Scribd
Upload
112 views2 pages

Massgrave Command Update and Troubleshooting

The document provides instructions for transitioning from an old command to a new one for retrieving a script from massgrave.dev. It includes troubleshooting steps for issues related to PowerShell language mode and third-party antivirus interference. Additionally, it outlines the process for verifying script integrity and handling potential CMD issues.

Uploaded by

Charner Bacani
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
112 views2 pages

Massgrave Command Update and Troubleshooting

The document provides instructions for transitioning from an old command to a new one for retrieving a script from massgrave.dev. It includes troubleshooting steps for issues related to PowerShell language mode and third-party antivirus interference. Additionally, it outlines the process for verifying script integrity and handling potential CMD issues.

Uploaded by

Charner Bacani
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

# Check massgrave.

dev for more details write-host Write-Host "The current command (irm
[Link] | iex) will be retired in the future." Write-Host -ForegroundColor
Green "Use the new command (irm [Link] | iex) moving forward." write-host
$troubleshoot = '[Link] if
($[Link].value__ -ne 0)
{ $[Link] Write-Host "Windows PowerShell is not
running in Full Language Mode." Write-Host "Help - [Link] -
ForegroundColor White -BackgroundColor Blue return } function Check3rdAV { $avList = Get-
CimInstance -Namespace root\SecurityCenter2 -Class AntiVirusProduct | Where-Object
{ $_.displayName -notlike '*windows*' } | Select-Object -ExpandProperty displayName if
($avList) { Write-Host '3rd party Antivirus might be blocking the script - ' -ForegroundColor
White -BackgroundColor Blue -NoNewline Write-Host " $($avList -join ', ')" -ForegroundColor
DarkRed -BackgroundColor White } } function CheckFile { param ([string]$FilePath) if (-not
(Test-Path $FilePath)) { Check3rdAV Write-Host "Failed to create MAS file in temp folder,
aborting!" Write-Host "Help - $troubleshoot" -ForegroundColor White -BackgroundColor Blue
throw } } [[Link]]::SecurityProtocol = [[Link]]::Tls12
$URLs = @( '[Link]
2a2352428eb2735ceb973f1d3795948dddf71752/MAS/All-In-One-Version-KL/MAS_AIO.cmd',
'[Link]
Activation-Scripts/items?path=/MAS/All-In-One-Version-KL/
MAS_AIO.cmd&versionType=Commit&version=2a2352428eb2735ceb973f1d3795948dddf717
52', '[Link]
2a2352428eb2735ceb973f1d3795948dddf71752/MAS/All-In-One-Version-KL/
MAS_AIO.cmd' ) foreach ($URL in $URLs | Sort-Object { Get-Random }) { try { $response =
Invoke-WebRequest -Uri $URL -UseBasicParsing; break } catch {} } if (-not $response)
{ Check3rdAV Write-Host "Failed to retrieve MAS from any of the available repositories,
aborting!" Write-Host "Help - $troubleshoot" -ForegroundColor White -BackgroundColor Blue
return } # Verify script integrity $releaseHash =
'5FDDC4C7FE3D51CA291EF49C1A6EA9DF7F5EE5171D5BEBC4678600DA233E55D5'
$stream = New-Object [Link] $writer = New-Object [Link] $stream
$[Link]($response) $[Link]() $[Link] = 0 $hash =
[BitConverter]::ToString([[Link].SHA256]::Create().ComputeHash($stream)) -
replace '-' if ($hash -ne $releaseHash) { Write-Warning "Hash ($hash) mismatch, aborting!
`nReport this issue at $troubleshoot" $response = $null return } # Check for AutoRun registry
which may create issues with CMD $paths = "HKCU:\SOFTWARE\Microsoft\Command
Processor", "HKLM:\SOFTWARE\Microsoft\Command Processor" foreach ($path in $paths)
{ if (Get-ItemProperty -Path $path -Name "Autorun" -ErrorAction SilentlyContinue) { Write-
Warning "Autorun registry found, CMD may crash! `nManually copy-paste the below command
to fix...`nRemove-ItemProperty -Path '$path' -Name 'Autorun'" } } $rand =
[Guid]::NewGuid().Guid $isAdmin = [bool]
([[Link]]::GetCurrent().Groups -match 'S-1-5-32-544') $FilePath =
if ($isAdmin) { "$env:SystemRoot\Temp\MAS_$[Link]" } else { "$env:USERPROFILE\
AppData\Local\Temp\MAS_$[Link]" } Set-Content -Path $FilePath -Value "@::: $rand
`r`n$response" CheckFile $FilePath $env:ComSpec = "$env:SystemRoot\system32\[Link]"
$chkcmd = & $env:ComSpec /c "echo CMD is working" if ($chkcmd -notcontains "CMD is
working") { Write-Warning "[Link] is not working.`nReport this issue at $troubleshoot" } saps
-FilePath $env:ComSpec -ArgumentList "/c """"$FilePath"" $args""" -Wait CheckFile $FilePath
$FilePaths = @("$env:SystemRoot\Temp\MAS*.cmd", "$env:USERPROFILE\AppData\Local\
Temp\MAS*.cmd") foreach ($FilePath in $FilePaths) { Get-Item $FilePath | Remove-Item }

