1551bd5dad
Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests. Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs. Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.
73 lines
2.0 KiB
Go
73 lines
2.0 KiB
Go
//go:build windows
|
|
|
|
package client
|
|
|
|
import (
|
|
"strings"
|
|
)
|
|
|
|
func collectPersistenceAudit() PersistenceAuditReport {
|
|
report := PersistenceAuditReport{Platform: "windows"}
|
|
queries := []struct {
|
|
kind, hive, sub string
|
|
}{
|
|
{"registry_run", "HKCU", `Software\Microsoft\Windows\CurrentVersion\Run`},
|
|
{"registry_run", "HKCU", `Software\Microsoft\Windows\CurrentVersion\RunOnce`},
|
|
{"registry_run", "HKLM", `Software\Microsoft\Windows\CurrentVersion\Run`},
|
|
{"registry_run", "HKLM", `Software\Microsoft\Windows\CurrentVersion\RunOnce`},
|
|
}
|
|
for _, q := range queries {
|
|
out, err := silentCombinedOutput("reg", "query", q.hive+`\`+q.sub)
|
|
if err != nil {
|
|
continue
|
|
}
|
|
for _, line := range strings.Split(string(out), "\n") {
|
|
line = strings.TrimSpace(line)
|
|
if line == "" || strings.HasPrefix(line, "HKEY_") || strings.HasPrefix(line, q.sub) {
|
|
continue
|
|
}
|
|
parts := strings.Fields(line)
|
|
if len(parts) < 2 {
|
|
continue
|
|
}
|
|
name := parts[0]
|
|
val := strings.Join(parts[2:], " ")
|
|
if strings.EqualFold(name, "REG_SZ") || strings.EqualFold(name, "REG_EXPAND_SZ") {
|
|
continue
|
|
}
|
|
report.Entries = append(report.Entries, PersistenceAuditEntry{
|
|
Kind: q.kind,
|
|
Name: name,
|
|
Detail: q.hive + `\` + q.sub + ` → ` + val,
|
|
})
|
|
}
|
|
}
|
|
taskOut, err := silentCombinedOutput("schtasks", "/Query", "/FO", "LIST", "/V")
|
|
if err == nil {
|
|
var curName, curRun string
|
|
flush := func() {
|
|
if curName != "" {
|
|
report.Entries = append(report.Entries, PersistenceAuditEntry{
|
|
Kind: "scheduled_task",
|
|
Name: curName,
|
|
Detail: curRun,
|
|
Enabled: true,
|
|
})
|
|
}
|
|
curName, curRun = "", ""
|
|
}
|
|
for _, line := range strings.Split(string(taskOut), "\n") {
|
|
line = strings.TrimSpace(line)
|
|
if strings.HasPrefix(line, "TaskName:") {
|
|
flush()
|
|
curName = strings.TrimSpace(strings.TrimPrefix(line, "TaskName:"))
|
|
} else if strings.HasPrefix(line, "Task To Run:") {
|
|
curRun = strings.TrimSpace(strings.TrimPrefix(line, "Task To Run:"))
|
|
}
|
|
}
|
|
flush()
|
|
}
|
|
report.Count = len(report.Entries)
|
|
return report
|
|
}
|