https://github.com/parsiya/evil-electron
Backdoored Electron app.asar
https://github.com/parsiya/evil-electron
electron security
Last synced: about 1 year ago
JSON representation
Backdoored Electron app.asar
- Host: GitHub
- URL: https://github.com/parsiya/evil-electron
- Owner: parsiya
- License: mit
- Created: 2020-07-05T20:35:27.000Z (almost 6 years ago)
- Default Branch: master
- Last Pushed: 2021-06-11T17:23:23.000Z (about 5 years ago)
- Last Synced: 2025-03-24T22:51:24.278Z (about 1 year ago)
- Topics: electron, security
- Language: JavaScript
- Homepage:
- Size: 29.3 KB
- Stars: 15
- Watchers: 2
- Forks: 3
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Evil Electron a Backdoored Electron app.asar
This is a fork of the Electron Quick Start application at
https://github.com/electron/electron-quick-start.
It spawns a command prompt. To change it, change [preload.js](preload.js).
## Usecase
If you have a bundled Electron app you can replace the original `app.asar` with
this app to get a command prompt.
## Quickstart
1. Make a copy of the original `/path/to/electron/app/resources/app.asar` file.
2. Copy `release/app.asar` into the path above.
3. Run the Electron app to see `cmd` pop.
## Building
This repository creates an `app.asar` file and not a complete Electron app. Note
we are not running `npm install` because the original Electron app already has
the dependency.
```
# Clone this repository
git clone https://github.com/parsiya/evil-electron
# Go into the repository
cd evil-electron
# Install asar globally if it's not already installed
npm install -g asar
# Package the app into app.asar (modify for non-Windows OS)
asar pack . release/app.asar --unpack-dir "{**/.git,**/release,**/node_modules}" && rd "release/app.asar.unpacked" /s /q
# Copy release/app.asar to the place you want.
```
## Testing
To test your `app.asar` you need to install Electron.
```
# Clone this repository
git clone https://github.com/parsiya/evil-electron
# Go into the repository
cd evil-electron
# Install dependencies
npm install
# Run the app to test it, you should see the command prompt
npm start
# Install asar globally if it's not already installed
npm install -g asar
# Package the app into app.asar (modify for non-Windows OS)
asar pack . release/app.asar --unpack-dir "{**/.git,**/release,**/node_modules}" && rd "release/app.asar.unpacked" /s /q
# Copy release/app.asar to `resources/app.asar` for your target application
```
## Troubleshooting
See the original repository at https://github.com/electron/electron-quick-start
and the [Writing Your First Electron App][first-electron] article.
[first-electron]: https://www.electronjs.org/docs/tutorial/first-app
### My app.asar is Too Big
1. Did you exclude `node_modules` from the `asar pack` command?
2. Did you delete the old `app.asar` file? The asar command will append data to existing files.
### Only Works on Windows
Yes. [issue #1](https://github.com/parsiya/evil-electron/issues/1) fixes some of
this problem. I do not have a Mac so I have not tested that part. The Linux
version just calls `gnome-terminal` which is problematic but
[issue #2](https://github.com/parsiya/evil-electron/issues/2) is looking for a
universal command.
### "The SUID sandbox helper binary was found, but is not configured correctly"
This happens after `npm start`. Run these commands:
```
sudo chown root /path/to/evil-electron/node_modules/electron/dist/chrome-sandbox
sudo chmod 4755 /path/to/evil-electron/node_modules/electron/dist/chrome-sandbox
```
Source: https://github.com/electron/electron/issues/17972#issuecomment-487369441
### I Cannot `asar extract` the Release File
Yes, `asar` for some reason likes to reference the excluded files and keeps them
in the `app.asar.unpacked` directory. We delete this directory with our
`asar pack` command but `asar extract` needs this directory to extract things
properly. If you know how to fix this please let me know.
### Should I Also Copy the `app.asar.unpacked` Directory?
No. These are excluded files that are not needed for the application. If you run
the commands above it should have been deleted.
### I Want to Package and Make a Standalone Electron Application
See https://www.electronjs.org/docs/tutorial/application-distribution.
### Do I Need `nodeIntegration`?
No. We are doing our spawn in `preload.js`. This file has almost complete access
to the Node APIs.
## License
MIT, see [LICENSE](LICENSE) for details. The original project is licensed under
`CC0 1.0 (Public Domain)`. I felt like the hamburglar after changing the
license.