Diagnosing and Remediating a Thrashed Windows Laptop via an Outbound HTTP Agent Loop

# Elevation check
if (-not ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Warning "Administrator privileges required."
    Start-Process powershell.exe -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
    exit
}

# 1. Install OpenSSH Server capability
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

# 2. Configure and start sshd service
Set-Service -Name sshd -StartupType 'Automatic'
Start-Service -Name sshd

# 3. Configure Windows Firewall rule for TCP 22
if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
}

import http.server
import json
import os
import socketserver
import time

PORT = 8000
DIRECTORY = os.path.dirname(os.path.abspath(__file__))
QUEUE_FILE = os.path.join(DIRECTORY, "task_queue.json")
RESULTS_FILE = os.path.join(DIRECTORY, "agent_results.json")

def load_queue():
    if os.path.exists(QUEUE_FILE):
        try:
            with open(QUEUE_FILE, "r") as f:
                return json.load(f)
        except Exception:
            return []
    return []

def save_queue(queue):
    with open(QUEUE_FILE, "w") as f:
        json.dump(queue, f, indent=2)

class AgentServer(http.server.SimpleHTTPRequestHandler):
    def __init__(self, *args, **kwargs):
        super().__init__(*args, directory=DIRECTORY, **kwargs)

    def do_POST(self):
        content_length = int(self.headers.get("Content-Length", 0))
        post_data = self.rfile.read(content_length)

        if self.path == "/agent/poll":
            queue = load_queue()
            if queue:
                task = queue.pop(0)
                save_queue(queue)
                response = {
                    "action": "run",
                    "name": task.get("name", "task"),
                    "script_url": task.get("script_url", ""),
                    "command": task.get("command", "")
                }
            else:
                response = {"action": "idle", "sleep": 2}

            self.send_response(200)
            self.send_header("Content-type", "application/json")
            self.end_headers()
            self.wfile.write(json.dumps(response).encode("utf-8"))

        elif self.path == "/agent/result":
            try:
                data = json.loads(post_data.decode("utf-8", errors="ignore"))
            except Exception:
                data = {"raw": post_data.decode("utf-8", errors="ignore")}

            print(f"\n[AGENT RESULT] Task: {data.get('name')}\n{data.get('output', '')}\n", flush=True)

            with open(RESULTS_FILE, "a") as f:
                f.write(json.dumps({"timestamp": time.time(), "result": data}) + "\n")

            self.send_response(200)
            self.send_header("Content-type", "application/json")
            self.end_headers()
            self.wfile.write(b'{"status":"ok"}')

        elif self.path.startswith("/report"):
            filename = "report_deep.json" if "deep" in self.path else "report.json"
            report_path = os.path.join(DIRECTORY, filename)
            with open(report_path, "wb") as f:
                f.write(post_data)

            self.send_response(200)
            self.send_header("Content-type", "application/json")
            self.end_headers()
            self.wfile.write(b'{"status":"received"}')
        else:
            self.send_response(404)
            self.end_headers()

class ReusableTCPServer(socketserver.TCPServer):
    allow_reuse_address = True

if __name__ == "__main__":
    with ReusableTCPServer(("0.0.0.0", PORT), AgentServer) as httpd:
        print(f"Agent Server listening on 0.0.0.0:{PORT}", flush=True)
        httpd.serve_forever()

$ProgressPreference = 'SilentlyContinue'
$ServerUrl = "http://192.168.1.50:8000"

Write-Host "[+] Agent runner active." -ForegroundColor Green
Write-Host "[+] Polling operator server at $ServerUrl" -ForegroundColor Cyan

while ($true) {
    try {
        $body = @{
            ComputerName = $env:COMPUTERNAME
            UserName     = $env:USERNAME
            Time         = (Get-Date).ToString("s")
        } | ConvertTo-Json

