79083208

Date: 2024-10-13 13:13:58
Score: 2
Natty:
Report link

Although this question was asked some time ago, I'd like to provide a more comprehensive solution that might be helpful for others facing similar issues.

To terminate specific TCP connections in PowerShell without third-party tools, we can use the SetTcpEntry function from the Windows API. Here's a complete solution that includes a function for closing TCP connections:

# Define Win32 API functions
Add-Type -TypeDefinition @"
    using System;
    using System.Runtime.InteropServices;

    public class TcpHelper
    {
        [DllImport("iphlpapi.dll", SetLastError=true)]
        public static extern int SetTcpEntry(IntPtr pTcpRow);

        [StructLayout(LayoutKind.Sequential)]
        public struct MIB_TCPROW
        {
            public uint dwState;
            public uint dwLocalAddr;
            public uint dwLocalPort;
            public uint dwRemoteAddr;
            public uint dwRemotePort;
        }
    }
"@

<#
.SYNOPSIS
Closes a specified TCP connection.

.DESCRIPTION
The Close-TcpConnection function closes a TCP connection using the Windows API. It takes a connection object (typically obtained from Get-NetTCPConnection) as input and forcibly closes the connection.

.PARAMETER Connection
An object representing the TCP connection to be closed. This should be an object returned by the Get-NetTCPConnection cmdlet.

.EXAMPLE
$connection = Get-NetTCPConnection -LocalPort 12345 | Select-Object -First 1
Close-TcpConnection -Connection $connection

This example closes the TCP connection on local port 12345.

.NOTES
This function requires administrative privileges to run successfully.
#>
function Close-TcpConnection {
    param (
        [Parameter(Mandatory=$true)]
        [object]$Connection
    )

    if ($null -eq $Connection) {
        Write-Host "Connection is null"
        return
    }

    # Create MIB_TCPROW structure
    $tcpRow = New-Object TcpHelper+MIB_TCPROW
    $tcpRow.dwState = 12  # MIB_TCP_STATE_DELETE_TCB
    $tcpRow.dwLocalAddr = [System.BitConverter]::ToUInt32([System.Net.IPAddress]::Parse($Connection.LocalAddress).GetAddressBytes(), 0)
    $tcpRow.dwLocalPort = [uint16]$Connection.LocalPort -shl 8 -bor [uint16]$Connection.LocalPort -shr 8
    $tcpRow.dwRemoteAddr = [System.BitConverter]::ToUInt32([System.Net.IPAddress]::Parse($Connection.RemoteAddress).GetAddressBytes(), 0)
    $tcpRow.dwRemotePort = [uint16]$Connection.RemotePort -shl 8 -bor [uint16]$Connection.RemotePort -shr 8

    # Allocate unmanaged memory and copy structure
    $pTcpRow = [System.Runtime.InteropServices.Marshal]::AllocHGlobal([System.Runtime.InteropServices.Marshal]::SizeOf($tcpRow))
    [System.Runtime.InteropServices.Marshal]::StructureToPtr($tcpRow, $pTcpRow, $false)

    # Call SetTcpEntry
    $result = [TcpHelper]::SetTcpEntry($pTcpRow)

    # Free unmanaged memory
    [System.Runtime.InteropServices.Marshal]::FreeHGlobal($pTcpRow)

    if ($result -eq 0) {
        Write-Host "Successfully closed TCP connection"
    } else {
        Write-Host "Failed to close TCP connection, error code: $result"
    }
}

Here's how to use it:

  1. First, find the connection you want to close:
$ConnectionToKill = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -eq 'SSHServer1' -and $_.RemotePort -eq 22 } | Select-Object -First 1
  1. Then, use the Close-TcpConnection function to close the connection:
Close-TcpConnection -Connection $ConnectionToKill

Notes: This script may requires administrative privileges to run.

Reasons:
  • Long answer (-1):
  • Has code block (-0.5):
  • Me too answer (2.5): facing similar issue
  • Low reputation (1):
Posted by: Cesaryuan