Common questions

Powered by AI

Post-execution, the script seeks out temporary files starting with 'MAS' located in system or user temporary directories and deletes them. These cleanup operations help prevent unnecessary file accumulation, ensuring that system storage remains optimized and secure .

The function 'Check3rdAV' is used to detect if any third-party antivirus software products might block the script execution. It does so by retrieving antivirus products from the 'root\SecurityCenter2' namespace and excluding those with 'windows' in their display name. If such software is present, it alerts the user .

The script checks if 'cmd.exe' is functioning by attempting an echo operation and analyzing the result. If it is not functioning, a warning is issued, and users are directed to report the issue via the troubleshoot link, emphasizing transparency in handling potential execution failures .

The script is designed to operate in an environment with administrative privileges, highlighted by a condition checking if the current identity group matches 'S-1-5-32-544'. It accordingly sets file paths for the script execution based on the availability of such privileges, ensuring the necessary permissions for its operations .

If an Autorun registry entry is detected, the script warns that CMD may crash and suggests the user manually remove the registry property using the command 'Remove-ItemProperty -Path [path] -Name 'Autorun'', guiding them towards self-resolution and preventing potential command-line conflicts .

The script utilizes a set of multiple URLs to retrieve the script components. It iteratively attempts to download the script from these URLs using 'Invoke-WebRequest', sorted in a random order, thus ensuring redundancy. If downloading fails from all sources, it attempts to diagnose potential issues like antivirus interference .

The current command used for massgrave.dev scripts, namely 'irm https://massgrave.dev/get | iex', is set to be retired soon, and users are advised to switch to using 'irm https://get.activated.win | iex'. This change is likely made to improve script efficiency, security, or reliability .

The script checks if PowerShell is running in Full Language Mode by comparing the LanguageMode value against 0. If it is not running in Full Language Mode, the script outputs a message and provides a link to resolve the issue, 'https://gravesoft.dev/fix_powershell', enhancing the user's capability to switch modes easily .

The script checks the existence of files using the 'Test-Path' cmdlet in the 'CheckFile' function. If the file does not exist, it attempts to diagnose the issue by invoking the 'Check3rdAV' function and alerts the user with a failure message, directing them to troubleshooting resources at 'https://massgrave.dev/troubleshoot' .

The script verifies the integrity of the downloaded script by computing the SHA-256 hash of the script content and comparing it against a known hash value, '5FDDC4C7FE3D51CA291EF49C1A6EA9DF7F5EE5171D5BEBC4678600DA233E55D5'. Any mismatch in hashing results in an operation abort with user notification, ensuring that only untampered scripts are utilized .

You might also like