Cromos - Download and Inject code into Google Chrome extensions

Cromos is a tool for downloading legitimate extensions of the Chrome Web Store and inject codes in the background of the application and more cromos create executable files to force installation via PowerShell for example, and also upload files to dropbox to host the malicious files.
  • Download extension
  • Injections
  • Upload files on dropbox
  • Windows infection

Group Policy Object (GPO)
Chrome allows you to add extensions using Windows Group Policy Object (GPO) if you need to force installation on multiple machines just follow the steps in the Chrome Deployment Guide then modify the original extension with few modifications you can publish your extension in the Chrome Web Store requires to pay $5.

If you chose to generate a batch file to force installation the script in powershell that will be downloaded is compatible Windows, 7, 8 10 with versions of powershell >= 3.0

This is a demonstration of the tool at work in this examples I'm downloading a famous Google extension called G Suite Training on Google Chrome Web Store and injecting a keylogger module.

$ cd $HOME/
$ git clone
$ sudo chmod -R 777 cromos/
$ cd cromos && python


Downloading the extension
Usage: python --extension {id}

Downloading the extension and loading module
Usage: python --extension {id} --load {currency/keylogger}

Build a batch file and upload the files in dropbox
Usage: python --extension {id} --build {bat} --token {dropboxToken}

You can also inject some predefined modules in the background as keyloggervirtual currency.
modules/keyloggerThis module captures all the passwords you type in an infected browser over https or not. All you need is to have a php server for example to receive the requests get the parameters are email, password, cookies and userAgent.
modules/currencyThis module allows you to mine virtual coins using the coinhive API, you just need to have an account.

No comments

Note: Only a member of this blog may post a comment.

Powered by Blogger.