif ($owners.Count -eq 1 -and (Test-ExactOwner ([int]$owners[0]))) {
|
||||||
|
SRC|145| if (Test-Socks) {
|
||||||
|
SRC|146| $FailureStreak = 0
|
||||||
|
SRC|147| }
|
||||||
|
SRC|148| else {
|
||||||
|
SRC|149| $FailureStreak++
|
||||||
|
SRC|151| if ($FailureStreak -ge 3) {
|
||||||
|
SRC|152| try {
|
||||||
|
SRC|153| Stop-Process -Id ([int]$owners[0]) -Force -ErrorAction SilentlyContinue
|
||||||
|
SRC|154| } catch {}
|
||||||
|
SRC|156| $FailureStreak = 0
|
||||||
|
SRC|157| Start-Sleep -Seconds 1
|
||||||
|
SRC|158| Start-Route | Out-Null
|
||||||
|
SRC|159| }
|
||||||
|
SRC|160| }
|
||||||
|
SRC|161| }
|
||||||
|
SRC|162| else {
|
||||||
|
SRC|163| # Safety hold: never terminate an unknown or competing owner.
|
||||||
|
SRC|164| $FailureStreak = 0
|
||||||
|
SRC|165| }
|
||||||
|
SRC|167| Start-Sleep -Seconds 12
|
||||||
|
SRC|168|}
|
||||||
|
SANITIZED_SOURCE_END
|
||||||
|
RUNNING_WATCHDOG_PS_COUNT=2
|
||||||
|
RUNNING_BRIDGE_PS_COUNT=2
|
||||||
|
REC|CURRENT_PLINK|IDX=1|HAS_R=false|HAS_L=true|HAS_D=false|HAS_64020=true|HAS_64022=false|HAS_AGENT=true|HAS_BATCH=true|HAS_N=true
|
||||||
|
CURRENT_PLINK_COUNT=1
|
||||||
|
WATCHDOG_PS1_SHA256=7738599c1d229c105f1073f04b420063bd776f3444b3f6fcf7d09bd320cce0e3
|
||||||
|
WATCHDOG_PS1_SHA_MATCH=true
|
||||||
|
PVE64020_LISTENER_COUNT=0
|
||||||
|
PVE64020_SSHD_OWNER_COUNT=0
|
||||||
|
CLUSTER_QUORATE=true
|
||||||
|
NETBIRD_LAZY=false
|
||||||
|
NETBIRD_MANAGEMENT=true
|
||||||
|
NETBIRD_SIGNAL=true
|
||||||
|
NETBIRD_CONNECTED=5
|
||||||
|
DECISION=PASS_WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE
|
||||||
|
NEXT_GATE=EXACT_WATCHDOG_LOGIC_REPAIR
|
||||||
|
TASK_RESULT=WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE
|
||||||
|
CHANGES_MADE=false
|
||||||
|
ROLLBACK_STARTED=false
|
||||||
|
ROLLBACK_RESTORED=null
|
||||||
|
MUTATION_OUTCOME=NO_MUTATION
|
||||||
|
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SANITIZED-SOURCE-99758R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
|
||||||
|
|
||||||
|
OUTPUT_END
|
||||||
|
CHAT_OUTPUT_END
|
||||||
+8
-8
File diff suppressed because one or more lines are too long
+155
-74
@@ -1,15 +1,15 @@
|
|||||||
CHAT_OUTPUT_BEGIN
|
CHAT_OUTPUT_BEGIN
|
||||||
COMMAND_ID=SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SEMANTIC-RCA-FIXED-99757R1
|
COMMAND_ID=SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SANITIZED-SOURCE-99758R1
|
||||||
STATUS=OK
|
STATUS=OK
|
||||||
RC=0
|
RC=0
|
||||||
HOST=pve01
|
HOST=pve01
|
||||||
MODE=read-only
|
MODE=read-only
|
||||||
COMPONENT=windows-dacha-watchdog-semantic-rca-fixed
|
COMPONENT=windows-dacha-watchdog-sanitized-source
|
||||||
REFERENCE_REGISTER_CHECK=OK
|
REFERENCE_REGISTER_CHECK=OK
|
||||||
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
|
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
|
||||||
ERROR_REGISTER_CHECK=OK
|
ERROR_REGISTER_CHECK=OK
|
||||||
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
|
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
|
||||||
COMMAND_SHA256=d5305a2592091a0bdee6810e59ff416686ecc668a271cefb00b941af34166b35
|
COMMAND_SHA256=82372359d1dfece3cca84734e47b1a82a17c43fb88ef3c8c418ee0f99f500497
|
||||||
DUPLICATE_FAILED_COMMAND_BLOCKED=false
|
DUPLICATE_FAILED_COMMAND_BLOCKED=false
|
||||||
EXECUTION_STARTED=true
