[P2602][F1] sysacadweb SSH 7022 verified, nodo updated (IP 10.0.10.12), Win32-OpenSSH legacy

bitacoras/2026-02-28.md

@@ -55,6 +55,7 @@
 | ⏳ 11:00 | (IA) 📋 **XenServer agregado a P2602**: srv-xen1 + srvv-maurik + srvv-sysacadweb. Renombrado `srv-xen01` → `srv-xen1` en nodos/ontología. SSH `rmonla@` a srv-xen1 ✅ (password). Total: 15 guests a respaldar. |
 | ✅ 11:27 | (IA) 🧟 **OpenSSH en VMs Windows**: Instalado en srvv-fenix (`10.0.10.200`) y srvv-maurik (`10.0.10.10`) via w-zombi. SSH verificado con usuario `monlaricardo` (dominio). Credencial `win_domain` almacenada en bóveda. `[Físico: 0:21 hs]` |
 | ✅ 17:38 | (IA) 🔒 **SSH Port Hardening**: Puerto cambiado de 22 → **7022** en srvv-fenix y srvv-maurik via payload w-zombi `ssh_port7022.ps1`. Verificado: port 7022 ✅, port 22 refused ✅. `[Remoto: 0:13 hs]` |
+| ✅ 19:11 | (IA) 🧟 **OpenSSH en srvv-sysacadweb** (Win 2008R2): Instalado Win32-OpenSSH legacy via w-zombi. Config en `C:\ProgramData\ssh\`. Port 7022 ✅. IP: `10.0.10.12`. Nodo actualizado. `[Remoto: 1:43 hs]` |
 
 ### Operaciones Centrales
 

proyectos/P2602_backups.md

@@ -96,7 +96,7 @@ Automatizar el ciclo completo de backup de la DTIC — actualmente un proceso ma
 | pmox3 | 107 | srvv-data | Debian | lxc | Libre | ✅ rmonla |
 | pmox3 | 113 | srvv-sitio2 | Debian | lxc | Libre | ✅ rmonla |
 | **xen1** | — | **srvv-maurik** | **WinSrv 2019** | **windows** | **Libre** | **✅ monlaricardo** |
-| **xen1** | — | **srvv-sysacadweb** | **WinSrv 2008R2** | **windows** | **Libre** | **❌ pendiente** |
+| **xen1** | — | **srvv-sysacadweb** | **WinSrv 2008R2** | **windows** | **Libre** | **✅ monlaricardo:7022** |
 
 **Excluidos** (stopped, sin auto-inicio, en preparación): docker (100), srvv-N8N VM (114), srvv-N8N CT (115).
 

tools/w-zombi/payloads/.gitignore

@@ -0,0 +1 @@
+OpenSSH-Win64.zip

tools/w-zombi/payloads/activo.ps1

@@ -1,46 +1,27 @@
-function Log-Msg {
-    param([string]$Message)
-    Write-Host $Message -ForegroundColor Cyan
-    try {
-        Invoke-RestMethod -Uri "http://10.0.10.8:8000/log" -Method Post -Body @{msg=$Message} -UseBasicParsing -ErrorAction SilentlyContinue | Out-Null
-    } catch {}
-}
-
-Log-Msg "=========================================================="
-Log-Msg "CONFIGURANDO SSH EN PUERTO 7022"
-Log-Msg "=========================================================="
-
 $cfg = "C:\ProgramData\ssh\sshd_config"
+Write-Host "=== Cambiando SSH a puerto 7022 ===" -ForegroundColor Green
+Write-Host "Config: $cfg"
 
-try {
+# Backup
-    # Leer config, quitar cualquier linea Port anterior
+Copy-Item $cfg "$cfg.bak" -Force -ErrorAction SilentlyContinue
-    $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' }
 
-    # Agregar Port 7022 al inicio
+# Leer, reemplazar, escribir
-    $lines = @("Port 7022") + $lines
+$content = Get-Content $cfg
+$content = $content -replace '^\s*#?\s*Port\s+\d+', 'Port 7022'
+$found = $content | Select-String '^Port 7022'
+if (-not $found) { $content = @("Port 7022") + $content }
+$content | Set-Content $cfg -Force
 
-    # Escribir config limpia
+Write-Host "Verificacion:" -ForegroundColor Yellow
-    $lines | Set-Content $cfg -Force
+Get-Content $cfg | Select-String "Port"
-    Log-Msg "sshd_config actualizado: Port 7022"
 
-    # Firewall: agregar 7022, quitar 22
+Write-Host "`nReiniciando sshd..." -ForegroundColor Yellow
-    New-NetFirewallRule -Name 'SSH-7022' -DisplayName 'SSH 7022' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 7022 -ErrorAction SilentlyContinue | Out-Null
+Stop-Service sshd -Force
-    Remove-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue
+Start-Sleep -Seconds 3
-    Log-Msg "Firewall actualizado: 7022 abierto, 22 cerrado"
-
-    # Reiniciar servicio
-    Stop-Service sshd -Force -ErrorAction SilentlyContinue
-    Start-Sleep -Seconds 2
 Start-Service sshd
-    Log-Msg "Servicio sshd reiniciado OK"
 
-    $port = (Get-Content $cfg | Select-String "^Port").ToString().Trim()
+Write-Host "`n=== netstat ===" -ForegroundColor Yellow
-    Log-Msg "Verificacion: $port"
+netstat -an | Select-String "LISTEN" | Select-String "7022"
-} catch {
-    Log-Msg "ERROR: $_"
-}
 
-Log-Msg "=========================================================="
+Write-Host "`n=== LISTO ===" -ForegroundColor Green
-Log-Msg "OPERACION COMPLETADA"
+Read-Host "Presione ENTER"
-Log-Msg "=========================================================="
-exit

tools/w-zombi/payloads/install_ssh.ps1

@@ -37,4 +37,4 @@ try {
 Log-Msg "=========================================================="
 Log-Msg "OPERACION COMPLETADA. Ahora SSH esta disponible."
 Log-Msg "=========================================================="
-exit
+return

