sync: auto-sync from HOWARD-HOME at 2026-07-05 01:00:55

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-05 01:00:55
This commit is contained in:
2026-07-05 01:01:23 -07:00
parent e359702837
commit 26b1cf400f
5 changed files with 0 additions and 5 deletions

View File

@@ -1 +0,0 @@
{"command_type": "powershell", "command": "$base = 'C:\\Windows\\SYSVOL\\sysvol\\IMC.local\\scripts'\nNew-NetFirewallRule -DisplayName GPSDIAG-TMP2 -Direction Inbound -Protocol TCP -LocalPort 8766 -Action Allow | Out-Null\n$l = New-Object System.Net.HttpListener\n$l.Prefixes.Add('http://+:8766/')\n$l.Start()\n$sw = [Diagnostics.Stopwatch]::StartNew()\n$log = @()\nwhile ($sw.Elapsed.TotalSeconds -lt 420) {\n $ar = $l.BeginGetContext($null, $null)\n if ($ar.AsyncWaitHandle.WaitOne(5000)) {\n $c = $l.EndGetContext($ar)\n $p = $c.Request.Url.AbsolutePath\n $log += ('[' + [int]$sw.Elapsed.TotalSeconds + 's] ' + $p + ' ' + [uri]::UnescapeDataString($c.Request.Url.Query))\n if ($p -eq '/exe') { $b = [IO.File]::ReadAllBytes(\"$base\\gururmm-agent-new.exe\") }\n elseif ($p -eq '/toml') { $b = [IO.File]::ReadAllBytes(\"$base\\gururmm-agent.toml\") }\n else { $b = [Text.Encoding]::UTF8.GetBytes('ok') }\n $c.Response.ContentLength64 = $b.Length\n $c.Response.OutputStream.Write($b, 0, $b.Length)\n $c.Response.Close()\n }\n}\n$l.Stop()\nRemove-NetFirewallRule -DisplayName GPSDIAG-TMP2 | Out-Null\nif ($log.Count -eq 0) { Write-Output 'NO-REQUESTS' } else { $log }", "timeout_seconds": 480}

View File

@@ -1 +0,0 @@
{"command_type": "powershell", "command": "New-NetFirewallRule -DisplayName GPSDIAG-TMP -Direction Inbound -Protocol TCP -LocalPort 8765 -Action Allow | Out-Null\n$l = New-Object System.Net.HttpListener\n$l.Prefixes.Add('http://+:8765/')\n$l.Start()\n$sw = [Diagnostics.Stopwatch]::StartNew()\n$got = @()\nwhile ($sw.Elapsed.TotalSeconds -lt 150 -and $got.Count -lt 1) {\n $ar = $l.BeginGetContext($null, $null)\n if ($ar.AsyncWaitHandle.WaitOne(5000)) {\n $ctx = $l.EndGetContext($ar)\n $got += $ctx.Request.Url.Query\n $b = [Text.Encoding]::UTF8.GetBytes('ok')\n $ctx.Response.OutputStream.Write($b, 0, $b.Length)\n $ctx.Response.Close()\n }\n}\n$l.Stop()\nRemove-NetFirewallRule -DisplayName GPSDIAG-TMP | Out-Null\nif ($got.Count -eq 0) { Write-Output 'NO-CONTACT' } else { $got | ForEach-Object { [uri]::UnescapeDataString($_) } }", "timeout_seconds": 200}

View File

@@ -1 +0,0 @@
{"command_type": "powershell", "command": "New-NetFirewallRule -DisplayName GPSDIAG-TMP -Direction Inbound -Protocol TCP -LocalPort 8765 -Action Allow | Out-Null\n$l = New-Object System.Net.HttpListener\n$l.Prefixes.Add('http://+:8765/')\n$l.Start()\n$sw = [Diagnostics.Stopwatch]::StartNew()\n$got = @()\nwhile ($sw.Elapsed.TotalSeconds -lt 150 -and $got.Count -lt 3) {\n $ar = $l.BeginGetContext($null, $null)\n if ($ar.AsyncWaitHandle.WaitOne(5000)) {\n $ctx = $l.EndGetContext($ar)\n $got += ('[' + [int]$sw.Elapsed.TotalSeconds + 's] ' + $ctx.Request.Url.Query)\n $b = [Text.Encoding]::UTF8.GetBytes('ok')\n $ctx.Response.OutputStream.Write($b, 0, $b.Length)\n $ctx.Response.Close()\n }\n}\n$l.Stop()\nRemove-NetFirewallRule -DisplayName GPSDIAG-TMP | Out-Null\nif ($got.Count -eq 0) { Write-Output 'NO-CONTACT' } else { $got | ForEach-Object { [uri]::UnescapeDataString($_) } }", "timeout_seconds": 200}

View File

@@ -1 +0,0 @@
{"command_type": "powershell", "command": "New-NetFirewallRule -DisplayName GPSDIAG-TMP -Direction Inbound -Protocol TCP -LocalPort 8765 -Action Allow | Out-Null\n$l = New-Object System.Net.HttpListener\n$l.Prefixes.Add('http://+:8765/')\n$l.Start()\n$sw = [Diagnostics.Stopwatch]::StartNew()\n$got = @()\nwhile ($sw.Elapsed.TotalSeconds -lt 400 -and $got.Count -lt 10) {\n $ar = $l.BeginGetContext($null, $null)\n if ($ar.AsyncWaitHandle.WaitOne(5000)) {\n $ctx = $l.EndGetContext($ar)\n $got += ('[' + [int]$sw.Elapsed.TotalSeconds + 's] ' + $ctx.Request.Url.Query)\n $b = [Text.Encoding]::UTF8.GetBytes('ok')\n $ctx.Response.OutputStream.Write($b, 0, $b.Length)\n $ctx.Response.Close()\n }\n}\n$l.Stop()\nRemove-NetFirewallRule -DisplayName GPSDIAG-TMP | Out-Null\nif ($got.Count -eq 0) { Write-Output 'NO-CONTACT' } else { $got | ForEach-Object { [uri]::UnescapeDataString($_) } }", "timeout_seconds": 450}

View File

@@ -1 +0,0 @@
{"command_type": "powershell", "command": "$d = (Get-CimInstance Win32_ComputerSystem).Domain\n$p = \"C:\\Windows\\SYSVOL\\sysvol\\$d\\scripts\"\n[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\nInvoke-WebRequest -Uri 'https://rmm.azcomputerguru.com/install/DARK-STORM-3150/download/windows' -OutFile \"$p\\gururmm-agent-new.exe\" -UseBasicParsing\n$config = @\"\n[server]\nurl = \"wss://rmm-api.azcomputerguru.com/ws\"\napi_key = \"DARK-STORM-3150\"\n\n[metrics]\ninterval_seconds = 60\ncollect_cpu = true\ncollect_memory = true\ncollect_disk = true\ncollect_network = true\n\n[watchdog]\nenabled = false\n\"@\n$config | Out-File -FilePath \"$p\\gururmm-agent.toml\" -Encoding UTF8\nWrite-Output \"domain=$d\"\nGet-Item \"$p\\gururmm-agent-new.exe\", \"$p\\gururmm-agent.toml\" | Select-Object Name, Length | Format-Table -AutoSize | Out-String", "timeout_seconds": 180}