|
EXECUTION_STARTED=true
|
||||||
CHANGE_DECLARED=false
|
CHANGE_DECLARED=false
|
||||||
@@ -24,10 +24,10 @@ MUTATION_OUTCOME=NO_MUTATION
|
|||||||
SANITIZED=yes
|
SANITIZED=yes
|
||||||
SECRETS_INCLUDED=no
|
SECRETS_INCLUDED=no
|
||||||
PRIVATE_ADDRESSES_INCLUDED=no
|
PRIVATE_ADDRESSES_INCLUDED=no
|
||||||
RAW_EVIDENCE_SHA256=daf114282e48c0472fc1f454fcc68053228fae8fbc85e996097870cdac05d508
|
RAW_EVIDENCE_SHA256=07576991b3bcf03a1f05666fc4f906e8ce3bab611b76ac9d0e0cd4f2ff28da02
|
||||||
SANITIZED_OUTPUT_SHA256=daf114282e48c0472fc1f454fcc68053228fae8fbc85e996097870cdac05d508
|
SANITIZED_OUTPUT_SHA256=07576991b3bcf03a1f05666fc4f906e8ce3bab611b76ac9d0e0cd4f2ff28da02
|
||||||
OUTPUT_BEGIN
|
OUTPUT_BEGIN
|
||||||
WINDOWS_DACHA_WATCHDOG_SEMANTIC_RCA_FIXED=V1
|
WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE=V1
|
||||||
MODE=read-only
|
MODE=read-only
|
||||||
NO_MUTATION=true
|
NO_MUTATION=true
|
||||||
WINDOWS_LOCAL_INSPECT_RC=0
|
WINDOWS_LOCAL_INSPECT_RC=0
|
||||||
@@ -37,70 +37,151 @@ WATCHDOG_PS1_RESOLVED=true
|
|||||||
WATCHDOG_PS1_BASENAME=watchdog.ps1
|
WATCHDOG_PS1_BASENAME=watchdog.ps1
|
||||||
WATCHDOG_PS1_SIZE=5001
|
WATCHDOG_PS1_SIZE=5001
|
||||||
WATCHDOG_LINE_COUNT=169
|
WATCHDOG_LINE_COUNT=169
|
||||||
WATCHDOG_HAS_CALL_OPERATOR=true
|
SANITIZED_SOURCE_BEGIN
|
||||||
WATCHDOG_HAS_START_PROCESS=false
|
SRC|001|$ErrorActionPreference='SilentlyContinue'
|
||||||
WATCHDOG_HAS_PROCESS_START=true
|
SRC|003|$HostKey='<HOSTKEY>'
|
||||||
WATCHDOG_HAS_INVOKE_EXPRESSION=false
|
SRC|004|$PlinkPath='<PATH> Files\PuTTY\plink.exe'
|
||||||
WATCHDOG_HAS_GET_NETTCP=true
|
SRC|005|$Target='<IP>'
|
||||||
WATCHDOG_HAS_TEST_NETCONNECTION=false
|
SRC|006|$FailureStreak=0
|
||||||
WATCHDOG_HAS_TCPCLIENT=true
|
SRC|008|function Get-Listeners {
|
||||||
WATCHDOG_HAS_WHILE=true
|
SRC|009| try {
|
||||||
WATCHDOG_HAS_TRY=true
|
SRC|010| return @(Get-NetTCPConnection -State Listen -LocalPort 64020 -ErrorAction SilentlyContinue)
|
||||||
WATCHDOG_HAS_CATCH=true
|
SRC|011| } catch {
|
||||||
WATCHDOG_HAS_EXIT=true
|
SRC|012| return @()
|
||||||
WATCHDOG_HAS_RETURN=true
|
SRC|013| }
|
||||||
WATCHDOG_HAS_SLEEP=true
|
SRC|014|}
|
||||||
WATCHDOG_HAS_LOG_WRITE=false
|
SRC|016|function Get-ProcessCommandLine([int]$processId) {
|
||||||
WATCHDOG_FORWARD_LITERAL_COUNT=0
|
SRC|017| try {
|
||||||
REC|SEM_LINE|LINE=4|PORTS=|VARS=plinkpath|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=true|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|018| $proc = Get-CimInstance Win32_Process -Filter "ProcessId=$processId"
|
||||||
REC|SEM_LINE|LINE=8|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=true|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=true|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|019| if ($proc) { return [string]$proc.CommandLine }
|
||||||
REC|SEM_LINE|LINE=10|PORTS=64020|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=true|LOCALPORT=true|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=true|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=true|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|020| } catch {}
|
||||||
REC|SEM_LINE|LINE=12|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|021| return ''
|
||||||
REC|SEM_LINE|LINE=19|PORTS=|VARS=proc|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|022|}