tools/w-zombi/payloads/install_ssh_legacy.ps1

@@ -0,0 +1,83 @@
+$ErrorActionPreference = "Continue"
+$logFile = "C:\ssh_install.log"
+
+function Log($msg) {
+    $ts = Get-Date -Format "HH:mm:ss"
+    $line = "[$ts] $msg"
+    Write-Host $line -ForegroundColor Cyan
+    Add-Content -Path $logFile -Value $line
+    try { (New-Object Net.WebClient).DownloadString("http://10.0.10.8:8000/log?msg=$msg") | Out-Null } catch {}
+}
+
+Log "=========================================="
+Log "OPENSSH LEGACY INSTALLER (2008R2+)"
+Log "=========================================="
+
+$sshDir = "C:\OpenSSH-Win64"
+$zipPath = "C:\OpenSSH-Win64.zip"
+$sshUrl = "http://10.0.10.8:8000/payloads/OpenSSH-Win64.zip"
+
+try {
+    if (Test-Path "$sshDir\sshd.exe") {
+        Log "OpenSSH ya instalado en $sshDir"
+    } else {
+        Log "Paso 1: Descargando ZIP..."
+        $wc = New-Object System.Net.WebClient
+        $wc.DownloadFile($sshUrl, $zipPath)
+        Log "Descarga OK ($zipPath)"
+
+        Log "Paso 2: Extrayendo ZIP..."
+        $shell = New-Object -ComObject Shell.Application
+        $zip = $shell.NameSpace($zipPath)
+        $dest = $shell.NameSpace("C:\")
+        $dest.CopyHere($zip.Items(), 0x14)
+        Log "Extraido en $sshDir"
+    }
+
+    Log "Paso 3: Instalando servicio sshd..."
+    cd $sshDir
+    powershell -ExecutionPolicy Bypass -File "$sshDir\install-sshd.ps1"
+    Log "Servicio instalado"
+
+    Log "Paso 4: Generando host keys..."
+    if (!(Test-Path "$sshDir\ssh_host_rsa_key")) {
+        & "$sshDir\ssh-keygen.exe" -A
+        Log "Host keys generadas"
+    } else {
+        Log "Host keys ya existen"
+    }
+
+    Log "Paso 5: Configurando puerto 7022..."
+    $cfg = "$sshDir\sshd_config"
+    if (Test-Path "$sshDir\sshd_config_default") {
+        Copy-Item "$sshDir\sshd_config_default" $cfg -Force
+    }
+    if (Test-Path $cfg) {
+        $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' }
+        $newContent = @("Port 7022") + $lines
+        $newContent | Set-Content $cfg -Force
+    } else {
+        "Port 7022" | Set-Content $cfg
+    }
+    Log "Config: Port 7022"
+
+    Log "Paso 6: Firewall..."
+    netsh advfirewall firewall add rule name="SSH-7022" dir=in action=allow protocol=TCP localport=7022
+    Log "Firewall actualizado"
+
+    Log "Paso 7: Iniciando servicio..."
+    Set-Service sshd -StartupType Automatic -ErrorAction SilentlyContinue
+    Start-Service sshd -ErrorAction Stop
+    Log "Servicio sshd INICIADO en puerto 7022"
+
+} catch {
+    Log "ERROR: $($_.Exception.Message)"
+    Log "LINEA: $($_.InvocationInfo.ScriptLineNumber)"
+}
+
+Log "=========================================="
+Log "FIN. Log guardado en $logFile"
+Log "=========================================="
+Write-Host ""
+Write-Host "Presiona ENTER para cerrar..." -ForegroundColor Yellow
+Read-Host

tools/w-zombi/payloads/ssh_port7022.ps1

@@ -43,4 +43,4 @@ try {
 Log-Msg "=========================================================="
 Log-Msg "OPERACION COMPLETADA"
 Log-Msg "=========================================================="
-exit
+return

tools/w-zombi/payloads/zombi_agent.bat

@@ -0,0 +1,38 @@
+@echo off
+chcp 65001 >nul 2>&1
+title W-ZOMBI Agent - Conectado a srv-ns8
+color 0A
+
+echo ======================================================
+echo    W-ZOMBI Agent — Esperando ordenes de srv-ns8
+echo ======================================================
+echo.
+echo  Este agente se queda abierto y ejecuta lo que 
+echo  srv-ns8 le envie. NO cerrar esta ventana.
+echo.
+echo  Servidor: http://10.0.10.8:8000
+echo ======================================================
+echo.
+
+:LOOP
+echo [%TIME%] Consultando payload activo...
+
+REM Descargar y ejecutar el payload activo via PowerShell
+powershell -ExecutionPolicy Bypass -Command ^
+  "$ErrorActionPreference='Continue'; " ^
+  "try { " ^
+  "  $script = (New-Object Net.WebClient).DownloadString('http://10.0.10.8:8000/payloads/activo.ps1'); " ^
+  "  if ($script -and $script.Trim() -ne '') { " ^
+  "    Write-Host '[ZOMBI] Ejecutando payload...' -ForegroundColor Green; " ^
+  "    Invoke-Expression $script " ^
+  "  } else { " ^
+  "    Write-Host '[ZOMBI] Sin payload pendiente.' -ForegroundColor DarkGray " ^
+  "  } " ^
+  "} catch { " ^
+  "  Write-Host '[ZOMBI] Sin conexion a srv-ns8, reintentando...' -ForegroundColor Yellow " ^
+  "}"
+
+echo.
+echo [%TIME%] Esperando 15 segundos... (CTRL+C para salir)
+timeout /t 15 /nobreak >nul
+goto LOOP