From d74fb2c8c08e2e3a5c0500a94dbc5b4cfc3446a4 Mon Sep 17 00:00:00 2001 From: Ricardo Monla Date: Sat, 28 Feb 2026 19:12:43 -0300 Subject: [PATCH] [P2602][F1] sysacadweb SSH 7022 verified, nodo updated (IP 10.0.10.12), Win32-OpenSSH legacy --- bitacoras/2026-02-28.md | 1 + proyectos/P2602_backups.md | 2 +- tools/w-zombi/payloads/.gitignore | 1 + tools/w-zombi/payloads/activo.ps1 | 61 +++++--------- tools/w-zombi/payloads/install_ssh.ps1 | 2 +- tools/w-zombi/payloads/install_ssh_legacy.ps1 | 83 +++++++++++++++++++ tools/w-zombi/payloads/ssh_port7022.ps1 | 2 +- tools/w-zombi/payloads/zombi_agent.bat | 38 +++++++++ 8 files changed, 147 insertions(+), 43 deletions(-) create mode 100644 tools/w-zombi/payloads/.gitignore create mode 100644 tools/w-zombi/payloads/install_ssh_legacy.ps1 create mode 100644 tools/w-zombi/payloads/zombi_agent.bat diff --git a/bitacoras/2026-02-28.md b/bitacoras/2026-02-28.md index 7967f2a5..f604142d 100644 --- a/bitacoras/2026-02-28.md +++ b/bitacoras/2026-02-28.md @@ -55,6 +55,7 @@ | ⏳ 11:00 | (IA) 📋 **XenServer agregado a P2602**: srv-xen1 + srvv-maurik + srvv-sysacadweb. Renombrado `srv-xen01` → `srv-xen1` en nodos/ontología. SSH `rmonla@` a srv-xen1 ✅ (password). Total: 15 guests a respaldar. | | ✅ 11:27 | (IA) 🧟 **OpenSSH en VMs Windows**: Instalado en srvv-fenix (`10.0.10.200`) y srvv-maurik (`10.0.10.10`) via w-zombi. SSH verificado con usuario `monlaricardo` (dominio). Credencial `win_domain` almacenada en bóveda. `[Físico: 0:21 hs]` | | ✅ 17:38 | (IA) 🔒 **SSH Port Hardening**: Puerto cambiado de 22 → **7022** en srvv-fenix y srvv-maurik via payload w-zombi `ssh_port7022.ps1`. Verificado: port 7022 ✅, port 22 refused ✅. `[Remoto: 0:13 hs]` | +| ✅ 19:11 | (IA) 🧟 **OpenSSH en srvv-sysacadweb** (Win 2008R2): Instalado Win32-OpenSSH legacy via w-zombi. Config en `C:\ProgramData\ssh\`. Port 7022 ✅. IP: `10.0.10.12`. Nodo actualizado. `[Remoto: 1:43 hs]` | ### Operaciones Centrales diff --git a/proyectos/P2602_backups.md b/proyectos/P2602_backups.md index ef4caed7..02406ad7 100644 --- a/proyectos/P2602_backups.md +++ b/proyectos/P2602_backups.md @@ -96,7 +96,7 @@ Automatizar el ciclo completo de backup de la DTIC — actualmente un proceso ma | pmox3 | 107 | srvv-data | Debian | lxc | Libre | ✅ rmonla | | pmox3 | 113 | srvv-sitio2 | Debian | lxc | Libre | ✅ rmonla | | **xen1** | — | **srvv-maurik** | **WinSrv 2019** | **windows** | **Libre** | **✅ monlaricardo** | -| **xen1** | — | **srvv-sysacadweb** | **WinSrv 2008R2** | **windows** | **Libre** | **❌ pendiente** | +| **xen1** | — | **srvv-sysacadweb** | **WinSrv 2008R2** | **windows** | **Libre** | **✅ monlaricardo:7022** | **Excluidos** (stopped, sin auto-inicio, en preparación): docker (100), srvv-N8N VM (114), srvv-N8N CT (115). diff --git a/tools/w-zombi/payloads/.gitignore b/tools/w-zombi/payloads/.gitignore new file mode 100644 index 00000000..ac8f6b91 --- /dev/null +++ b/tools/w-zombi/payloads/.gitignore @@ -0,0 +1 @@ +OpenSSH-Win64.zip diff --git a/tools/w-zombi/payloads/activo.ps1 b/tools/w-zombi/payloads/activo.ps1 index cf6162a8..97b5fd2d 100644 --- a/tools/w-zombi/payloads/activo.ps1 +++ b/tools/w-zombi/payloads/activo.ps1 @@ -1,46 +1,27 @@ -function Log-Msg { - param([string]$Message) - Write-Host $Message -ForegroundColor Cyan - try { - Invoke-RestMethod -Uri "http://10.0.10.8:8000/log" -Method Post -Body @{msg=$Message} -UseBasicParsing -ErrorAction SilentlyContinue | Out-Null - } catch {} -} - -Log-Msg "==========================================================" -Log-Msg "CONFIGURANDO SSH EN PUERTO 7022" -Log-Msg "==========================================================" - $cfg = "C:\ProgramData\ssh\sshd_config" +Write-Host "=== Cambiando SSH a puerto 7022 ===" -ForegroundColor Green +Write-Host "Config: $cfg" -try { - # Leer config, quitar cualquier linea Port anterior - $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' } - - # Agregar Port 7022 al inicio - $lines = @("Port 7022") + $lines - - # Escribir config limpia - $lines | Set-Content $cfg -Force - Log-Msg "sshd_config actualizado: Port 7022" +# Backup +Copy-Item $cfg "$cfg.bak" -Force -ErrorAction SilentlyContinue - # Firewall: agregar 7022, quitar 22 - New-NetFirewallRule -Name 'SSH-7022' -DisplayName 'SSH 7022' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 7022 -ErrorAction SilentlyContinue | Out-Null - Remove-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue - Log-Msg "Firewall actualizado: 7022 abierto, 22 cerrado" +# Leer, reemplazar, escribir +$content = Get-Content $cfg +$content = $content -replace '^\s*#?\s*Port\s+\d+', 'Port 7022' +$found = $content | Select-String '^Port 7022' +if (-not $found) { $content = @("Port 7022") + $content } +$content | Set-Content $cfg -Force - # Reiniciar servicio - Stop-Service sshd -Force -ErrorAction SilentlyContinue - Start-Sleep -Seconds 2 - Start-Service sshd - Log-Msg "Servicio sshd reiniciado OK" +Write-Host "Verificacion:" -ForegroundColor Yellow +Get-Content $cfg | Select-String "Port" - $port = (Get-Content $cfg | Select-String "^Port").ToString().Trim() - Log-Msg "Verificacion: $port" -} catch { - Log-Msg "ERROR: $_" -} +Write-Host "`nReiniciando sshd..." -ForegroundColor Yellow +Stop-Service sshd -Force +Start-Sleep -Seconds 3 +Start-Service sshd -Log-Msg "==========================================================" -Log-Msg "OPERACION COMPLETADA" -Log-Msg "==========================================================" -exit +Write-Host "`n=== netstat ===" -ForegroundColor Yellow +netstat -an | Select-String "LISTEN" | Select-String "7022" + +Write-Host "`n=== LISTO ===" -ForegroundColor Green +Read-Host "Presione ENTER" diff --git a/tools/w-zombi/payloads/install_ssh.ps1 b/tools/w-zombi/payloads/install_ssh.ps1 index dbb1bcd9..a6cd6cd2 100644 --- a/tools/w-zombi/payloads/install_ssh.ps1 +++ b/tools/w-zombi/payloads/install_ssh.ps1 @@ -37,4 +37,4 @@ try { Log-Msg "==========================================================" Log-Msg "OPERACION COMPLETADA. Ahora SSH esta disponible." Log-Msg "==========================================================" -exit +return diff --git a/tools/w-zombi/payloads/install_ssh_legacy.ps1 b/tools/w-zombi/payloads/install_ssh_legacy.ps1 new file mode 100644 index 00000000..cda1e397 --- /dev/null +++ b/tools/w-zombi/payloads/install_ssh_legacy.ps1 @@ -0,0 +1,83 @@ +$ErrorActionPreference = "Continue" +$logFile = "C:\ssh_install.log" + +function Log($msg) { + $ts = Get-Date -Format "HH:mm:ss" + $line = "[$ts] $msg" + Write-Host $line -ForegroundColor Cyan + Add-Content -Path $logFile -Value $line + try { (New-Object Net.WebClient).DownloadString("http://10.0.10.8:8000/log?msg=$msg") | Out-Null } catch {} +} + +Log "==========================================" +Log "OPENSSH LEGACY INSTALLER (2008R2+)" +Log "==========================================" + +$sshDir = "C:\OpenSSH-Win64" +$zipPath = "C:\OpenSSH-Win64.zip" +$sshUrl = "http://10.0.10.8:8000/payloads/OpenSSH-Win64.zip" + +try { + if (Test-Path "$sshDir\sshd.exe") { + Log "OpenSSH ya instalado en $sshDir" + } else { + Log "Paso 1: Descargando ZIP..." + $wc = New-Object System.Net.WebClient + $wc.DownloadFile($sshUrl, $zipPath) + Log "Descarga OK ($zipPath)" + + Log "Paso 2: Extrayendo ZIP..." + $shell = New-Object -ComObject Shell.Application + $zip = $shell.NameSpace($zipPath) + $dest = $shell.NameSpace("C:\") + $dest.CopyHere($zip.Items(), 0x14) + Log "Extraido en $sshDir" + } + + Log "Paso 3: Instalando servicio sshd..." + cd $sshDir + powershell -ExecutionPolicy Bypass -File "$sshDir\install-sshd.ps1" + Log "Servicio instalado" + + Log "Paso 4: Generando host keys..." + if (!