Add smbtakeover

[olegsenko]

Add SMB Takeover Command to Apollo

Overview

This PR adds a new smbtakeover command to Apollo, enabling OPSEC-conscious SMB 445 takeover functionality without requiring any agent-side modifications.

Inspiration

This implementation is inspired by SpecterOps' research: Relay Your Heart Away: An OPSEC Conscious Approach to 445 Takeover

Implementation Details

• Leverages the existing Service Control Manager (SCM) to interact with services
• No agent-side modifications required - works with existing Apollo agents
• Purely server-side implementation

OPSEC Safety Features

To prevent operational mistakes and maintain stealth, this command includes several safety checks:

Pre-execution Checks

• ✅ Public Share Detection: Identifies available public shares on the target
• ✅ Established 445 Connections: Checks for existing SMB connections to prevent killing active sessions
• ✅ Threshold Protection: Implements a safety threshold (default: 1 connection) that must be met before execution

Controls

• Enable/Disable Toggle: Can be easily enabled or disabled as needed
• Bypass Option: Safety checks can be bypassed when necessary (use with caution)

Usage

Enable 445:

Disable 445: