what's going on everyone in this video I want to talk about a red teaming tool
called cursed chrome if you've never heard of it look in the description get
the link and this will be the github that you see so cursed chrome is
essentially two things it's a extension for chrome a victim
extension and a fully functional HTTP proxy which can be used to actually talk
to the victim plug in and browse authenticated websites as your victim
user so obviously you could do whatever you want with these authenticated
websites so this is a bit of a run-through of how to set it up and how
it works so this diagram would think github there's only really two things
you need to know here and the victim browsers here are the cursed chrome
plugins for chrome this talks to the cursed chrome server which we're going
to sell in this video and you as the attacker can then proxy to the curse
chrome server which then goes to the victim browsers which will allow you to
browse the web sites as these victim users so what I've got going on here is
a digitalocean droplet which I'm Rd peed into if you want this RDP display then
look in the description as a link for that as well a quick setup of it so the
first thing you want to do here is clone the git repository so I've done that
already and it's cursed Chrome as you can see here you're gonna want to
apt-get install docker and apt-get install docker compose to create the
docker images for cursed chrome and the last thing you're gonna want to do for a
bit of a setup before you actually spin up these docker containers is do an IP
Taber's rule so the way cursed chrome works is it allows you to proxy through
this cascarone proxy to your victim user so what we need to do is actually allow
port 4 3 4 3 here which is a WebSockets port so our victims can connect to our
server which will then allow us to see they're connected and do what we need to
do so to do that just use this IT iptables role which opens up port for
free for free on your external interface which - 206 189 one-two-three 92 and
then it redirects it to your localhost 43 43 which is the cursed proxy so there
is a better way to do that you can use an energetic server but it's a bit
bloated for this demo so I've just done a simple iptables Rob not the most
secure but it will do for now anyway getting to the the point of this you
want to run a few docker compose commands so this first command docker
throws up - the Redis DB that will start a Reedus database which is the back end
for the curst chrome proxy the next one you want to run is the docker container
for cursed chrome and on the first run of curse chrome you will see this
attention and if you look above that you'll see a admin username and password
so just make a note of that you will want to change this once you login to
the admin panel on the first login but I'm not going to do that but you should
do that talking about mint panels you can go to the admin panel on one two
seven zero zero one and the port is eight one one eight so login with those
credentials that we just saw and you will see this logged in panel so all of
your victim hosts are going to appear here of course at the moment we don't
have any so the next step on from this and the setup is to download this HTTP
CA certificate so we can talk to the victim machines using SSL TLS so
download that and save it I'm just going to move that to my desktop to make
things easier we want to import this into Firefox so I just put that into my
desktop so to import it you want to go to the settings of Firefox go to
preferences search for cert and that will show you stiff coats so view
certificates go to your authority stab import
and just go ahead and import that stiff cut now you want to trust the CA to
identify websites click ok click OK again and that's typical it's now
installed within Firefox so we can talk to the victims using encrypted means so
you can just click off this now so the next thing we need to do is set up the
plug-in which we're going to give to our victims so within the curst chrome
directory the github repo you'll find an extensions directory you'll then see a
source directory the feejee directory and this background is this is what
you're gonna have to modify with your external IP address so - 206 189 1 2 3
92 here change this part to your external IP address leave the for free
for free save that and then you can use this plug-in later so now it's time to
actually set up the plug-in so I'm gonna simulate being a victim on my own host
here so if you want to go to extensions Chrome extensions here make sure
developer mode is on click load unpacked go to the chrome repo click extensions
select the folder and then you'll see this Coast chrome implant pop up here so
obviously this isn't the best way to do it you don't you want to give your
victim the cursed chrome implant because they probably will work out that this
might be malicious what you actually want to do is roll this out using a
chrome enterprise policy within an organization if you can get to that
level you could potentially put this into other legitimate plugins using the
developer tools or make your own malicious plug-in and try and get out
onto the store but that would be highly illegal and don't do that anyway so if
now what is implement my actual Windows machines so if I go back to my
digitalocean droplet we should see a connection which we do we now have this
connected browser bot so now we need to set up a proxy within Firefox here on
the digitalocean droplet so the best way to do that is by using foxy proxy so you
can go ahead and download that as an extension to Firefox once you've done
that click add just title it wherever you want which we call it Vic make sure
the proxy type is HTTP and not HTTP I made this mistake and it cost me some
time the proxy IP is going to be your localhost or whatever the IP addresses
of your proxy your port is going to be 8080 and then using a password you can
get from the cursed chrome dashboard so just go ahead and copy that over like so
and now you can save that so now we have the proxy setup we've got our victim
machine with that implant and you can see at the moment on our digitalocean
droplet i'm not signed in on YouTube I'm not signed in on LinkedIn and I'm not
signed in on reddit so as soon as I flip the switch on foxy proxy so the moments
turned off let's go ahead and turn that on so just Vic that proxy is now on and
with any luck if we refresh these pages we should see that we're now logged in
as our victim user the proxy is a little bit slow probably won't be in all cases
but it is in this case so hopefully this won't delay us too much ok it took a few
minutes but we're now loaded I'm in YouTube as my Victim user which is
myself but on my other legitimate machine here are all my subscriptions
you can see LinkedIn is still loading but I'm logged in I've got a feed you
can see me you can see me and on reddit I'm logged in mister turvy see I've got
a message so at this point you can kind of do whatever you want through the
proxy that we set up here so that's cursed chrome very easy to set up
hopefully this made sense thanks for watching guys I appreciate it subscribe
and like the video thank you