Suspicious 80% arch Download

thurbox 0.169.2-1

Legitimate software project with standard scripts

Dense printf decodingPowerShell execution policy bypass flag
SHA-2569a8e65a3ef31b178c09d00af4c13f2cc51eaa99eae361b1b7b6fdf52eb79315d

Evidence

Unattended agent execution mode value lines 1–10
1#!/usr/bin/env bash
2#
3# Spin up a throwaway Windows VM (Windows 11) to exercise thurbox's Windows support
4# on top of psmux (the native-Windows tmux clone). Mirrors remote-ssh-test.sh:
5# a single Podman container runs a real, KVM-accelerated Windows VM via
6# dockur/windows, with an unattended first-boot script that installs psmux +
7# OpenSSH so the harness can drive the VM headlessly over SSH — exactly like the
8# Linux remote-SSH test drives its container.
9#
10# All s …
References the user SSH directory lines 11–16
11:28… release zip, the generated /oem setup payload, and
12# the VM disk image. Nothing touches your real ~/.ssh or ~/.config.
13#
14# Usage:
15# scripts/dev/windows-test.sh up # build /oem payload + boot the VM (first run installs Windows, ~10-20 min)
16# scripts/ …
Build image installs a Windows cross-compiler lines 38–43
38:61… ease to install in the VM
39#
40# Requires: podman (with /dev/kvm + /dev/net/tun), ssh, ssh-keygen, curl.
41# Cross-build (deploy / test-suite) additionally needs the x86_64-pc-windows-gnu
42# Rust target, the mingw-w64 toolchain, and (for test-suite) cargo-nextest on the
43# host. No Rust toolchain is needed *inside* the VM: test-suite cross-buil …
References a release download URL path lines 44–70
44:51… uns it with cargo-nextest.exe.
45
46set -euo pipefail
47
48REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
49WORKDIR="${THURBOX_WIN_TEST_DIR:-$REPO_ROOT/target/windows-test}"
50IMAGE="docker.io/dockurr/windows"
51CONTAINER="thurbox-windows"
⋯6 lines
58WIN_DISK="${THURBOX_WIN_DISK:-64G}"
59PSMUX_VERSION="${PSMUX_VERSION:-v3.3.6}"
60PSMUX_ZIP_URL="https://github.com/psmux/psmux/releases/download/${PSMUX_VERSION}/psmux-${PSMUX_VERSION}-windows-x64.zip"
61NEXTEST_VERSION="${NEXTEST_VERSION:-latest}"
62# get.nexte.st serves a prebuilt cargo-nextest.exe (zip) per platform/version.
63NEXTEST_ZIP_URL="https://get.nexte.st/${NEXTEST_VERSION}/windows"
64WIN_TARGET="x86_64-pc-windows-gnu"
65
66KEY="$WORKDIR/id_ed25519"
67OEM_DIR="$WORKDIR/oem"
68STORAGE_DIR="$WORKDIR/storage"
69
70# VM credentials (the dockur default admin user). Keys are the real auth …
SSH client discards the known-hosts database lines 81–93
81:10… printf '\033[1;31merror:\033[0m %s\n' "$*" >&2; exit 1; }
82
83ssh_vm() {
84 ssh -p "$SSH_PORT" -i "$KEY" \
85 -o IdentitiesOnly=yes -o StrictHostKeyChecking=no \
86 -o UserKnownHostsFile=/dev/null -o LogLevel=ERROR -o ConnectTimeout=6 \
87 "$WIN_USER@localhost" "$@"
88}
89
90scp_vm() {
91 scp -P "$SSH_PORT" -i "$KEY" \
92 -o IdentitiesOnly=yes -o StrictHostKeyChecking=no \
93 -o UserKnownHostsFile=/dev/null -o LogLev …

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.