(Test-Path "$sshDir\ssh_host_rsa_key")) { + & "$sshDir\ssh-keygen.exe" -A + Log "Host keys generadas" + } else { + Log "Host keys ya existen" + } + + Log "Paso 5: Configurando puerto 7022..." + $cfg = "$sshDir\sshd_config" + if (Test-Path "$sshDir\sshd_config_default") { + Copy-Item "$sshDir\sshd_config_default" $cfg -Force + } + if (Test-Path $cfg) { + $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' } + $newContent = @("Port 7022") + $lines + $newContent | Set-Content $cfg -Force + } else { + "Port 7022" | Set-Content $cfg + } + Log "Config: Port 7022" + + Log "Paso 6: Firewall..." + netsh advfirewall firewall add rule name="SSH-7022" dir=in action=allow protocol=TCP localport=7022 + Log "Firewall actualizado" + + Log "Paso 7: Iniciando servicio..." + Set-Service sshd -StartupType Automatic -ErrorAction SilentlyContinue + Start-Service sshd -ErrorAction Stop + Log "Servicio sshd INICIADO en puerto 7022" + +} catch { + Log "ERROR: $($_.Exception.Message)" + Log "LINEA: $($_.InvocationInfo.ScriptLineNumber)" +} + +Log "==========================================" +Log "FIN. Log guardado en $logFile" +Log "==========================================" +Write-Host "" +Write-Host "Presiona ENTER para cerrar..." -ForegroundColor Yellow +Read-Host diff --git a/tools/w-zombi/payloads/ssh_port7022.ps1 b/tools/w-zombi/payloads/ssh_port7022.ps1 index cf6162a8..50108189 100644 --- a/tools/w-zombi/payloads/ssh_port7022.ps1 +++ b/tools/w-zombi/payloads/ssh_port7022.ps1 @@ -43,4 +43,4 @@ try { Log-Msg "==========================================================" Log-Msg "OPERACION COMPLETADA" Log-Msg "==========================================================" -exit +return diff --git a/tools/w-zombi/payloads/zombi_agent.bat b/tools/w-zombi/payloads/zombi_agent.bat new file mode 100644 index 00000000..086676fa --- /dev/null +++ b/tools/w-zombi/payloads/zombi_agent.bat @@ -0,0 +1,38 @@ +@echo off +chcp 65001 >nul 2>&1 +title W-ZOMBI Agent - Conectado a srv-ns8 +color 0A + +echo ====================================================== +echo W-ZOMBI Agent — Esperando ordenes de srv-ns8 +echo ====================================================== +echo. +echo Este agente se queda abierto y ejecuta lo que +echo srv-ns8 le envie. NO cerrar esta ventana. +echo. +echo Servidor: http://10.0.10.8:8000 +echo ====================================================== +echo. + +:LOOP +echo [%TIME%] Consultando payload activo... + +REM Descargar y ejecutar el payload activo via PowerShell +powershell -ExecutionPolicy Bypass -Command ^ + "$ErrorActionPreference='Continue'; " ^ + "try { " ^ + " $script = (New-Object Net.WebClient).DownloadString('http://10.0.10.8:8000/payloads/activo.ps1'); " ^ + " if ($script -and $script.Trim() -ne '') { " ^ + " Write-Host '[ZOMBI] Ejecutando payload...' -ForegroundColor Green; " ^ + " Invoke-Expression $script " ^ + " } else { " ^ + " Write-Host '[ZOMBI] Sin payload pendiente.' -ForegroundColor DarkGray " ^ + " } " ^ + "} catch { " ^ + " Write-Host '[ZOMBI] Sin conexion a srv-ns8, reintentando...' -ForegroundColor Yellow " ^ + "}" + +echo. +echo [%TIME%] Esperando 15 segundos... (CTRL+C para salir) +timeout /t 15 /nobreak >nul +goto LOOP