EvilNeko is a project to automate orchestration of containers and operationalize Browser in the Browser (BITB) attacks for red teams. Inspired by research done by Mr. d0x here and to build off of the ideas in the EvilNoVNC project.
The goal of the project is to improve on the current open source tooling available to build a tool that can be used to scale infrastructure for multiple targets rather than a single user/session. EvilNeko provides red teams with a realistic way to emulate BITB techniques and assist blue teams in finding ways to detect these techniques.
The tool uses the neko project for creating containers with browsers to interact with over WebRTC. With some minor modifications to the settings we can use these to emulate browser in the browser techniques.
EvilNeko does not currently include it's own payload so you will need to bring your own, if you want to see an example using the mythic agent you can read my blog.
EvilNeko is not meant for malicious purposes it is meant for authorized testing of environments you have received consent to test.
EvilNeko works on Linux or MacOS and requires docker, docker-compose, flask and NGINX installed.
As mentioned above you will need to bring your own payload in the form of an unpacked chrome extension and place it in lures/extension.
Once the prerequisite services are installed clone the EvilNeko repo and run EvilNeko.py:
python EvilNeko.py
Then set the domain if you are hosting this publicly, this is mainly for user convince in understanding what links to send to a target, alternatively 127.0.0.1 is the default for testing:
EvilNeko> set_domain <your domain>
Next set the URL that you want the neko container to open to:
EvilNeko> set_url login.microsoft.com
Now you can create a number of containers to be sent to targets:
EvilNeko> create_lure 2
Finally start the Flask and NGINX handlers which will properly route traffic to these containers for each target:
EvilNeko> start_handler
To destroy containers you can either pass the UUID or use "all":
EvilNeko> destroy_lure all
Exiting will also destroy all containers and stop the handler.