        $resp = Invoke-RestMethod -Uri "$ServerUrl/agent/poll" -Method Post -Body $body -ContentType "application/json; charset=utf-8" -TimeoutSec 10

        if ($resp.action -eq "run") {
            Write-Host "`n[*] Task received: $($resp.name)" -ForegroundColor Cyan
            $output = ""

            try {
                if ($resp.script_url) {
                    $scriptContent = Invoke-RestMethod -Uri "$ServerUrl/$($resp.script_url)"
                    $output = Invoke-Expression $scriptContent *>&1 | Out-String
                } elseif ($resp.command) {
                    $output = Invoke-Expression $resp.command *>&1 | Out-String
                }
            } catch {
                $output = "ERROR: $($_.Exception.Message)`n$($_.ScriptStackTrace)"
            }

            $resultPayload = @{
                name   = $resp.name
                output = $output
            } | ConvertTo-Json -Depth 3

            Invoke-RestMethod -Uri "$ServerUrl/agent/result" -Method Post -Body $resultPayload -ContentType "application/json; charset=utf-8" -TimeoutSec 10 | Out-Null
        } elseif ($resp.action -eq "done") {
            Write-Host "[*] Execution complete. Exiting loop." -ForegroundColor Green
            break
        } else {
            Start-Sleep -Seconds ($resp.sleep)
        }
    } catch {
        Write-Host "." -NoNewline -ForegroundColor DarkGray
        Start-Sleep -Seconds 3
    }
}

$ProgressPreference = 'SilentlyContinue'
$report = [ordered]@{}

# 1. OS and Memory
$cs = Get-CimInstance Win32_ComputerSystem
$os = Get-CimInstance Win32_OperatingSystem
$report['System'] = [ordered]@{
    Manufacturer        = $cs.Manufacturer
    Model               = $cs.Model
    TotalPhysicalRAM_GB = [math]::Round($cs.TotalPhysicalMemory / 1GB, 2)
    FreePhysicalRAM_GB  = [math]::Round($os.FreePhysicalMemory / 1MB, 2)
    OSName              = $os.Caption
    OSVersion           = $os.Version
}

# 2. CPU Frequency and Load
$cpus = Get-CimInstance Win32_Processor
$report['CPU'] = $cpus | ForEach-Object {
    [ordered]@{
        Name                  = $_.Name
        Cores                 = $_.NumberOfCores
        LogicalProcessors     = $_.NumberOfLogicalProcessors
        MaxClockSpeed_MHz     = $_.MaxClockSpeed
        CurrentClockSpeed_MHz = $_.CurrentClockSpeed
        LoadPercentage        = $_.LoadPercentage
    }
}

# 3. Storage Hardware
$report['PhysicalDisks'] = Get-PhysicalDisk | ForEach-Object {
    [ordered]@{
        DeviceId          = $_.DeviceId
        FriendlyName      = $_.FriendlyName
        MediaType         = $_.MediaType
        BusType           = $_.BusType
        Size_GB           = [math]::Round($_.Size / 1GB, 2)
        HealthStatus      = $_.HealthStatus
        OperationalStatus = $_.OperationalStatus
    }
}

# 4. Top Resource Consumers
$report['TopCPUProcesses'] = Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 | ForEach-Object {
    [ordered]@{ Name = $_.ProcessName; Id = $_.Id; CPU = [math]::Round($_.CPU, 2); WorkingSet_MB = [math]::Round($_.WorkingSet64 / 1MB, 2) }
}
$report['TopMemoryProcesses'] = Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 10 | ForEach-Object {
    [ordered]@{ Name = $_.ProcessName; Id = $_.Id; WorkingSet_MB = [math]::Round($_.WorkingSet64 / 1MB, 2) }
}

# 5. Event Log Analysis (WHEA and storage errors over the last 48 hours)
$since = (Get-Date).AddDays(-2)
$report['HardwareEvents'] = Get-WinEvent -FilterHashtable @{
    LogName = 'System'; Level = 1, 2, 3; StartTime = $since
} -MaxEvents 50 -ErrorAction SilentlyContinue | Where-Object {
    $_.ProviderName -match 'disk|WHEA|Kernel-Power|storahci'
} | Select-Object -First 10 | ForEach-Object {
    [ordered]@{ TimeCreated = $_.TimeCreated.ToString('s'); ProviderName = $_.ProviderName; Id = $_.Id; Message = ($_.Message -split "`r?`n")[0] }
}

