using Insight.Domain.Interfaces; using Insight.Domain.Messages; using Insight.Domain.Messages.Agent; using System.Management.Automation; using System.Management.Automation.Runspaces; namespace Insight.Agent.Network.Handlers; public class ConsoleHandler : IMessageHandler { public async ValueTask HandleAsync(AgentSession sender, TMessage message, CancellationToken cancellationToken) where TMessage : IMessage { if (message is ConsoleQueryRequest consoleQueryRequest) { await OnConsoleQueryRequestAsync(sender, consoleQueryRequest, cancellationToken); } } private async ValueTask OnConsoleQueryRequestAsync(AgentSession sender, ConsoleQueryRequest consoleQueryRequest, CancellationToken cancellationToken) { var result = await QueryScriptAsync(consoleQueryRequest.Query); await sender.SendAsync(new ConsoleQuery { Id = consoleQueryRequest.Id, HostId = consoleQueryRequest.HostId, Query = consoleQueryRequest.Query, Data = result.Data, Errors = result.Errors, HadErrors = result.HadErrors }, cancellationToken); } private static async Task QueryScriptAsync(string query) { var result = new QueryResult(); var errors = new List(); try { using var runspace = RunspaceFactory.CreateRunspace(); runspace.Open(); runspace.SessionStateProxy.LanguageMode = PSLanguageMode.FullLanguage; using var ps = PowerShell.Create(runspace); ps.AddScript("Set-ExecutionPolicy unrestricted -Scope Process"); ps.AddScript(query); ps.AddCommand("ConvertTo-Json"); // -Depth 10 result.Query = query; var queryResult = await ps.InvokeAsync(); if (ps.HadErrors) { result.HadErrors = true; errors.AddRange(ps.Streams.Error.Select(e => e.ToString())); } else { result.Data = queryResult[0].ToString(); //if (string.IsNullOrWhiteSpace(jsonString)) return result; //if (jsonString.TrimStart().StartsWith("[")) // It's an array //{ // result.IsArray = true; // var deserialized = JsonSerializer.Deserialize>>(jsonString, new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping }); // if (deserialized is null) return result; // result.Data.AddRange(deserialized); // //Console.WriteLine("Deserialized to List>"); //} //else //{ // if (jsonString.TrimStart().StartsWith("{") is false) // It's an object // { // result.IsString = true; // result.Data.Add(new Dictionary { { query, jsonString.Trim('"') } }); // } // else // { // var deserialized = JsonSerializer.Deserialize>(jsonString, new JsonSerializerOptions { Encoder = JavaScriptEncoder.UnsafeRelaxedJsonEscaping }); // if (deserialized is null) return result; // result.Data.Add(deserialized); // //Console.WriteLine("Deserialized to Dictionary"); // } //} } } catch (Exception ex) { result.HadErrors = true; errors.Add(ex.Message); } result.Errors = string.Join("\n", errors); return result; } } public class QueryResult { public bool HadErrors { get; set; } public string? Query { get; set; } public string? Data { get; set; } public string? Errors { get; set; } }