EggShell 3.0.0: iOS/macOS Remote Administration Tool

by do son · Published August 11, 2017 · Updated April 20, 2018

EggShell is an iOS and macOS post exploitation surveillance pentest tool written in Python. This tool creates 1 line multi-stage payloads that give you a command line session with extra functionality. EggShell gives you the power and convenience of uploading/downloading files, taking pictures, location tracking, shell command execution, persistence, escalating privileges, password retrieval, and much more. Server communication features end to end encryption with 128 bit AES and the ability to handle multiple clients. This is a proof of concept pen test tool, intended for use on machines you own.

New In Version 3.0.0

More secure socket connection using SSL
Linux support
Tab completion
Improved overall structure and efficiency of session handling
Native iOS python support for 64-bit devices

Installation

git clone https://github.com/neoneggplant/EggShell && cd EggShell
easy_install pycrypto
python eggshell.py

iOS (Jailbroken)

Add Cydia source: http://lucasjackson.io/repo Install EggShell 3 Use any mobile terminal application and run the command eggshell

Creating Payloads

Eggshell payloads are executed on the target machine. The payload first sends over instructions for getting and sending back device details to our server and then chooses the appropriate executable to establish a secure remote control session.

bash

Selecting bash from the payload menu will give us a 1 liner that establishes an eggshell session upon execution on the target machine

teensy macOS (USB injection)

Teensy is a USB development board that can be programmed with the Arduino ide. It emulates usb keyboard strokes extremely fast and can inject the EggShell payload just in a few seconds.

Selecting teensy will give us an Arduino based payload for the teensy board.

After uploading to the teensy, we can use the device to plug into a macOS usb port. Once connected to a computer, it will automatically emulate the keystrokes needed to execute a payload.

Interacting with a session

After a session is established, we can execute commands on that device through the EggShell command line interface. We can show all the available commands by typing “help”

Tab Completion

Similar to most command line interfaces, EggShell supports tab completion. When you start typing the path to a directory or filename, we can complete the rest of the path using the tab key.

Multihandler

The Multihandler option lets us handle multiple sessions. We can choose to interact with different devices while listening for new connections in the background.