backdoorhack toolsiosmacosmalwareRemote Administration Tool
EggShell - iOS/macOS Remote Administration Tool
Root
April 13, 2017
0 comments
EggShell is an iOS and macOS post exploitation surveillance pentest tool written in Python.
This tool creates 1 line multi stage payloads that give you a command line session with extra functionality. EggShell gives you the power and convenience of uploading/downloading files, taking pictures, location tracking, shell command execution, persistence, escalating privileges, password retrieval, and much more.
Server communication features end to end encryption with 128 bit AES and the ability to handle multiple clients.
This tool creates 1 line multi stage payloads that give you a command line session with extra functionality. EggShell gives you the power and convenience of uploading/downloading files, taking pictures, location tracking, shell command execution, persistence, escalating privileges, password retrieval, and much more.
Server communication features end to end encryption with 128 bit AES and the ability to handle multiple clients.
Creating And Running A Payload
EggShell gives us a convenient 1 line payload and listener on our local machine
On the target machine, after the payload is run, we will get a connection back
Taking Pictures
Eggshell has the command functionality of taking pictures on both iOS(frontcam/backcam) and macOS(picture)
Password Prompt / Root Privileges
With the prompt command, we can have a password pop up information retrieval + built in privilege escalation
Sending SMS through iMessage
Interacting With Multiple Sessions
MultiSession gives us easy access to interacting and managing multiple sessions
Installation
git clone https://github.com/neoneggplant/EggShell && cd EggShell
easy_install pycrypto
python eggshell.py
iOS Commands:
- sysinfo : get system information
- cd : change directories
- ls : list contents of directory
- rm : delete file
- pwd : get current directory
- download : download file
- upload : upload file
- frontcam : take picture through front camera
- backcam : take picture through back camera
- mic : record microphone
- getpid : get process id
- vibrate : make device vibrate
- alert : make alert show up on device
- say : make device speak
- locate : get device location
- respring : respring device
- setvol : set mediaplayer volume
- getvol : view mediaplayer volume
- isplaying : view mediaplayer info
- openurl : open url on device
- dial : dial number on device
- getsms : download sms database
- getnotes : download notes database
- getcontacts : download addressbook
- battery : get battery level
- listapps : list bundle identifiers
- open : open app
- persistence : installs LaunchDaemon - tries to connect every 30 seconds
- rmpersistence : uninstalls LaunchDaemon
- open : open app
- installpro : installs eggshellpro to device
EggShell Pro Commands (iOS)
- lock : simulate lock button press
- wake : wake device from sleeping state
- home : simulate home button press
- doublehome : simulate home button double press
- play : plays music
- pause : pause music
- next : next track
- prev : previous track
- togglemute : programatically toggles silence switch
- ismuted : check if we are silenced or not
- islocked : check if device is locked
- getpasscode : log successfull passcode attempts
- unlock : unlock with passcode
- keylog : log keystrokes
- keylogclear : clear keylog data
- locationservice: turn on or off location services
macOS Commands
- **cd : change directories
- **ls : list contents of directory
- **rm : delete file
- **pwd : get current directory
- **download : download file
- **upload : upload file
- **getpaste : get pasteboard contents
- **mic : record mic
- **picture : take picture through iSight
- **screenshot : take screenshot
- **getfacebook : retrieve facebook session cookies
- **brightness : adjust screen brightness
- **getvol : get output volume
- **setvol : set output volume
- **idletime : get the amount of time since the keyboard/cursor were touched
- **keyboard : your keyboard -> is target's keyboard
- **imessage : send message through the messages app
- **openurl : open url through the default browser
- **play : tell iTunes to play
- **pause : tell iTunes to pause
- **prev : tell iTunes to play previous track
- **next : tell iTunes to play next track
- **pid : get process id
- **prompt : prompt user to type password
- **su : su login
- **persistence : attempts to connect back every 60 seconds
- **rmpersistence : removes persistence
Local Commands
- lls : list contents of local directory
- lcd : change local directories
- lpwd : get current local directory
- lopen : open local directory
- clear : clears terminal
Notes
- Supports Python 2.7.x
Ad