$json = $report | ConvertTo-Json -Depth 5
Invoke-RestMethod -Uri "http://192.168.1.50:8000/report" -Method Post -Body $json -ContentType "application/json; charset=utf-8"

Write-Host "[1/5] Disabling PCIe Link State Power Management (WHEA Event 17)..." -ForegroundColor Cyan
try {
    # GUID 0ee12f90-76e7-4b4d-9e91-b3a2b56e0893 = Link State Power Management
    # Setting index 0 = Off
    powercfg /setacvalueindex SCHEME_CURRENT SUB_PCIEXPRESS 0ee12f90-76e7-4b4d-9e91-b3a2b56e0893 0
    powercfg /setdcvalueindex SCHEME_CURRENT SUB_PCIEXPRESS 0ee12f90-76e7-4b4d-9e91-b3a2b56e0893 0
    powercfg /setactive SCHEME_CURRENT
    Write-Host "[OK] PCIe ASPM disabled." -ForegroundColor Green
} catch {
    Write-Warning "Failed to set PCIe power profile: $_"
}

Write-Host "`n[2/5] Disabling disk-thrashing background services..." -ForegroundColor Cyan
$servicesToDisable = @('SysMain', 'DiagTrack')
foreach ($svc in $servicesToDisable) {
    if (Get-Service -Name $svc -ErrorAction SilentlyContinue) {
        Stop-Service -Name $svc -Force -ErrorAction SilentlyContinue
        Set-Service -Name $svc -StartupType Disabled
        Write-Host "[OK] Service disabled: $svc" -ForegroundColor Green
    }
}

Write-Host "`n[3/5] Terminating memory leaks and cleaning startup items..." -ForegroundColor Cyan
Get-Process -Name "PhoneExperienceHost", "CrossDeviceService" -ErrorAction SilentlyContinue | Stop-Process -Force -ErrorAction SilentlyContinue
Set-Service -Name "CrossDeviceService" -StartupType Manual -ErrorAction SilentlyContinue

$runKeyPath = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
$bloatEntries = @(
    'Teams',
    'OneDrive',
    'Adobe Acrobat Synchronizer',
    'MicrosoftEdgeAutoLaunch_9EDF312A5B50E1CCDC30082229C6FF51'
)
foreach ($entry in $bloatEntries) {
    if (Get-ItemProperty -Path $runKeyPath -Name $entry -ErrorAction SilentlyContinue) {
        Remove-ItemProperty -Path $runKeyPath -Name $entry -ErrorAction SilentlyContinue
        Write-Host "[OK] Removed autostart entry: $entry" -ForegroundColor Green
    }
}

Write-Host "`n[4/5] Executing SSD TRIM optimization..." -ForegroundColor Cyan
try {
    Optimize-Volume -DriveLetter C -ReTrim -Verbose -ErrorAction SilentlyContinue
    Write-Host "[OK] TRIM issued to C: drive." -ForegroundColor Green
} catch {
    Write-Warning "TRIM error: $_"
}

[Baseline]  Temp: 71°C | Clock: 1600 MHz
[T + 10s]   Temp: 71°C | Clock: 1600 MHz | Load: 79%
[T + 20s]   Temp: 71°C | Clock: 1600 MHz | Load: 100%
[T + 30s]   Temp: 71°C | Clock: 1600 MHz | Load: 100%
[T + 40s]   Temp: 71°C | Clock: 1600 MHz | Load: 100%
[T + 50s]   Temp: 71°C | Clock: 1600 MHz | Load: 100%
[T + 60s]   Temp: 71°C | Clock: 1600 MHz | Load: 84%
Peak Temperature: 71°C