{"id":27596,"date":"2017-01-26T02:53:13","date_gmt":"2017-01-25T19:53:13","guid":{"rendered":"http:\/\/deepquest.code511.com\/blog\/?p=27596"},"modified":"2017-01-26T02:53:13","modified_gmt":"2017-01-25T19:53:13","slug":"eggshell-an-ios-and-os-x-surveillance-tool","status":"publish","type":"post","link":"https:\/\/deepquest.code511.com\/blog\/2017\/01\/eggshell-an-ios-and-os-x-surveillance-tool\/","title":{"rendered":"EggShell: an iOS and OS X surveillance tool"},"content":{"rendered":"<p>EggShell (formerly known as NeonEggShell) is an iOS and OS X surveillance tool written in python. This tool creates an command line session with extra functionality like downloading files, taking pictures, location tracking, and gathering data on a target. Communication between server and target is encrypted with a random 128 bit AES key. EggShell also has the functionality to switch between and handle multiple targets. This is a proof of concept project, intended for use on machines you own.<\/p>\n<p><!--more--><\/p>\n<h2>Getting Started<\/h2>\n<div class=\"highlight highlight-source-shell\">\n<pre>git clone https:\/\/github.com\/neoneggplant\/EggShell\r\neasy_install pycrypto\r\n<span class=\"pl-c1\">cd<\/span> EggShell\r\npython eggshell.py<\/pre>\n<\/div>\n<h2><a id=\"user-content-ios-commands\" class=\"anchor\" href=\"https:\/\/github.com\/neoneggplant\/EggShell#ios-commands\"><\/a>iOS Commands:<\/h2>\n<ul>\n<li>ls\u00a0: list contents of directory<\/li>\n<li>cd\u00a0: change directories<\/li>\n<li>rm\u00a0: delete file<\/li>\n<li>pwd\u00a0: get current directory<\/li>\n<li>download\u00a0: download file<\/li>\n<li>frontcam\u00a0: take picture through front camera<\/li>\n<li>backcam\u00a0: take picture through back camera<\/li>\n<li>getpid\u00a0: get process id<\/li>\n<li>vibrate\u00a0: make device vibrate<\/li>\n<li>alert\u00a0: make alert show up on device<\/li>\n<li>say\u00a0: make device speak<\/li>\n<li>locate\u00a0: get device location<\/li>\n<li>respring\u00a0: respring device<\/li>\n<li>setvol\u00a0: set mediaplayer volume<\/li>\n<li>getvol\u00a0: view mediaplayer volume<\/li>\n<li>isplaying\u00a0: view mediaplayer info<\/li>\n<li>openurl\u00a0: open url on device<\/li>\n<li>dial\u00a0: dial number on device<\/li>\n<li>listapps\u00a0: list bundle identifiers<\/li>\n<li>open\u00a0: open app<\/li>\n<li>installpro\u00a0: installs eggshellpro to device<\/li>\n<\/ul>\n<h2><a id=\"user-content-eggshell-pro-commands\" class=\"anchor\" href=\"https:\/\/github.com\/neoneggplant\/EggShell#eggshell-pro-commands\"><\/a>EggShell Pro Commands<\/h2>\n<ul>\n<li>lock\u00a0: simulate lock button press<\/li>\n<li>wake\u00a0: wake device from sleeping state<\/li>\n<li>home\u00a0: simulate home button press<\/li>\n<li>doublehome\u00a0: simulate home button double press<\/li>\n<li>play\u00a0: plays music<\/li>\n<li>pause\u00a0: pause music<\/li>\n<li>next\u00a0: next track<\/li>\n<li>prev\u00a0: previous track<\/li>\n<li>getpasscode\u00a0: log successfull passcode attempts<\/li>\n<li>unlock\u00a0: unlock with passcode<\/li>\n<li>keylog\u00a0: log keystrokes<\/li>\n<li>keylogclear\u00a0: clear keylog data<\/li>\n<li>locationservice: turn on or off location services<\/li>\n<\/ul>\n<h2><a id=\"user-content-os-x-commands\" class=\"anchor\" href=\"https:\/\/github.com\/neoneggplant\/EggShell#os-x-commands\"><\/a>OS X Commands<\/h2>\n<ul>\n<li>ls\u00a0: