<# .SYNOPSIS Skybertech Tactical Field Audit & Forensics Engine (Cloud In-Memory Edition v4.0) Target Site: Field Intern Triage Pool Generated by: security.webec.in #> [Console]::OutputEncoding = [System.Text.Encoding]::UTF8 $Host.UI.RawUI.WindowTitle = "Skybertech Tactical Field Audit [Cloud Kernel v4.0]" Write-Host @" ======================================================================================== ███████╗██╗ ██╗██╗ ██╗██████╗ ███████╗██████╗ ████████╗███████╗ ██████╗██╗ ██╗ ██╔════╝██║ ██╔╝╚██╗ ██╔╝██╔══██╗██╔════╝██╔══██╗╚══██╔══╝██╔════╝██╔════╝██║ ██║ ███████╗█████╔╝ ╚████╔╝ ██████╔╝█████╗ ██████╔╝ ██║ █████╗ ██║ ███████║ ╚════██║██╔═██╗ ╚██╔╝ ██╔══██╗██╔══╝ ██╔══██╗ ██║ ██╔══╝ ██║ ██╔══██║ ███████║██║ ██╗ ██║ ██████╔╝███████╗██║ ██║ ██║ ███████╗╚██████╗██║ ██║ ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚═════╝ ╚══════╝╚═╝ ╚═╝ ╚═╝ ╚══════╝ ╚═════╝╚═╝ ╚═╝ TACTICAL FIELD AUDIT & FORENSICS ENGINE // CLOUD TELEMETRY ======================================================================================== "@ -ForegroundColor Green $clientName = "Field Intern Triage Pool" $authToken = "TOKEN-FIELD-INTERN" $uploadUrl = "https://security.webec.in/api/upload.php" Write-Host "[*] Engagement Target : $clientName" -ForegroundColor Cyan Write-Host "[*] Target Host : $env:COMPUTERNAME ($env:USERDOMAIN)" -ForegroundColor Cyan Write-Host "[*] Timestamp : $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')" -ForegroundColor Cyan Write-Host "----------------------------------------------------------------------------------------" $timestamp = Get-Date -Format "yyyyMMdd_HHmmss" $workDir = Join-Path $env:TEMP "SkyberAudit_${env:COMPUTERNAME}_${timestamp}" $zipFile = Join-Path $env:TEMP "Audit_Logs_${env:COMPUTERNAME}_${timestamp}.zip" $desktopZip = Join-Path ([Environment]::GetFolderPath("Desktop")) "Audit_Logs_${env:COMPUTERNAME}_${timestamp}.zip" New-Item -Path $workDir -ItemType Directory -Force | Out-Null try { # Phase 1: System Info & Software Matrix Write-Host "[~] Phase 1/6: Harvesting System Architecture & Software Inventory..." -ForegroundColor Yellow systeminfo > (Join-Path $workDir "systeminfo.txt") 2>$null tasklist /v > (Join-Path $workDir "tasklist.txt") 2>$null Get-Process | Select-Object Name, Id, Path, StartTime, CPU, WorkingSet64 | Format-Table -AutoSize | Out-File -FilePath (Join-Path $workDir "running_processes.txt") -Encoding utf8 # 32-bit & 64-bit Registry Software Enumeration $regPaths = @( "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*", "HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*", "HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" ) Get-ItemProperty $regPaths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName } | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Sort-Object DisplayName | Format-Table -AutoSize | Out-File -FilePath (Join-Path $workDir "installed_software.txt") -Encoding utf8 Get-CimInstance Win32_LogicalDisk | Select-Object DeviceID, VolumeName, Size, FreeSpace, FileSystem | Format-Table -AutoSize | Out-File -FilePath (Join-Path $workDir "disk_storage.txt") -Encoding utf8 # Phase 2: Network Topography & Sockets Write-Host "[~] Phase 2/6: Mapping Network Topology, Sockets & Wireless..." -ForegroundColor Yellow ipconfig /all > (Join-Path $workDir "network_config.txt") 2>$null arp -a > (Join-Path $workDir "arp_cache.txt") 2>$null route print > (Join-Path $workDir "routing_table.txt") 2>$null netstat -ano > (Join-Path $workDir "active_sockets.txt") 2>$null netsh wlan show profiles > (Join-Path $workDir "wifi_profiles.txt") 2>$null netsh wlan show networks mode=bssid > (Join-Path $workDir "wifi_beacons.txt") 2>$null # Phase 3: Complete Windows Event Log Telemetry Write-Host "[~] Phase 3/6: Exporting Core Event Viewer Telemetry (.evtx)..." -ForegroundColor Yellow $wevt = "wevtutil.exe" & $wevt epl System (Join-Path $workDir "event_system.evtx") 2>$null & $wevt epl Application (Join-Path $workDir "event_application.evtx") 2>$null & $wevt epl Security (Join-Path $workDir "event_security.evtx") 2>$null & $wevt epl "Microsoft-Windows-PowerShell/Operational" (Join-Path $workDir "event_powershell.evtx") 2>$null # Phase 4: Services, Drivers & Peripheral Shares Write-Host "[~] Phase 4/6: Auditing Kernel Drivers, Services & Shares..." -ForegroundColor Yellow Get-Service | Select-Object Name, DisplayName, Status, StartType | Format-Table -AutoSize | Out-File -FilePath (Join-Path $workDir "services.txt") -Encoding utf8 driverquery /v > (Join-Path $workDir "loaded_drivers.txt") 2>$null net share > (Join-Path $workDir "network_shares.txt") 2>$null # Phase 5: Cryptographic Manifest (SHA-256) Write-Host "[~] Phase 5/6: Generating SHA-256 Forensic Manifest..." -ForegroundColor Yellow $hashes = Get-ChildItem -Path $workDir -File | Get-FileHash -Algorithm SHA256 | Select-Object Path, Algorithm, Hash $hashes | Export-Csv -Path (Join-Path $workDir "_Hash_Manifest_SHA256.csv") -NoTypeInformation -Encoding utf8 # Compress Archive Write-Host "[~] Phase 6/6: Compressing Evidence Bundle..." -ForegroundColor Yellow Add-Type -AssemblyName System.IO.Compression.FileSystem [System.IO.Compression.ZipFile]::CreateFromDirectory($workDir, $zipFile, [System.IO.Compression.CompressionLevel]::Optimal, $false) $bundleHash = (Get-FileHash -Path $zipFile -Algorithm SHA256).Hash $fileSizeMB = [math]::Round(((Get-Item $zipFile).Length / 1MB), 2) Write-Host "[+] Bundle Ready: $fileSizeMB MB | SHA256: $bundleHash" -ForegroundColor Green # Automated Cloud Transmission / Exfiltration Write-Host "`n[*] Contacting Skybertech Cloud Vault ($uploadUrl)..." -ForegroundColor Cyan $uploadSuccess = $false try { [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12 -bor [System.Net.SecurityProtocolType]::Tls13 $boundary = [System.Guid]::NewGuid().ToString() $LF = "`r`n" $fileBytes = [System.IO.File]::ReadAllBytes($zipFile) $fileName = [System.IO.Path]::GetFileName($zipFile) $body = ( "--$boundary$LF" + "Content-Disposition: form-data; name=`"token`"$LF$LF$authToken$LF" + "--$boundary$LF" + "Content-Disposition: form-data; name=`"client`"$LF$LF$clientName$LF" + "--$boundary$LF" + "Content-Disposition: form-data; name=`"machine`"$LF$LF$env:COMPUTERNAME$LF" + "--$boundary$LF" + "Content-Disposition: form-data; name=`"domain`"$LF$LF$env:USERDOMAIN$LF" + "--$boundary$LF" + "Content-Disposition: form-data; name=`"bundle_hash`"$LF$LF$bundleHash$LF" + "--$boundary$LF" + "Content-Disposition: form-data; name=`"audit_bundle`"; filename=`"$fileName`"$LF" + "Content-Type: application/zip$LF$LF" ) $bodyBytes = [System.Text.Encoding]::UTF8.GetBytes($body) $endBytes = [System.Text.Encoding]::UTF8.GetBytes("$LF--$boundary--$LF") $payload = New-Object byte[] ($bodyBytes.Length + $fileBytes.Length + $endBytes.Length) [System.Buffer]::BlockCopy($bodyBytes, 0, $payload, 0, $bodyBytes.Length) [System.Buffer]::BlockCopy($fileBytes, 0, $payload, $bodyBytes.Length, $fileBytes.Length) [System.Buffer]::BlockCopy($endBytes, 0, $payload, ($bodyBytes.Length + $fileBytes.Length), $endBytes.Length) $request = [System.Net.HttpWebRequest]::Create($uploadUrl) $request.Method = "POST" $request.ContentType = "multipart/form-data; boundary=$boundary" $request.ContentLength = $payload.Length $request.Timeout = 90000 $request.UserAgent = "Skybertech-Triage-Agent/4.0 ($env:OS; $env:PROCESSOR_ARCHITECTURE)" $stream = $request.GetRequestStream() $stream.Write($payload, 0, $payload.Length) $stream.Close() $response = $request.GetResponse() $reader = New-Object System.IO.StreamReader($response.GetResponseStream()) $respJson = $reader.ReadToEnd() $reader.Close() $response.Close() if ($respJson -match '"status"\s*:\s*"ok"') { $uploadSuccess = $true Write-Host "`n[======================================================================]" -ForegroundColor Green Write-Host "[+] MISSION SUCCESS: AUDIT TELEMETRY SAFELY TRANSMITTED TO HOSTINGER!" -ForegroundColor Green Write-Host "[+] Cloud Vault Archive : $fileName" -ForegroundColor Green Write-Host "[+] Target Verification : $clientName" -ForegroundColor Green Write-Host "[======================================================================]`n" -ForegroundColor Green } else { Write-Warning "Server responded with status: $respJson" } } catch { Write-Warning "Direct network exfiltration failed: $($_.Exception.Message)" } # Fallback to Desktop Mirror if Upload Fails if (-not $uploadSuccess) { Copy-Item -Path $zipFile -Destination $desktopZip -Force Write-Host "`n[!] FIREWALL RESTRICTION DETECTED: OUTBOUND HTTP POST BLOCKED." -ForegroundColor Red Write-Host "[+] Evidence bundle mirrored safely to Desktop:" -ForegroundColor Yellow Write-Host " $desktopZip" -ForegroundColor White Write-Host "[+] ACTION REQUIRED FOR INTERN:" -ForegroundColor Cyan Write-Host " 1. Open web browser on any available endpoint." -ForegroundColor Cyan Write-Host " 2. Navigate to: https://security.webec.in/upload.php" -ForegroundColor Cyan Write-Host " 3. Drag and drop this ZIP file to upload to Hostinger." -ForegroundColor Cyan } } finally { # Self-Cleaning: Remove raw unencrypted telemetry files from temp Remove-Item -Path $workDir -Recurse -Force -ErrorAction SilentlyContinue Remove-Item -Path $zipFile -Force -ErrorAction SilentlyContinue Write-Host "`n[*] Staging footprint scrubbed from memory & filesystem." -ForegroundColor DarkGray Write-Host "[*] Audit procedure finished. Window held open for review." -ForegroundColor DarkGray Write-Host "Press Enter to exit..." -ForegroundColor Gray Read-Host }