# Electrogrid
## Initial Foothold
We are provided with a downloadable `UserLandCityPC-1.0.0.AppImage` file. This is an Electron app image. We can extract the source code either by using `binwalk` or running the app image with the `--appimage-extract` option.
This gives us the `app.asar` file, which we can again extract using
```shell
asar extract app.asar ./
```
which gives us the Electron app's source code.
At this point we can start running the Electron app, proxying the traffic through Burp Suite:
```
electron --proxy-server=127.0.0.1:8080 --enable-logging .
```
At the moment it does not load anything, but we will come back to this later.
Let's begin by taking a look at `index.js`.
```javascript
const { app, BrowserWindow, shell, ipcMain } = require('electron');
const path = require('path');
const { download } = require('electron-dl');
const fs = require('fs');
const createWindow = () => {
const win = new BrowserWindow({
autoHideMenuBar: true,
webPreferences: {
preload: path.join(__dirname, 'preload.js'),
},
show: false,
icon: path.join(__dirname,'static/userlandprivate.png')
});
win.maximize()
win.loadFile('index.html');
win.once('ready-to-show', () => {
win.show()
})
ipcMain.on('handle-links',(event,task,url)=>{
if (task === 'download') {
const downloadPath = '/opt/userland/';
const filename = url.split('/').pop();
const filepath = `${downloadPath}${filename}`;
fs.access(filepath, fs.F_OK, async (err) => {
if (err) {
await download(BrowserWindow.getFocusedWindow(), url, { directory: downloadPath })
win.webContents.send('file-downloaded', `File Imported at: ${downloadPath}${filename}`)
return
}
win.webContents.send('file-downloaded', `File Already Exists At: ${downloadPath}${filename}`)
})
}
else {
shell.openExternal(url)
}
})
}
app.whenReady().then(() => {
createWindow();
});
```
A couple things of note here:
* When the browser window is launched, the `preload.js` script is first run. This script has access to the Electron APIs.
* The `handle-links` IPC event is handled by either saving the file to disk if it is a downloadable file, or using `shell.openExternal` to open the URL.
The `shell.openExternal` function is [dangerous](https://benjamin-altpeter.de/shell-openexternal-dangers/) when used on untrusted user input, because it will “open the given external protocol URL in the desktop’s default manner”. This means that if `shell.openExternal` opens a local file using the `file:` protocol, it can automatically run executable files. We will come back to this later.
For now, we can look at `preload.js`. We see that the preload script exposes the `handle-links` IPC event to the renderer context through the `click` event handler.
```javascript
const { contextBridge, ipcRenderer } = require('electron')
const handleAnchorClick = (event) => {
const a = event.target.closest('a');
if (!a) {
return;
}
const href = a.getAttribute('href');
const download = a.hasAttribute('download');
if (download) {
const downloadUrl = a.href;
ipcRenderer.send('handle-links', 'download', downloadUrl)
event.preventDefault();
return;
}
ipcRenderer.send('handle-links', 'openLink', href)
event.preventDefault();
}
window.addEventListener('click', (event) => {
handleAnchorClick(event);
});
contextBridge.exposeInMainWorld('electronAPI', {
fileDownloaded: (callback) => ipcRenderer.on('file-downloaded', callback)
});
```
This means that anytime a link is clicked, the `handle-links` IPC event is fired and either a file is downloaded or `shell.openExternal` is called.
It looks like we need to trigger an arbitrary URL link click, but we are not sure how yet. Let's now take a look at the rendered HTML.
```markup
```
In order to get the Electron app working properly, we must change the CSP in the above HTML, replacing `127.0.0.1` with the target server's IP. Additionally, in `app.js` , the `BACKEND_URL` also needs to be changed.
```javascript
/***/ "./src/js/config.json":
/*!****************************!*\
!*** ./src/js/config.json ***!
\****************************/
/***/ ((module) => {
module.exports =
JSON.parse('{"BACKEND_URL":"http://10.129.228.64:9000"}');
/***/
})
```
After this, the Electron app should run proper!
The `app.js` is minified, but at the end of the file we find the base64-encoded source map. Decoding it gives a JSON source map, from which we can recover the React source code.
```python
import json
import os
with open("idk.json") as f:
data = json.load(f)
sources = data["sources"]
sourcesContent = data["sourcesContent"]
for i in range(len(sources)):
sourcePath = sources[i].replace("webpack://", "./")
os.makedirs(os.path.dirname(sourcePath), exist_ok=True)
with open(sourcePath, "w") as f:
f.write(sourcesContent[i])
```
In `mainUIComponents/messages.js`, `dangerouslySetInnerHTML` allows us to perform HTML injection in regular messages.
```javascript
if (message.type === 'file') {
if ( message.message.split('.').pop() === 'png' || message.message.split('.').pop() === 'jpg' || message.message.split('.').pop() === 'jpeg' || message.message.split('.').pop() === 'gif') {
return (