list contents of directory<\/li>\n<li>cd\u00a0: change directories<\/li>\n<li>rm\u00a0: delete file<\/li>\n<li>pwd\u00a0: get current directory<\/li>\n<li>download\u00a0: download file<\/li>\n<li>picture\u00a0: take picture through iSight camera<\/li>\n<li>getpid\u00a0: get process id<\/li>\n<li>openurl\u00a0: open url through the default browser<\/li>\n<li>idletime\u00a0: get the amount of time since the keyboard\/cursor were touched<\/li>\n<li>getpaste\u00a0: get pasteboard contents<\/li>\n<li>mic\u00a0: record microphone<\/li>\n<li>brightness\u00a0: adjust screen brightness<\/li>\n<li>getfacebook\u00a0: retrieve facebook cookies from safari<\/li>\n<li>exec\u00a0: execute command<\/li>\n<li>encrypt\u00a0: encrypt file<\/li>\n<li>decrypt\u00a0: decrypt file<\/li>\n<li>persistence\u00a0: attempts to connect back every 60 seconds<\/li>\n<li>rmpersistence\u00a0: removes persistence<\/li>\n<\/ul>\n<h2><a id=\"user-content-local-commands\" class=\"anchor\" href=\"https:\/\/github.com\/neoneggplant\/EggShell#local-commands\"><\/a>Local Commands<\/h2>\n<ul>\n<li>lls\u00a0: list contents of local directory<\/li>\n<li>lcd\u00a0: change local directories<\/li>\n<li>lpwd\u00a0: get current local directory<\/li>\n<li>lopen\u00a0: open local directory<\/li>\n<li>clear\u00a0: clears terminal<\/li>\n<\/ul>\n<h2><a id=\"user-content-notes\" class=\"anchor\" href=\"https:\/\/github.com\/neoneggplant\/EggShell#notes\"><\/a>Notes<\/h2>\n<ul>\n<li>Supports Python 2.7.x<\/li>\n<li>Expect Updates \ud83d\ude42<\/li>\n<\/ul>\n<h2><a id=\"user-content-new-in-20\" class=\"anchor\" href=\"https:\/\/github.com\/neoneggplant\/EggShell#new-in-20\"><\/a>New in 2.0<\/h2>\n<ul>\n<li>Rewritten for encrypted communication\/optimization<\/li>\n<li>Smaller payloads<\/li>\n<li>NeonEggShell -&gt; EggShell<\/li>\n<li>Fully open source<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>EggShell (formerly known as NeonEggShell) is an iOS and OS X surveillance tool written in python. This tool creates an command line session with extra functionality like downloading files, taking&#8230;<\/p>\n","protected":false},"author":1,"featured_media":27597,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[8,139],"tags":[2893,2892,2600,19,2238],"class_list":["post-27596","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-osx-security-tools","category-tools","tag-aes","tag-eggshell","tag-ios","tag-osx","tag-surveillance"],"jetpack_featured_media_url":"https:\/\/deepquest.code511.com\/blog\/wp-content\/uploads\/2017\/01\/IMG_0014.png","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4bBYZ-7b6","_links":{"self":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/27596","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/comments?post=27596"}],"version-history":[{"count":1,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/27596\/revisions"}],"predecessor-version":[{"id":27598,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/posts\/27596\/revisions\/27598"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media\/27597"}],"wp:attachment":[{"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/media?parent=27596"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/categories?post=27596"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/deepquest.code511.com\/blog\/wp-json\/wp\/v2\/tags?post=27596"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}