comfyui-arkennemasis 1.4.0
Hidden persistence, tunneling, credential access
Python writes, renames, executes, and deletes an EXE payloadScheduled task with no execution time limit
SHA-25657b4e3b04909183a75d96a2f03b1a39846ab189026bad60dfec0cd98f3186828
Evidence
1"""Owner-initiated setup; importing this module never installs or starts anything."""
2
3import json
4import math
5import os
6from pathlib import Path
7import re
8import secrets
9import shutil
10import subprocess
11import sys
12import tempfile
13import time
14
15from .settings import COMFY_DIR, DEFAULT_CONFIG, SCOPES, SERVICE_DIR, Settings, load_settings, save_settings
16
17LAUNCHERS = ("run_cpu.bat", "run_nvidia_gpu.bat", "run_nvidia_gpu_fast_fp16_accumulation.bat")
18MCP_LAUNCH …
19:4… NCHER_MARKER = "rem Arkennemasis MCP launcher - generated by MCP setup"
20PYTHON_NAME = re.compile(r"python(?:3(?:\.\d+)?)?(?:\.exe)?$", re.IGNORECASE)
21PACK_NAME = re.compile(r"[A-Za-z0-9_-]{1,120}$")
22
23
24def run(arguments, **kwargs):
25 return subprocess.run(arguments, shell=False, stdin=subprocess.DEVNULL, capture_output=True,
26 text=True, encoding="utf-8", errors="replace",
27 creationflags=subprocess.CREATE_NO_WINDOW if os.name == "nt" else 0, **kwargs)
28
29
⋯4 lines
34:17… [str(executable), "-I", "-c",
35 "import json,sys; print(json.dumps({'version':list(sys.version_info[:3]),'implementation':sys.implementation.name}))"], timeout=15)
36 if probe.returncode:
37 raise ValueError("The selected Python could not start. Choose a working Python installation.")
38 try:
39 details = json.loads(probe.stdout)
40 version = details["version"]
41 if details["implementation"] != "cpython" or len(version) != 3 or any(type(part) is not int for part in version):
42 raise ValueError
43 if tuple(version[:2]) < (3, 11):
44 rais …
325:2… if not any(line.strip().casefold() == 'cd /d "%~dp0"' for line in normal.splitlines()):
326 connected = '@echo off\ncd /d "%~dp0"\n' + connected
327 connected = LAUNCHER_MARKER + "\n" + expression.sub(
328 lambda match: 'echo Starting ComfyUI with Arkennemasis MCP. Check the connection badge for readiness.\n'
329 + hook + "\n" + match.g …
21:17… rity.Principal.WindowsIdentity]::GetCurrent().Name
22$arkAction = New-ScheduledTaskAction -Execute $arkPython -Argument $arkArguments -WorkingDirectory $arkPackage
23$arkTrigger = New-ScheduledTaskTrigger -AtLogOn -User $arkUser
24$arkPrincipal = New-ScheduledTaskPrincipal -UserId $arkUser -LogonType Interactive -RunLevel Limited
25$arkSettings = New-ScheduledTaskSettingsSet -Hidden -StartWhenAvailable -AllowStartIfOnBatteries `
26 -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero) `
27 -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -MultipleInstances IgnoreNew
28Register-ScheduledTask -TaskName $arkTaskName -Action $arkAction -Trigger $arkTrigger `
29 -Principal $arkPrincipal -Settings $arkSettings `
30 -Description 'Start the Arkennemasi …
Showing the top 5 files — 7 more files (91 regions) not shown.
No evidence locations were recorded for this file. Raw result