|
||||||
REC|SEM_LINE|LINE=21|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|024|function Test-ExactOwner([int]$processId) {
|
||||||
REC|SEM_LINE|LINE=26|PORTS=|VARS=commandline,false|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|025| $commandLine = Get-ProcessCommandLine $processId
|
||||||
REC|SEM_LINE|LINE=28|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|026| if ([string]::IsNullOrWhiteSpace($commandLine)) { return $false }
|
||||||
REC|SEM_LINE|LINE=29|PORTS=|VARS=commandline|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=true|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|028| return (
|
||||||
REC|SEM_LINE|LINE=30|PORTS=127,1,64020,127,1,64020|VARS=commandline|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=true|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|029| $commandLine -match '(?i)\bplink(\.exe)?\b' -and
|
||||||
REC|SEM_LINE|LINE=41|PORTS=1800|VARS=task,false|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|030| $commandLine -match '(?i)-L\s+127\.0\.0\.1:64020:127\.0\.0\.1:64020' -and
|
||||||
REC|SEM_LINE|LINE=42|PORTS=|VARS=client|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|031| $commandLine -match '(?i)root@192\.168\.50\.11' -and
|
||||||
REC|SEM_LINE|LINE=44|PORTS=|VARS=false|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|032| $commandLine -match [regex]::Escape($HostKey)
|
||||||
REC|SEM_LINE|LINE=50|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|033| )
|
||||||
REC|SEM_LINE|LINE=54|PORTS=127,1,64020|VARS=task,client|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|034|}
|
||||||
REC|SEM_LINE|LINE=55|PORTS=1200|VARS=task,false|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|036|function Test-Tcp22 {
|
||||||
REC|SEM_LINE|LINE=56|PORTS=|VARS=client|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|037| $client = $null
|
||||||
REC|SEM_LINE|LINE=58|PORTS=|VARS=false|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|038| try {
|
||||||
REC|SEM_LINE|LINE=66|PORTS=|VARS=curl,false|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|039| $client = New-Object Net.Sockets.TcpClient
|
||||||
REC|SEM_LINE|LINE=69|PORTS=4,10,127,1,64020,2|VARS=code,curl,null|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=true|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|040| $task = $client.ConnectAsync($Target, 22)
|
||||||
REC|SEM_LINE|LINE=70|PORTS=1,5,9,9|VARS=lastexitcode,code|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=true|RETURN=true|SLEEP=false
|
SRC|041| if (-not $task.Wait(1800)) { return $false }
|
||||||
REC|SEM_LINE|LINE=72|PORTS=|VARS=false|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|042| return $client.Connected
|
||||||
REC|SEM_LINE|LINE=76|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=true|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|043| } catch {
|
||||||
REC|SEM_LINE|LINE=79|PORTS=|VARS=proc|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=true|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|044| return $false
|
||||||
REC|SEM_LINE|LINE=85|PORTS=|VARS=result|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|045| } finally {
|
||||||
REC|SEM_LINE|LINE=88|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=true|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|046| try { if ($client) { $client.Close() } } catch {}
