azcomputerguru/claudetools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sync: auto-sync from HOWARD-HOME at 2026-07-10 14:44:39

Browse Source 
Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-10 14:44:39
This commit is contained in:
Howard Enos
2026-07-10 14:45:04 -07:00
parent df46f56e59
commit 0fdeabde3d
4 changed files with 214 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
.claude/scripts/guruscan-agent-test.sh
View File

@@ -1,11 +1,11 @@
#!/usr/bin/env bash
# guruscan-agent-test.sh - Deploy GuruScan to a Windows GuruRMM agent and run an
# end-to-end smoke test (full 3-engine chain, EICAR-seeded, clean mode), pulling
# every log back for review.
# end-to-end smoke test (full 3-engine chain, clean mode), pulling every log back
# for review.
#
# Phases:
# prep - upload module to C:\GuruScan, Defender-exclude tool/test dirs,
# download RKill+Emsisoft, fetch HitmanPro, seed EICAR, verify ready
# prep - upload module to C:\GuruScan, Defender-exclude tool dirs,
# download RKill+Emsisoft, fetch HitmanPro, verify ready
# scan - dispatch Invoke-GuruScan.ps1 -Headless (clean mode) and poll
# collect - pull results.json + per-scanner logs into the repo
# all - prep then scan then collect
@@ -14,10 +14,9 @@
# bash guruscan-agent-test.sh <hostname|uuid> <prep|scan|collect|all>
#
# Mirrors the RMM plumbing in run-onboarding-diagnostic.sh (vault auth -> JWT ->
# chunked base64 upload -> dispatch -> poll). EICAR is the standard harmless AV
# test file; it is assembled on the endpoint (never written to this host) and
# dropped only into a Defender-excluded folder so GuruScan's own engines are what
# detect it.
# chunked base64 upload -> dispatch -> poll). Detection testing uses the real
# malware-samples set via the scan-one / verify-each phases. Prep's EICAR seed is
# DISABLED by default (kept for future scanners) -- enable with SEED_EICAR=1.
set -u
@@ -25,6 +24,11 @@ TARGET="${1:-}"
PHASE="${2:-all}"
SCANNER_ARG="${3:-}"
# EICAR test-file seeding in the prep phase. DISABLED by default -- kept (not
# deleted) so it can be switched back on to smoke-test detection as new scanners
# are added to the chain. Enable per-run with: SEED_EICAR=1 bash guruscan-agent-test.sh ...
SEED_EICAR="${SEED_EICAR:-0}"
if [ -z "$TARGET" ]; then
echo "[ERROR] Usage: bash guruscan-agent-test.sh <hostname|uuid> <prep|scan|collect|all>" >&2
exit 1
@@ -273,12 +277,12 @@ phase_prep() {
upload_file "$GS_DIR/$f" "C:\\GuruScan\\$f" || { _logerr "upload failed" --context "file=$f host=$AGENT_HOST"; return 1; }
done
# 2) Defender exclusions for tool + downloads + test dirs (so Defender does not
# nuke the scanner EXEs or grab EICAR before GuruScan's engines run).
# 2) Defender exclusions for tool + downloads dirs (so Defender does not nuke
# the scanner EXEs before GuruScan's engines run).
local sf="$WORK_DIR/defender.ps1"
cat > "$sf" <<'PS'
$ErrorActionPreference='Continue'
foreach($p in @('C:\GuruScan','C:\GuruScan\downloads','C:\GuruScanTest','C:\EmsisoftCmd')){
foreach($p in @('C:\GuruScan','C:\GuruScan\downloads','C:\EmsisoftCmd')){
try { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; Write-Output "EXCLUDED $p" }
catch { Write-Output ("EXCLUDE-SKIP " + $p + " : " + $_.Exception.Message) }
}
@@ -310,12 +314,16 @@ try {
PS
run_ps "$sf3" 300 70 "download-hitmanpro" || echo "[WARN] HitmanPro download dispatch issue"
# 5) seed EICAR into the Defender-excluded test folder (assembled on endpoint)
local sf4="$WORK_DIR/eicar.ps1"
cat > "$sf4" <<'PS'
# 5) [OPTIONAL] seed EICAR into a Defender-excluded test folder (assembled on
# the endpoint). DISABLED unless SEED_EICAR=1 -- retained so detection can be
# smoke-tested as new scanners are added to the chain.
if [ "$SEED_EICAR" = "1" ]; then
local sfe="$WORK_DIR/eicar.ps1"
cat > "$sfe" <<'PS'
$ErrorActionPreference='Continue'
$dir='C:\GuruScanTest'
if(-not (Test-Path $dir)){New-Item -ItemType Directory -Path $dir -Force|Out-Null}
try { Add-MpPreference -ExclusionPath $dir -ErrorAction Stop } catch {}
# Standard EICAR test signature, assembled from fragments so it is never stored
# contiguously anywhere except the on-disk test file.
$e = 'X5O!P%@AP[4\PZX54(P^)7CC)7}' + '$EICAR' + '-STANDARD-ANTIVIRUS-' + 'TEST-FILE!$H+H*'
@@ -329,9 +337,12 @@ if(Test-Path $f){
Write-Output "EICAR MISSING after write - Defender (or other AV) grabbed it despite exclusion"
}
PS
run_ps "$sf4" 60 24 "seed-eicar" || { _logerr "EICAR seed failed" --context "host=$AGENT_HOST"; return 1; }
run_ps "$sfe" 60 24 "seed-eicar" || { _logerr "EICAR seed failed" --context "host=$AGENT_HOST"; return 1; }
else
echo "[INFO] EICAR seeding disabled (set SEED_EICAR=1 to enable)"
fi
# 6) readiness check - confirm all three scanner binaries present + EICAR present
# 6) readiness check - confirm all three scanner binaries + module present
local sf5="$WORK_DIR/ready.ps1"
cat > "$sf5" <<'PS'
$ErrorActionPreference='Continue'
@@ -339,8 +350,7 @@ $need=@{
'RKill' ='C:\GuruScan\downloads\rkill.exe';
'Emsisoft' ='C:\GuruScan\downloads\EmsisoftCommandlineScanner64.exe';
'HitmanPro' ='C:\GuruScan\downloads\HitmanPro_x64.exe';
'Module' ='C:\GuruScan\GuruScan.psm1';
'EICAR' ='C:\GuruScanTest\eicar_test.com'
'Module' ='C:\GuruScan\GuruScan.psm1'
}
$ok=$true
foreach($k in $need.Keys){
@@ -353,7 +363,7 @@ PS
if grep -q 'ALL-READY' "$WORK_DIR/last_result.json" 2>/dev/null || \
echo "$(jq -r '.stdout' "$WORK_DIR/last_result.json" 2>/dev/null)" | grep -q 'ALL-READY'; then
echo "[OK] prep complete - endpoint is READY for scan"
post_alert "[RMM] GuruScan test: prepped $AGENT_HOST (module+3 scanners+EICAR staged)"
post_alert "[RMM] GuruScan test: prepped $AGENT_HOST (module+3 scanners staged)"
else
echo "[WARN] prep finished but not all components READY - review output above before scanning"
fi