Ghost Framework -- Control Android Devices Remotely

Ghost Framework is an Android post-exploitation framework that uses an
Android Debug Bridge to remotely access and control Android device.
Ghost Framework 6.0 gives us the power and convenience of remote Android device administration.

Remotely control android using ghosts

We can use this framework to control old Android devices which have turn on the debug bridge in the "Developer options".

Now this becomes very harmful because an attacker gets the full admin control on the vulnerable Android device.

In our this detailed tutorial we will practically learn how we can use the Ghost Framework to take control of Android device from our Kali Linux system.

So we start from cloning the Ghost Framework from GitHub by using following command:
git clone https://github.com/entynetproject/ghost
The screenshot of the command is following:

clonning ghost from github

Then it will be cloned on our root folder of Kali Linux. Then we go the ghost directory by using cd command:
cd ghost
Now we need to install it using the installer script. Before that we give the permission to the installer script by applying following command:
sudo chmod +x install.sh
Here if it prompted for sudo password of our machine then we need to provide it.

giving root permission

Now we can run the installer script using following command:

sudo ./install.sh
Then wit will start installing the dependencies and  as the following screenshot:
 

This process will take some time depending our internet speed.

After installing Ghost Framework we can run it from any where in our terminal by only the ghost command:

ghost
And the ghost will appear with it's main screen as the following screenshot:

ghost home screen

Now we can see the options by using help command.
help
The help option will be like following screenshot:

ghost help options

In the above screenshot we can see that we can connect vulnerable Android device by it's IP with the help of options command:

 
Now how we get a IP address of an Old vulnerable Android devices? Shodan is here. Shodan is a grate search engine for searching the devices connected to internet. We already have a tutorial on Shodan.

In Shodan we have to search "Android Debug Bridge", as we have shown in following screenshot:

shodan android debug bridge

Here we can see over 19k search results. Every device is vulnerable for ghost and those devices are connected to internet. If ghost shows failed to connect then Shodan is showing us an offline device. We also can try this with our Android device.

From here we can pick any IP address and use with connect command.
set RHOST <IP address>
Then if need we need to set port using RPORT command (Usually we use 5555 port that is set by default, if we are using 5555 port then we don't need to add it using RPORT).
 
To get connected we need to use run command:
run
We got connected with this device as we see the screenshot below.
Here we can see we are connected with the IP address. Now we can run anything from Ghost Framework.

We can see the commands we can run after connecting by using help command again.
help
ghost framework main options

What we can do with Ghost Framework:

  1. Show connected devices
  2. Disconnect all devices
  3. Connect a new device
  4. Access device shell
  5. Install an apk on a device
  6. Screen record a device
  7. Get device screenshot
  8. Restart Ghost Server
  9. Pull files from devices
  10. Shutdown the device
  11. Uninstall an app
  12. Show device log
  13. Dump system Info
  14. List of all device app
  15. Run a device app
  16. Port Forwarding
  17. Grab wpa_supplicant(WiFi password)
  18. Show Mac/Inct
  19. Extract apk from app
  20. Get Battery Status
  21. Get Network Status
  22. Turn WiFi on/off
  23. Remove device password
  24. Emulate button presses
  25. Get Current Activity
  26. Update Ghost Framework
  27. Exit Ghost Framework
For an example we connect to the Android shell of connected device.
shell
shell on compromised android device

Ghost Framework has a simple and clear UX/UI. It is easy to understand and it will be easier for us to master the Ghost Framework.

Ghost Framework can be used to remove the remote Android device password if it was forgotten. It is also can be used to access the remote Android device shell without using OpenSSH or other protocols.

[UPDATE] Many user got error like this "Failed to start Ghost Server". In that case ADB (Android Debug Bus) and fastboot need to be install manually. Try following commands if this kind of error comes:
sudo apt-get update
sudo apt-get install android-tools-adb
sudo apt-get install android-tools-fastboot

Usage of the post on Ghost Framework for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local,state, federal, and international laws. Developers and content writers assume no liability and are not responsible for any misuse or damage caused by this program.

If you like our tutorial or got an issue regarding this post please comment down, we always happy to replay. If you liked our tutorials then visit our website regularly and for the quick updates follow us on Twitter and Medium.

148 comments:

  1. failed to start ghost server! any fix

    ReplyDelete
    Replies
    1. Can you please provide the full information of the error. Because our ghost framework is works smoothly.

      Delete
    2. It doesn't show any information. Only says
      "[-] Failed to start Ghost Server!"

      Delete
    3. Try to remove it using the uninstall.sh bash file in to the ghost directory and then delete the directory. Do the complete setup from the git clone again. Try this

      Delete
    4. I tried bro. Tried many times. but didn't work. Will try to install it on a fresh Kali Linux and let you know. But as I saw on YouTube tutorials, many of users are facing the same issue.

      Delete
    5. have you try to install it on android using Termux?

      Delete
    6. My question is It doesn't show any information. Only says
      "[-]No Internet connection!"