|
||||||
REC|SEM_LINE|LINE=89|PORTS=|VARS=plinkpath,false|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=true|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=true|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|047| }
|
||||||
REC|SEM_LINE|LINE=90|PORTS=|VARS=false|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|048|}
|
||||||
REC|SEM_LINE|LINE=94|PORTS=|VARS=psi|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=true|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|050|function Test-Tcp64020 {
|
||||||
REC|SEM_LINE|LINE=95|PORTS=|VARS=psi,plinkpath|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=true|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|051| $client = $null
|
||||||
REC|SEM_LINE|LINE=98|PORTS=4,22,127,1,64020,127,1,64020,192,168,50,11|VARS=psi,hostkey|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=true|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|052| try {
|
||||||
REC|SEM_LINE|LINE=101|PORTS=|VARS=false|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|053| $client = New-Object Net.Sockets.TcpClient
|
||||||
REC|SEM_LINE|LINE=104|PORTS=|VARS=null,proc,false|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|054| $task = $client.ConnectAsync('<IP>', 64020)
|
||||||
REC|SEM_LINE|LINE=106|PORTS=1,30|VARS=i|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=true|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|055| if (-not $task.Wait(1200)) { return $false }
|
||||||
REC|SEM_LINE|LINE=107|PORTS=500|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=true
|
SRC|056| return $client.Connected
|
||||||
REC|SEM_LINE|LINE=108|PORTS=|VARS=rows|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=true|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=true|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|057| } catch {
|
||||||
REC|SEM_LINE|LINE=111|PORTS=1|VARS=owners,proc|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|058| return $false
|
||||||
REC|SEM_LINE|LINE=112|PORTS=|VARS=true|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|059| } finally {
|
||||||
REC|SEM_LINE|LINE=116|PORTS=|VARS=proc|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=true|RETURN=false|SLEEP=false
|
SRC|060| try { if ($client) { $client.Close() } } catch {}
|
||||||
REC|SEM_LINE|LINE=121|PORTS=|VARS=proc|ASSIGN=false|IF=true|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=true|RETURN=false|SLEEP=false
|
SRC|061| }
|
||||||
REC|SEM_LINE|LINE=126|PORTS=|VARS=false|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=true|SLEEP=false
|
SRC|062|}
|
||||||
REC|SEM_LINE|LINE=129|PORTS=|VARS=true|ASSIGN=false|IF=false|ELSE=false|WHILE=true|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|064|function Test-Socks {
|
||||||
REC|SEM_LINE|LINE=130|PORTS=|VARS=rows|ASSIGN=true|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=true|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=true|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|065| $curl = (Get-Command curl.exe -ErrorAction SilentlyContinue).Source
|
||||||
REC|SEM_LINE|LINE=136|PORTS=|VARS=staleprocessid|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=true|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|066| if (-not $curl) { return $false }
