初版功能完成

2026-08-29 13:12:17 +08:00
commit 142e5dc7d6
217 changed files with 21313 additions and 0 deletions
@@ -0,0 +1,46 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [ValidateSet("Engineer", "Site")]
+    [string]$Role,
+    [Parameter(Mandatory = $true)]
+    [string]$OutputDirectory
+)
+
+$ErrorActionPreference = "Stop"
+$resolved = [System.IO.Path]::GetFullPath($OutputDirectory)
+New-Item -ItemType Directory -Force -Path $resolved | Out-Null
+$stamp = (Get-Date).ToUniversalTime().ToString("yyyyMMddTHHmmssZ")
+$prefix = "$stamp-$($Role.ToLowerInvariant())"
+
+$adapters = Get-NetAdapter -IncludeHidden | Select-Object Name, InterfaceDescription, ifIndex, Status, MacAddress, LinkSpeed
+$remlinkAdapters = @($adapters | Where-Object Name -eq "RemLink")
+$ipConfiguration = Get-NetIPConfiguration -All | Select-Object InterfaceAlias, InterfaceIndex, IPv4Address, IPv4DefaultGateway, DNSServer
+$routes = Get-NetRoute -AddressFamily IPv4 | Select-Object DestinationPrefix, NextHop, InterfaceAlias, InterfaceIndex, RouteMetric, Protocol, PolicyStore
+$nat = @(Get-NetNat -ErrorAction SilentlyContinue | Select-Object Name, InternalIPInterfaceAddressPrefix, ExternalIPInterfaceAddressPrefix, Active)
+$processes = Get-Process | Where-Object ProcessName -Match "RemLink|wireguard" | Select-Object ProcessName, Id, Path, StartTime
+
+$inventory = [ordered]@{
+    captured_at = (Get-Date).ToUniversalTime().ToString("o")
+    computer = $env:COMPUTERNAME
+    role = $Role
+    elevated = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
+    remlink_adapter_count = $remlinkAdapters.Count
+    remlink_adapters = $remlinkAdapters
+    adapters = $adapters
+    ip_configuration = $ipConfiguration
+    ipv4_routes = $routes
+    existing_nat_read_only_snapshot = $nat
+    processes = $processes
+}
+$path = Join-Path $resolved "$prefix-network.json"
+$inventory | ConvertTo-Json -Depth 8 | Set-Content -Encoding utf8 $path
+Get-FileHash -Algorithm SHA256 $path | Format-List | Out-File -Encoding utf8 (Join-Path $resolved "$prefix-network.sha256.txt")
+
+if ($remlinkAdapters.Count -ne 1) {
+    throw "Expected exactly one adapter named RemLink; found $($remlinkAdapters.Count). Evidence was saved to $path"
+}
+if (@($adapters | Where-Object { $_.Name -Match "WireGuard" -or $_.InterfaceDescription -Match "WireGuardNT" }).Count -ne 0) {
+    throw "Unexpected independent WireGuard/WireGuardNT adapter detected. Evidence was saved to $path"
+}
+Write-Host "Windows evidence captured: $path"