@echo off
TITLE Skybertech Tactical Field Audit [CMD Stager v4.0]
COLOR 0A
mode con: cols=100 lines=30

echo ====================================================================================
echo   SKYBERTECH TACTICAL FIELD AUDIT ENGINE - CLOUD STAGER (CMD/BATCH)
echo   Target Site: Field Intern Triage Poolecho ====================================================================================
echo.

SET "CLIENT_NAME=Field Intern Triage Pool"
SET "AUTH_TOKEN=TOKEN-FIELD-INTERN"
SET "UPLOAD_URL=https://security.webec.in/api/upload.php"

SET "TIMESTAMP=%DATE:~10,4%%DATE:~4,2%%DATE:~7,2%_%TIME:~0,2%%TIME:~3,2%%TIME:~6,2%"
SET "TIMESTAMP=%TIMESTAMP: =0%"
SET "OUTDIR=%TEMP%\SkyberAudit_%COMPUTERNAME%_%TIMESTAMP%"
SET "DESKTOPDIR=%USERPROFILE%\Desktop\Audit_Logs_%COMPUTERNAME%"
SET "ZIPFILE=%TEMP%\Audit_Logs_%COMPUTERNAME%_%TIMESTAMP%.zip"

mkdir "%OUTDIR%" 2>nul
mkdir "%DESKTOPDIR%" 2>nul

echo [*] Initializing Telemetry Capture on %COMPUTERNAME% [%USERDOMAIN%]...
echo [*] Temporary Workspace: %OUTDIR%

:: Phase 1: System Info & Tasks
echo [~] Phase 1/5: Extracting System Specs and Running Processes...
systeminfo > "%OUTDIR%\systeminfo.txt" 2>nul
tasklist /v > "%OUTDIR%\tasklist.txt" 2>nul
wmic logicaldisk get caption,description,providername,size,freespace > "%OUTDIR%\disk_storage.txt" 2>nul

:: Phase 2: Network Topography
echo [~] Phase 2/5: Mapping Network Interfaces and Ports...
ipconfig /all > "%OUTDIR%\network_config.txt" 2>nul
arp -a > "%OUTDIR%\arp_cache.txt" 2>nul
netstat -ano > "%OUTDIR%\active_sockets.txt" 2>nul
route print > "%OUTDIR%\routing_table.txt" 2>nul
netsh wlan show profiles > "%OUTDIR%\wifi_profiles.txt" 2>nul

:: Phase 3: Event Log Harvesting
echo [~] Phase 3/5: Dumping Core Event Viewer Logs...
wevtutil epl System "%OUTDIR%\event_system.evtx" 2>nul
wevtutil epl Application "%OUTDIR%\event_application.evtx" 2>nul
wevtutil epl Security "%OUTDIR%\event_security.evtx" 2>nul
wevtutil epl "Microsoft-Windows-PowerShell/Operational" "%OUTDIR%\event_powershell.evtx" 2>nul

:: Phase 4: Services and Kernel Drivers
echo [~] Phase 4/5: Auditing Services, Drivers, and Shares...
sc query state= all > "%OUTDIR%\services.txt" 2>nul
driverquery /v > "%OUTDIR%\loaded_drivers.txt" 2>nul
net share > "%OUTDIR%\shares.txt" 2>nul

:: Phase 5: Hashing & Compression
echo [~] Phase 5/5: Generating Forensic Hash Manifest and Compressing...
powershell -NoProfile -Command "Get-ChildItem -Path '%OUTDIR%' -File | Get-FileHash -Algorithm SHA256 | Export-Csv -Path '%OUTDIR%\_Hash_Manifest_SHA256.csv' -NoTypeInformation" 2>nul
powershell -NoProfile -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::CreateFromDirectory('%OUTDIR%', '%ZIPFILE%')" 2>nul

:: Attempt Automated Upload via curl
echo.
echo [*] Transmitting telemetry package to Skybertech Cloud Vault...
curl -s -F "audit_bundle=@%ZIPFILE%" -F "token=%AUTH_TOKEN%" -F "client=%CLIENT_NAME%" -F "machine=%COMPUTERNAME%" "%UPLOAD_URL%" > "%TEMP%\upload_resp.txt" 2>nul

findstr /i "ok" "%TEMP%\upload_resp.txt" >nul
if %ERRORLEVEL% EQU 0 (
    echo.
    echo ====================================================================================
    echo [X] SUCCESS: AUDIT ARCHIVE TRANSMITTED AND RECORDED ON HOSTINGER!
    echo ====================================================================================
) else (
    echo.
    echo [!] Direct upload restricted. Copying bundle to Desktop repository...
    copy "%ZIPFILE%" "%DESKTOPDIR%\Audit_Logs_%COMPUTERNAME%.zip" >nul
    xcopy "%OUTDIR%\*" "%DESKTOPDIR%\" /E /I /Y >nul
    echo [+] Fallback complete: Files mirrored to %DESKTOPDIR%
    echo [+] Upload manually via browser: https://security.webec.in/upload.php
)

:: Scrub Temporary Working Files
rd /s /q "%OUTDIR%" 2>nul
del "%ZIPFILE%" 2>nul
del "%TEMP%\upload_resp.txt" 2>nul

echo.
echo [!] Field Audit Stager Completed.
pause