DOCSEARCHbyAlgolia
Submit Docs

SeaShell Framework

repository·main·Indexed 20 days ago

https://github.com/entysec/seashell

An iOS/macOS post-exploitation framework for remote device access, control, and sensitive information extraction. It leverages the Pwny implant and exploits CoreTrust vulnerabilities to maintain access on iOS versions 14.0 beta 2 through 17.0. The framework includes tools for IPA generation, TCP listener management, and an interactive shell for device interaction.

Tokens
4.4K
Snippets
27
Records
30
Agent score
72%

What's inside SeaShell

  3. How to use SeaShell for remote device access

    main

    The SeaShell workflow follows three main phases:

    1. IPA Generation: Generate a custom IPA file or patch an existing one. Install this IPA on the target iPhone or iPad using TrollStore or another installer that bypasses CoreTrust.
    2. Listener Setup: Start a listener on a host and port that matches the configuration added to your IPA. When the installed application is opened on the device, a connection will be established.
    3. Device Interaction: Once connected, interact with the device via a Pwny interactive shell.

    Supported iOS versions include 14.0 beta 2 through 16.6.1, 16.7 RC, and 17.0 beta 1 through 17.0 (versions vulnerable to the CoreTrust bug).

  4. Install the SeaShell Framework

    main

    Install SeaShell Framework directly from the GitHub repository using pip3. Once installed, you can launch the framework using the seashell command.

    pip3 install git+https://github.com/EntySec/SeaShell

  5. Build Mussel application bundle or IPA

    main

    You can build the Mussel payload using the make command with specific options:

    • make all: Builds the complete application bundle.
    • make ipa: Builds an IPA file from the application bundle.
    # Build the application bundle
make all

# Build the IPA file
make ipa

  6. Interact with a connected device session

    main

    After receiving a connection in the SeaShell listener, use the devices -i <id> command to enter an interactive session with a specific device. Once inside the session, you can use the help command to view all available post-exploitation commands.

    # Example: Interacting with a device (replace <id> with actual session ID)
devices -i <id>

# Inside the session, use help to see commands
help

  7. Initialize SeaShell configuration and directories

    main

    The Config.setup() method initializes the SeaShell environment by ensuring necessary user directories exist on the filesystem. It specifically creates the user configuration directory and the loot directory if they are not already present.

    # Usage of the setup method
config = Config()
config.setup()

  8. Use the App class to build or patch macOS application bundles

    main

    The App class provides an interface to programmatically create macOS .app bundles and package them into .zip archives. It is used to configure application metadata such as the name, bundle identifier, and icon, and then generate the final bundle.

    When initialized, it automatically generates a Base64 encoded hash derived from the provided host and port (formatted as tcp://host:port), which is used as the CFBundlePackageType in the generated Info.plist.

    from seashell.core.app import App

# Initialize with the listener host and port
app = App(host='127.0.0.1', port=4444)

# Configure application identity
app.set_name('My Custom App', 'com.example.customapp')

# Set a custom icon path
app.set_icon('/path/to/icon.icns')

# Generate the zipped .app bundle at the specified path
zip_path = app.generate('/path/to/output_directory')

  9. Manage exfiltrated information with the Loot class

    main
    The Loot class provides tools for managing, storing, and retrieving exfiltrated data (loot) collected by SeaShell. It handles directory creation, file saving, retrieval, and deletion within a designated loot directory.

  10. SeaShell directory structure and paths

    main

    SeaShell uses a specific directory structure for user data, modules, and loot. Understanding these paths is useful for manual data management or extending the tool.

    User Paths

    • User Config Directory: ~/.seashell/ (contains user-specific data)
    • Loot Directory: ~/.seashell/loot/ (where captured data is stored)
    • History File: ~/.seashell/history.txt

    Application Paths

    • Data Directory: Located in the application's data/ folder, containing:
      • banners/
      • tips/
    • Extensibility Directories:
      • modules/
      • plugins/
      • commands/
    User Paths:
  user_path: ~/.seashell/
  loot_path: ~/.seashell/loot/
  history_path: ~/.seashell/history.txt

Application Paths:
  data_path: [base_path]/data/
  banners_path: [data_path]/banners/
  tips_path: [data_path]/tips/
  modules_path: [base_path]/modules/
  plugins_path: [base_path]/plugins/
  commands_path: [base_path]/commands/

  12. Reference: 'ipa' command options

    main

    The following options are available for the ipa command:

    FlagMetavarDescription
    -c, --check <FILE>FILECheck if the IPA file is infected (built or patched).
    -p, --patch <FILE>FILEPatch an existing IPA file with SeaShell hooks.
    -b, --buildN/ABuild a new IPA file via interactive prompts.
    # Example: Patching an existing file
# This will trigger interactive prompts for Host and Port
ipa --patch my_app.ipa

# Example: Checking if a file is patched
ipa --check my_app.ipa