|
||||||
REC|SEM_LINE|LINE=142|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=true|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|068| try {
|
||||||
REC|SEM_LINE|LINE=157|PORTS=1|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=true
|
SRC|069| $code = ((& $curl '-sS' '-o' 'NUL' '--connect-timeout' '4' '--max-time' '10' '-w' '%{http_code}' '--socks5-hostname' '<IP>:64020' 'https://api.telegram.org' 2>$null) | Out-String).Trim()
|
||||||
REC|SEM_LINE|LINE=158|PORTS=|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=true|L=false|D=false|EXIT=false|RETURN=false|SLEEP=false
|
SRC|070| return ($LASTEXITCODE -eq 0 -and $code -match '^[1-5][0-9][0-9]$' -and $code -ne '000')
|
||||||
REC|SEM_LINE|LINE=167|PORTS=12|VARS=|ASSIGN=false|IF=false|ELSE=false|WHILE=false|TRY=false|CATCH=false|GET_NETTCP=false|LOCALPORT=false|REMOTEPORT=false|OWNINGPROCESS=false|STATE_LISTEN=false|TEST_NET=false|PLINK=false|CALL_OP=false|START_PROCESS=false|PROCESS_START=false|R=false|L=false|D=false|EXIT=false|RETURN=false|SLEEP=true
|
SRC|071| } catch {
|
||||||
WATCHDOG_RELEVANT_LINE_COUNT=48
|
SRC|072| return $false
|
||||||
|
SRC|073| }
|
||||||
|
SRC|074|}
|
||||||
|
SRC|076|function Get-ExactPlinkPids {
|
||||||
|
SRC|077| $result = New-Object 'System.Collections.Generic.List[int]'
|
||||||
|
SRC|078| try {
|
||||||
|
SRC|079| foreach ($proc in (Get-CimInstance Win32_Process -Filter "Name='plink.exe'" -ErrorAction SilentlyContinue)) {
|
||||||
|
SRC|080| if (Test-ExactOwner ([int]$proc.ProcessId)) {
|
||||||
|
SRC|081| $result.Add([int]$proc.ProcessId)
|
||||||
|
SRC|082| }
|
||||||
|
SRC|083| }
|
||||||
|
SRC|084| } catch {}
|
||||||
|
SRC|085| return @($result | Sort-Object -Unique)
|
||||||
|
SRC|086|}
|
||||||
|
SRC|088|function Start-Route {
|
||||||
|
SRC|089| if (-not (Test-Path -LiteralPath $PlinkPath -PathType Leaf)) { return $false }
|
||||||
|
SRC|090| if (-not (Test-Tcp22)) { return $false }
|
||||||
|
SRC|092| $proc = $null
|
||||||
|
SRC|093| try {
|
||||||
|
SRC|094| $psi = New-Object Diagnostics.ProcessStartInfo
|
||||||
|
SRC|095| $psi.FileName = $PlinkPath
|
||||||
|
SRC|096| $psi.UseShellExecute = $false
|
||||||
|
SRC|097| $psi.CreateNoWindow = $true
|
||||||
|
SRC|098| $psi.Arguments = "-batch -agent -noshare -no-antispoof -ssh -4 -P 22 -hostkey <HOSTKEY_OR_VAR> -N -L <IP>:64020:<IP>:64020 <USER>@<IP>"
|
||||||
|
SRC|099| $proc = [Diagnostics.Process]::Start($psi)
|
||||||
|
SRC|100| } catch {
|
||||||
|
SRC|101| return $false
|
||||||
|
SRC|102| }
|
||||||
|
SRC|104| if ($null -eq $proc) { return $false }
|
||||||
|
SRC|106| for ($i = 1; $i -le 30; $i++) {
|
||||||
|
SRC|107| Start-Sleep -Milliseconds 500
|
||||||
|
SRC|108| $rows = Get-Listeners
|
||||||
|
SRC|109| $owners = @($rows | ForEach-Object { $_.OwningProcess } | Where-Object { $_ -gt 0 } | Sort-Object -Unique)
|
||||||
|
SRC|111| if ($owners.Count -eq 1 -and $owners[0] -eq $proc.Id -and (Test-Tcp64020)) {
|
||||||
|
SRC|112| return $true
|
||||||
|
SRC|113| }
|
||||||
|
SRC|115| try {
|
||||||
|
SRC|116| if ($proc.HasExited) { break }
|
||||||
|
SRC|117| } catch {}
|
||||||
|
SRC|118| }
|
||||||
|
SRC|120| try {
|
||||||
|
SRC|121| if (-not $proc.HasExited) {
|
||||||
|
