EggShell – iOS/macOS/Linux Remote Administration Tool
Introduction
EggShell is an iOS/macOS and Linux post exploitation surveillance pentesting tool written in Python. With EggShell you’ll be able to:
- upload/download files, take pictures, track location, execute shell command, retrieve passwords, and much more.
EggShell: Post Exploitation Surveillance Tool
This remote administration tool provides a command line session with additional functionality between you and target machine. EggShell comes packed with a wide variety of features.
Features:
- Tab completion,
- File manipulation (upload/download/delete, etc.),
- Full camera and microphone control,
- Location Tracking,
- Shell command execution,
- Persistence,
- Escalating privileges,
- Tacking Pictures,
- Password Retrieval,
- iTunes/iMessages manipulation, etc.
EggShell Install
Requirements:
- python 2.7
Clone it from the Githhub.
MacOS/Linux:
$ git clone https://github.com/neoneggplant/eggshell
$ cd eggshell
$ python eggshell.py
iOS (Jailbroken Only):
- Add Cydia source: http://lucasjackson.io/repo
- Install EggShell 3
- Run the command
eggshell
(use any mobile terminal application)
Payloads
Eggshell payloads are executed on the target machine. After we retrieve device details, server will establish a secure remote control session. There are 2 different payload options:
- bash
- Teensy (macOS)
Sessions
After a session is established, you can execute commands on that device through the EggShell command line interface. Type help
to show all available commands.
Multihandler
Multihandler option allow us to handle multiple sessions. You can also show Multihandler commands (similar to the sessions), just type help
.
Taking Pictures/Recording Audio
Both iOS and macOS sessions support taking pictures and recording audio.
Taking pictures:
macOS
: (picture command) takes a picture through the front facing iSight camera,iOS
: requires 1 argument specifying ‘front’ or ‘back’ facing camera.
Recording audio:
- When it came to recording audio, the process is same for both iOS and macOS. The argument for this command will specify the
record
orstop
action. Recording will run in the background, so you’ll be able to execute additional commands during the recording. When the recording is finished, the file will be downloaded and saved.
To see detailed EggShell feature explanation, click the documentation link bellow.
Commands
macOS:
brightness
: adjust screen brightnesscd
: change directorydownload
: download filegetfacebook
: retrieve facebook session cookiesgetpaste
: pasteboard contentsgetvol
: get speaker output volumeidletime
: get the amount of time since the keyboard/cursor were touchedimessage
: send message through the messages appitunes
: iTunes Controllerkeyboard
: your keyboard -> is target’s keyboardlazagne
: firefox password retrievalls
: list contents of a directorymic
: record micpersistence
: attempts to re establish connection after closepicture
: take picture through iSightpid
: get process idprompt
: prompt user to type passwordscreenshot
: take screenshotsetvol
: set output volumesleep
: put device into sleep modesu
: su loginsuspend
: suspend current session (goes back to login screen)upload
: upload file
Linux:
cd
: change directorydownload
: download filels
: list contents of a directorypid
: get process idpwd
: show current directoryupload
: upload file
iOS:
alert
: make alert show up on devicebattery
: get battery levelbundleids
: list bundle identifierscd
: change directorydhome
: simulate a double home button pressdial
: dial a phone numberdownload
: download filegetcontacts
: gets addressbookgetnotes
: download notesgetpasscode
: retreive the device passcodegetsms
: download SMSgetvol
: get volume levelhome
: simulate a home button pressinstallpro
: install substrate commandsipod
: control music playerislocked
: check if the device is lockedlastapp
: get last opened applicationlocate
: get device location coordinateslocationservice
: toggle location serviceslock
: simulate a lock button pressls
: list contents of a directorymic
: record micmute
: update and view mute statusopen
: open appsopenurl
: open url on devicepersistence
: attempts to re establish connection after closepicture
: take picture through the front or back camerapid
: get process idrespring
: restart springboardsafemode
: put device into safe modesay
: text to speachsetvol
: set device volumesysinfo
: view system informationupload
: upload filevibrate
: vibrate device