# ElectronVulnScanner

*Automatically scan the file system to identify Electron applications vulnerable to ASAR tampering.*

<br>

### Quick Links

[Maldev Academy Home](https://maldevacademy.com?ref=gh)

[Maldev Database](https://search.maldevacademy.com?ref=gh)
  
[Malware Development Course Syllabus](https://maldevacademy.com/maldev-course/syllabus?ref=gh)

[Offensive Phishing Operations Course Syllabus](https://maldevacademy.com/phishing-course/syllabus?ref=gh)

[Ransomware Internals, Simulation and Detection Course Syllabus](https://maldevacademy.com/ransomware-course/syllabus?ref=gh)

<br>


## ASAR Tampering

ASAR tampering (referenced in MITRE ATT&CK technique [T1218.015](https://attack.mitre.org/techniques/T1218/015)) refers to modifying an Electron application's packaged source code files inside the [**.asar**](https://github.com/electron/asar) archive to introduce malicious code or alter existing functionality. When an Electron application does not enforce integrity checks or signature validation, attackers can replace or modify its ASAR contents to gain persistence, execute arbitrary JavaScript, or hijack the application's normal behavior.

<br>

## Identifying Vulnerable Electron Applications

Using [ElectronVulnScanner](https://github.com/Maldev-Academy/ElectronVulnScanner/tree/main/ElectronVulnScanner), one can enumerate installed Electron applications, detect associated ASAR archives, and identify those with disabled code integrity protection. An example of running `ElectronVulnScanner.exe` is demonstrated in the image below:

<br>

<img width="95%" alt="image" src="https://github.com/user-attachments/assets/1dc8b5bf-5747-435c-af79-1ec86331be52" />

<br>
<br>


## Packing & Unpacking Electron Applications

Once a vulnerable Electron application is identified, one can test for JavaScript code injection by extracting its `.asar` file, if present (some applications delete the `.asar` file after installation and unpack its contents to disk). To do this, [AsarEdit](https://github.com/Maldev-Academy/ElectronVulnScanner/tree/main/AsarEdit) can be invoked with the `/u` command to unpack a given `.asar` archive. Below is the usage for `AsarEdit.exe`:

<br>

```
.\AsarEdit.exe /?

Usage:
  AsarEdit.exe /u <input.asar> <output_dir>
  AsarEdit.exe /p <input_dir>  <output.asar>
  AsarEdit.exe /v <input.asar>

Description:
  Packs, unpacks, and verifies Electron ASAR archive files.

Commands:
  /u <input.asar> <output_dir>    Extract ASAR archive to directory
  /p <input_dir>  <output.asar>   Create ASAR archive from directory
  /v <input.asar>                 Verify ASAR integrity (hash & blocks)

Examples:
  AsarEdit.exe /u .\app.asar extracted
  AsarEdit.exe /p .\extracted app.new.asar
  AsarEdit.exe /v .\app.new.asar
```

<br>
<br>

## Example: Targeting Discord

1. Running `ElectronVulnScanner.exe`, we identified two vulnerable Electron Applications: Discord and VS Code.  

<p align="center"> <img src="https://github.com/Maldev-Academy/ElectronVulnScanner/blob/main/Images/PIC1.png" alt="Screenshot 1" width="95%"> </p>

<br>

2.  After locating Discord's `core.asar` file, we extracted its content to a directory named `extracted` using `AsarEdit.exe /u`.

<p align="center"> <img src="https://github.com/Maldev-Academy/ElectronVulnScanner/blob/main/Images/PIC2.png" alt="Screenshot 2" width="100%"> </p>

<br>

3. We then added our [SpawnCalcProc.js](https://github.com/Maldev-Academy/ElectronVulnScanner/blob/main/SpawnCalcProc.js) file, representing our PoC script that spawns a calc process.

<p align="center"> <img src="https://github.com/Maldev-Academy/ElectronVulnScanner/blob/main/Images/PIC3.png" alt="Screenshot 3" width="90%"> </p>

<br>

4. To execute our script, we inserted a one-liner at the beginning of the `init` function (located at line ~918) in the **app\mainScreen.js** file to run the exported function from `SpawnCalcProc.js`.

<p align="center"> <img src="https://github.com/Maldev-Academy/ElectronVulnScanner/blob/main/Images/PIC4.png" alt="Screenshot 4" width="95%"> </p>

<br>

5. Using `AsarEdit.exe /p`, and after backing up the original `core.asar` file, we repacked our `extracted` directory into a new `core.asar`, which will spawn a calc process whenever the `init` function is invoked.

<p align="center"> <img src="https://github.com/Maldev-Academy/ElectronVulnScanner/blob/main/Images/PIC5.png" alt="Screenshot 5" width="100%"> </p>

<br>

6. Finally, running the Discord application, we can observe the calc process being spawned successfully:

https://github.com/user-attachments/assets/2dc94bee-18f2-49c7-b7bc-29c590e28600

<br>
<br>


## Other Applications

The following table represents the tested applications using `ElectronVulnScanner.exe`:

| Application        | Vulnerable | Notes                                                     |
| ------------------ | ---------- | --------------------------------------------------------- |
| **Discord** | Yes | core.asar and app.asar |
| **Claude Desktop** | No | Code integrity check is enabled |
| **VS Code** | Yes | app.asar |
| **Canva** | No | Code integrity check is enabled |
| **Slack** | No | Was found to be vulnerable to DLL sideloading from a user-writable directory instead |
| **Signal Desktop** | No | Code integrity check is enabled |
| **Cursor** | Yes | app.asar |
| **Notion** | Yes | app.asar |
| **Microsoft Teams** | No | Microsoft Teams is a WebView2 application and not an Electron Application (since 2023) |
| **Github Desktop** | Yes | Github Desktop does not have any associated asar files (it's extracted under \resources\app instead) |

<br>

> [!NOTE]
> For additional potentially vulnerable Electron applications, refer to [this list](https://github.com/boku7/Loki?tab=readme-ov-file#%E2%80%8D%EF%B8%8F-deploy-illusions) provided in the [Loki C2 repository](https://github.com/boku7/Loki).