SRC|122| Stop-Process -Id $proc.Id -Force -ErrorAction SilentlyContinue
|
||||||
|
SRC|123| }
|
||||||
|
SRC|124| } catch {}
|
||||||
|
SRC|126| return $false
|
||||||
|
SRC|127|}
|
||||||
|
SRC|129|while ($true) {
|
||||||
|
SRC|130| $rows = Get-Listeners
|
||||||
|
SRC|131| $owners = @($rows | ForEach-Object { $_.OwningProcess } | Where-Object { $_ -gt 0 } | Sort-Object -Unique)
|
||||||
|
SRC|133| if ($rows.Count -eq 0) {
|
||||||
|
SRC|134| $FailureStreak = 0
|
||||||
|
SRC|136| foreach ($staleProcessId in (Get-ExactPlinkPids)) {
|
||||||
|
SRC|137| try {
|
||||||
|
SRC|138| Stop-Process -Id $staleProcessId -Force -ErrorAction SilentlyContinue
|
||||||
|
SRC|139| } catch {}
|
||||||
|
SRC|140| }
|
||||||
|
SRC|142| Start-Route | Out-Null
|
||||||
|
SRC|143| }
|
||||||
|
SRC|144| elseif ($owners.Count -eq 1 -and (Test-ExactOwner ([int]$owners[0]))) {
|
||||||
|
SRC|145| if (Test-Socks) {
|
||||||
|
SRC|146| $FailureStreak = 0
|
||||||
|
SRC|147| }
|
||||||
|
SRC|148| else {
|
||||||
|
SRC|149| $FailureStreak++
|
||||||
|
SRC|151| if ($FailureStreak -ge 3) {
|
||||||
|
SRC|152| try {
|
||||||
|
SRC|153| Stop-Process -Id ([int]$owners[0]) -Force -ErrorAction SilentlyContinue
|
||||||
|
SRC|154| } catch {}
|
||||||
|
SRC|156| $FailureStreak = 0
|
||||||
|
SRC|157| Start-Sleep -Seconds 1
|
||||||
|
SRC|158| Start-Route | Out-Null
|
||||||
|
SRC|159| }
|
||||||
|
SRC|160| }
|
||||||
|
SRC|161| }
|
||||||
|
SRC|162| else {
|
||||||
|
SRC|163| # Safety hold: never terminate an unknown or competing owner.
|
||||||
|
SRC|164| $FailureStreak = 0
|
||||||
|
SRC|165| }
|
||||||
|
SRC|167| Start-Sleep -Seconds 12
|
||||||
|
SRC|168|}
|
||||||
|
SANITIZED_SOURCE_END
|
||||||
RUNNING_WATCHDOG_PS_COUNT=2
|
RUNNING_WATCHDOG_PS_COUNT=2
|
||||||
RUNNING_BRIDGE_PS_COUNT=2
|
RUNNING_BRIDGE_PS_COUNT=2
|
||||||
REC|CURRENT_PLINK|IDX=1|HAS_R=false|HAS_L=true|HAS_D=false|HAS_64020=true|HAS_64022=false|HAS_AGENT=true|HAS_BATCH=true|HAS_N=true
|
REC|CURRENT_PLINK|IDX=1|HAS_R=false|HAS_L=true|HAS_D=false|HAS_64020=true|HAS_64022=false|HAS_AGENT=true|HAS_BATCH=true|HAS_N=true
|
||||||
@@ -114,14 +195,14 @@ NETBIRD_LAZY=false
|
|||||||
NETBIRD_MANAGEMENT=true
|
NETBIRD_MANAGEMENT=true
|
||||||
NETBIRD_SIGNAL=true
|
NETBIRD_SIGNAL=true
|
||||||
NETBIRD_CONNECTED=5
|
NETBIRD_CONNECTED=5
|
||||||
DECISION=PASS_WINDOWS_DACHA_WATCHDOG_SEMANTIC_RCA_FIXED
|
DECISION=PASS_WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE
|
||||||
NEXT_GATE=EXACT_WATCHDOG_BRANCH_REPAIR
|
NEXT_GATE=EXACT_WATCHDOG_LOGIC_REPAIR
|
||||||
TASK_RESULT=WINDOWS_DACHA_WATCHDOG_SEMANTIC_RCA_FIXED
|
TASK_RESULT=WINDOWS_DACHA_WATCHDOG_SANITIZED_SOURCE
|
||||||
CHANGES_MADE=false
|
CHANGES_MADE=false
|
||||||
ROLLBACK_STARTED=false
|
ROLLBACK_STARTED=false
|
||||||
ROLLBACK_RESTORED=null
|
ROLLBACK_RESTORED=null
|
||||||
MUTATION_OUTCOME=NO_MUTATION
|
MUTATION_OUTCOME=NO_MUTATION
|
||||||
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SEMANTIC-RCA-FIXED-99757R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
|
HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261007-WINDOWS-DACHA-WATCHDOG-SANITIZED-SOURCE-99758R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null}
|
||||||
|
|
||||||
OUTPUT_END
|
OUTPUT_END
|
||||||
CHAT_OUTPUT_END
|
CHAT_OUTPUT_END
|
||||||
|
|||||||
Reference in New Issue
Block a user