EvilOSX - An evil RAT (Remote Administration Tool) for macOS

项目说明

<h1 align="center">
<br>
<a href=" src="/data/images/logo.png?raw=true" alt="Logo" width="280"></a>
<br>
E
<br>
</h1>

<h4 align="center">An evil RAT (Remote Administration 工具) for macOS / OS X.</h4>

<p align="center">
<a href="
<img src=" alt="License">
</a>
<a href="
<img src=" alt="Python">
</a>
<a href="
<img src=" alt="Issues">
</a>
<a href="
<img src=" alt="Build Status">
</a>
<a href="
<img src=" alt="Contributing">
</a>
</p>

---

Marco Generator by Cedric Owens

This project is no longer active

Features

Emulate a terminal instance

Simple extendable module system

No bot dependencies (pure python)

Undetected by anti-virus (OpenSSL AES-256 encrypted payloads)

Persistent

GUI and CLI support

Retrie passwords

Retrie tokens and contacts

Retrie the clipboard

Retrie history (Chrome and Safari)

Phish for iCloud passwords

iTunes (iOS) backup enumeration

Record the microphone

Take a desktop screenshot or picture using the webcam

Attempt to get root pri escalation

How To Use

Warning: Because payloads are created unique to the target system (automatically by the 服务端), the 服务端 must be running when any bot connects for the first time.

Ad users

There's also a CLI for those who want to use this over SSH:

Screenshots

!CLI
!GUI

Moti

This project was created to be used with my Rubber Ducky, here's the simple script:

It takes about 10 seconds to backdoor any unlocked Mac, which is...... *nice*

Terminal is spelt that way intentionally, on some systems spotlight won't find the terminal otherwise. <br/>

To bypass the keyboard setup assistant make sure you change the VID&PID which can be found here. <br/>

Aluminum Keyboard (ISO) is probably the one you are looking for.

E will be maintained under the Semantic guidelines as much as possible. <br/>
服务端 and bot releases will be numbered with the follow format:

And constructed with the following guidelines:

Breaking backward compatibility (with older bots) bumps the major

New additions without breaking backward compatibility bumps the minor

Bug fixes and misc changes bump the patch

For more information on SemVer, please visit

Design Notes

Infecting a machine is split up into three parts:

* A launcher is run on the target machine whose only goal is to run the stager
* The stager asks the server for a loader which handles how a payload will be loaded
* The loader is given a uniquely encrypted payload and then sent back to the stager

The ser it's communications by sending messages hidden in HTTP 404 error pages (from BlackHat's "Hiding In Plain Sight")

* Command requests are retrieved from the 服务端 via a GET request
* Command responses are sent to the 服务端 via a POST request

Modules take ad of python's dynamic nature, they are simply sent over the 网络 compressed with zlib, along with any configuration options

Since the bot only communicates with the 服务端 and never the other way around, the 服务端 has no way of knowing when a bot goes offline

Issues

Feel free to submit any issues or feature requests here.

Contributing

For a simple guide on how to create modules click here.

Credits

The awesome Empire project

Shoutout to Patrick Wardle for his awesome talks, check out Objecti

manwhoami for his projects: OSXChromeDecrypt, MMeTokenDecrypt, iCloudContacts <br/>

(now deleted... let me know if you reappear)

The slowloris module is pretty much copied from PySlowLoris

urwid and this 代码 which saved me a lot of time with the CLI

Logo created by motusora

License

GPLv3

项目信息

开发语言：Python

Star 数：2421

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕An evil RAT (Remote Administration 工具) for macOS / OS X.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。