ip = $ip; $this->username = $username; $this->password = $password; $this->url = "http://{$this->ip}:53389/wsman"; $this->auth = base64_encode("{$this->username}:{$this->password}"); } private function send_winrm_request($headers, $body) { try { // Make the HTTP POST request $response = Http::withHeaders($headers) ->withBasicAuth('administrator', 'Thegioiso@123**$$8899TgTk2') ->timeout(20) // Timeout in seconds ->withBody($body, 'application/soap+xml;charset=UTF-8') // Ensure the correct content type ->withoutVerifying() // Disable SSL verification ->post($this->url); // Check for a successful response if ($response->successful()) { return $response->body(); } // Handle response errors return 'Error: ' . $response->status() . ' - ' . $response->body(); } catch (\Exception $e) { // Handle exceptions return 'Exception: ' . $e->getMessage(); } } private function get_headers() { return [ "Host: {$this->ip}:53389", "User-Agent: PHP WinRM client", "Accept-Encoding: gzip, deflate, br", "Accept: */*", "Connection: keep-alive", "Content-Type: application/soap+xml;charset=UTF-8", "Authorization: Basic {$this->auth}" ]; } public function execute_command($command) { $headers = $this->get_headers(); // Step 1: Create Shell $create_shell_body = $this->get_create_shell_body(); $response = $this->send_winrm_request($headers, $create_shell_body); $shell_id = preg_match('/(.*?)<\/rsp:ShellId>/s', $response, $matches) ? $matches[1] : null; if (!$shell_id) { return "Failed to create shell session."; } // Step 2: Execute Command $execute_command_body = $this->get_execute_command_body($shell_id, $command); $response = $this->send_winrm_request($headers, $execute_command_body); $command_id = preg_match('/(.*?)<\/rsp:CommandId>/s', $response, $matches) ? $matches[1] : null; if (!$command_id) { return "Failed to execute command."; } // Step 3: Receive Command Output $receive_output_body = $this->get_receive_output_body($shell_id, $command_id); $response = $this->send_winrm_request($headers, $receive_output_body); $output = $this->parse_command_output($response, $command_id); // Step 4: Signal Termination $signal_termination_body = $this->get_signal_termination_body($shell_id, $command_id); $this->send_winrm_request($headers, $signal_termination_body); // Step 5: Delete Shell Session $delete_shell_body = $this->get_delete_shell_body($shell_id); $this->send_winrm_request($headers, $delete_shell_body); return $output; } private function get_create_shell_body() { // XML body for creating a shell return ' http://' . $this->ip . ':53389/wsman http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous 153600 uuid:' . uniqid() . ' PT60S http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd http://schemas.xmlsoap.org/ws/2004/09/transfer/Create FALSE 437 stdin stdout stderr '; } private function get_execute_command_body($shell_id, $command) { // XML body for executing a command return ' http://' . $this->ip . ':53389/wsman http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous 153600 uuid:' . uniqid() . ' PT60S http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Command ' . $shell_id . ' ' . $command . ' '; } private function get_receive_output_body($shell_id, $command_id) { // XML body for receiving command output return ' http://' . $this->ip . ':53389/wsman http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous 153600 uuid:' . uniqid() . ' PT60S http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Receive ' . $shell_id . ' stdout stderr '; } private function parse_command_output($response, $command_id) { preg_match_all('/(.*?)<\/rsp:Stream>/s', $response, $matches); $output = ''; foreach ($matches[1] as $base64_output) { $decoded = base64_decode($base64_output); // Normalize line endings to \n $decoded = preg_replace('/\r\n|\r/', "\n", $decoded); $output .= $decoded; } return trim($output); // Remove any leading/trailing whitespace } private function get_signal_termination_body($shell_id, $command_id) { // XML body for signaling termination return ' http://' . $this->ip . ':53389/wsman http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous 153600 uuid:' . uniqid() . ' PT60S http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd http://schemas.microsoft.com/wbem/wsman/1/windows/shell/Signal ' . $shell_id . ' http://schemas.microsoft.com/wbem/wsman/1/windows/shell/signal/terminate '; } private function get_delete_shell_body($shell_id) { // XML body for deleting the shell session return ' http://' . $this->ip . ':53389/wsman http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous 153600 uuid:' . uniqid() . ' PT60S http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd http://schemas.xmlsoap.org/ws/2004/09/transfer/Delete ' . $shell_id . ' '; } }