Evan Hosinski
110 lines
3.0 KiB
Go
110 lines
3.0 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"rmm-hunter/internal/pkg"
|
|
"rmm-hunter/internal/pkg/hunter"
|
|
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
var (
|
|
excludeRMMs []string
|
|
inputFile string
|
|
outputFile string
|
|
)
|
|
|
|
// rootCmd represents the base command when called without any subcommands
|
|
var rootCmd = &cobra.Command{
|
|
Use: "rmm-hunter",
|
|
Short: "RMM-Hunter - Detect and eliminate Remote Monitoring and Management software",
|
|
Long: `RMM-Hunter is a tool designed to detect and eliminate Remote Monitoring
|
|
and Management (RMM) software on Windows systems. It can hunt for suspicious
|
|
processes, services, binaries, and network connections associated with RMM tools.`,
|
|
Version: "1.0.0",
|
|
}
|
|
|
|
// huntCmd represents the hunt command
|
|
var huntCmd = &cobra.Command{
|
|
Use: "hunt",
|
|
Short: "Hunt for RMM software on the system",
|
|
Long: `Hunt mode scans the system for signs of RMM software including:
|
|
- Suspicious processes
|
|
- Services
|
|
- Binaries and executables
|
|
- Network connections
|
|
- Scheduled tasks
|
|
- Registry entries`,
|
|
Run: func(cmd *cobra.Command, args []string) {
|
|
fmt.Println("Starting RMM Hunt...")
|
|
runHunt()
|
|
},
|
|
}
|
|
|
|
// eliminateCmd represents the eliminate command
|
|
var eliminateCmd = &cobra.Command{
|
|
Use: "eliminate",
|
|
Short: "Eliminate Sus software based on hunt results",
|
|
Long: `Eliminate mode removes detected Sus software from the system.
|
|
Requires a JSON input file containing hunt results to determine what to remove.`,
|
|
Run: func(cmd *cobra.Command, args []string) {
|
|
if inputFile == "" {
|
|
fmt.Println("Error: --input flag is required for eliminate command")
|
|
os.Exit(1)
|
|
}
|
|
|
|
fmt.Printf("Starting Sus Elimination using input file: %s\n", inputFile)
|
|
// TODO: Call eliminate.Eliminate() function
|
|
runEliminate()
|
|
},
|
|
}
|
|
|
|
// Execute adds all child commands to the root command and sets flags appropriately.
|
|
func Execute() {
|
|
err := rootCmd.Execute()
|
|
if err != nil {
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func init() {
|
|
// Add subcommands
|
|
rootCmd.AddCommand(huntCmd)
|
|
rootCmd.AddCommand(eliminateCmd)
|
|
|
|
// Global flags
|
|
rootCmd.PersistentFlags().StringSliceVar(&excludeRMMs, "exclude", []string{},
|
|
"Comma-separated list of Sus names to exclude from detection (optional)")
|
|
|
|
// Hunt command flags
|
|
huntCmd.Flags().StringSliceVar(&excludeRMMs, "exclude", []string{},
|
|
"Comma-separated list of Sus names to exclude from hunt")
|
|
huntCmd.Flags().StringVarP(&outputFile, "output", "o", "suspicious-hunter.json",
|
|
"Output file to write hunt results (optional) Default: suspicious-hunter.json")
|
|
|
|
// Eliminate command flags
|
|
eliminateCmd.Flags().StringVarP(&inputFile, "input", "i", "",
|
|
"JSON input file containing hunt results (required)")
|
|
eliminateCmd.MarkFlagRequired("input")
|
|
}
|
|
|
|
func runHunt() {
|
|
fmt.Println("Starting Sus Hunt...")
|
|
if len(excludeRMMs) > 0 {
|
|
fmt.Printf("Excluding RMMs: %v\n", excludeRMMs)
|
|
}
|
|
|
|
hunter.Start(pkg.RunOptions{
|
|
ExcludeRMMs: excludeRMMs,
|
|
})
|
|
|
|
}
|
|
|
|
func runEliminate() {
|
|
// TODO: Implement eliminate functionality
|
|
fmt.Println("Eliminate functionality not yet implemented")
|
|
fmt.Printf("Input file: %s\n", inputFile)
|
|
fmt.Printf("Excluded RMMs: %v\n", excludeRMMs)
|
|
}
|