      Delete
    7. You add network repositories,regular Repositories and Source Repositories in source list in this location etc/apt/source.list

      Delete
    8. If it fails to start ghost server it means you haven't run the install.sh and thus has not installed the adb package.As for internet connection issue, I found that
      if you dont have the iputils-ping package installed, It will always say no internet connection.Hope this helps

      Delete
    9. bro you try to parrot os definetly it's work parrot os have tools more without error it's best os for for bigenners

      Delete
    10. showing such error....
      [*] Connecting to 183.179.79.239:5555...
      [-] Failed to connect to 183.179.79.239:5555!

      Delete
  2. For educational purposes. Not bad

    ReplyDelete
  3. Failed to start ghost server

    ReplyDelete
    Replies
    1. Many users getting this error. The problem comes from the developers of ghost framework.

      Delete
    2. in termux android-tools and scrcpy pakages are not getting installied showing unable to locate package

      Delete
    3. Sorry, we can't say much about Termux. We didn't use it so much. Sorry from heart.

      Delete
  4. um i've been take a screenshot as remotly but i can't find the picture on my desktop

    ReplyDelete
    Replies
    1. give the path post screenshot command like
      'screenshot /home/user/downloads'

      Delete
  5. not showing any options only ghost will be open
    like
    ghost>

    ReplyDelete
  6. Hello Everyone.
    Is it possible to use this awesome framework targeting only devices within my network(meaning using my private ip addresses)?

    ReplyDelete
  7. Failed to connect to 52.221.194.125

    ReplyDelete
  8. Failed to connect to my ip address how solved this problem

    ReplyDelete
  9. Failed to connect to my ip address how solved this problem

    ReplyDelete
    Replies
    1. We can use this framework to control old Android devices which have turn on the debug bridge in the "Developer options". That means your device may not vulnerable.

      Delete
    2. I'm unable to view saved files, it says file has been saved to my desired directory but there's just no file, such as screenshots or records. Can you help me? Thanks!

      Delete
  10. how to install it on android using termux

    ReplyDelete
  11. [wanasx@wanasx ghost]$ sudo ghost
    which: no adb in (/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl:/Applications/Visual Studio Code.app/Contents/Resources/app/bin)
    [-] Failed to start Ghost Server!

    ReplyDelete
    Replies
    1. It means you haven't run the install.sh and thus has not installed the adb package.

      Delete
  12. Sir my Kali Linux show that
    [-] failed to start ghost service

    ReplyDelete
    Replies
    1. install adb

      quick search on google how to install it and then retsart the command ghost, it work for me

      Delete
  13. sir while im installing the ghost im facing the error like this how to solve it
    Traceback (most recent call last):
    File "./ghost", line 27, in
    import readline
    ModuleNotFoundError: No module named 'readline'

    ReplyDelete
    Replies
    1. Hey, You need to install readline. try one of following commands:

      pip install pyreadline
      or
      python -m pip install pyreadline

      Delete
    2. its not working bro

      Delete
    3. Try
      pyton3 -m pip install pyreadline

      Delete
  14. Hi;
    I can't connect ghost framework to my phone.The text of message of ghost is:
    "Failed to connect to .
    My phone is quite new ( 1 year ),is it possible that's not vulnerable?
    So,can i use ghost framework only on old phones?
    Thank's for your help and time.

    ReplyDelete
    Replies
    1. It depends on your phone. If it is not vulnerable then for education purpose try it on Shodan to check the ghost framework working properly.

      Delete
  15. How to connect to devices that ma not be vulnerabl?
    How to connect to a device that are not present on Shodan?

    ReplyDelete
    Replies
    1. Okey, telling this can be used in non-ethical works. So we can't share this. But we can refer you something interesting. Android Security: ADB connection

      Delete
  16. Failed to start Ghost Server!

    ReplyDelete
    Replies
    1. Have you installed ADB (Android Debug Bus) and fastboot ? We have updated our post because many user getting this error check the update section and try those commands. Good luck

      Delete
  17. i am facing same problem "NO internet connection" when installing the ghost framework.
    and i already change etc/apt/sources.list but it did not work.
    please help..

    ReplyDelete
    Replies
    1. Hi, I think you are using Kali Linux in Virtual Machine. I don't know why some virtual machine users got this problem. You can easily fix it by modifying the install.sh file. You need to check it and delete those lines checks for internet connection.

      Delete
    2. Thanks a lot for your suggestion "You can easily fix it by modifying the install.sh file. You need to check it and delete those lines checks for internet connection".I just change some line in install.sh file which were showing "No internet connection" and some other modification too.So now it is working without any error.

      Delete
    3. how did you do it? im unable to do it. plz help

      Delete
  18. Can I use this tool in termux?

    ReplyDelete
    Replies
    1. Yes but to run the installer script you need root permission in termux.

      Delete
  19. Failed to connect to my device
    Debug bridge is also on in my device , but it's still not connecting and i tried it in my old device but it's not connecting with that device also , but all io address from shodan are connecting , what's the problem can anyone tell me??

    ReplyDelete
    Replies
    1. Did you double checked the public IP address of your devices?

      Delete
    2. Yes i checked it from google, now please help me i am stuck in this topic..

      Delete
    3. Are you sure that your device is vulnerable ? We have checked after your call. Everything is working finely in our case. Try on different devices. Good Luck

      Delete
  20. my commands such as battery and screenshot on applying to an android device shows
    chmod :changing permission of 'data/payloads/battery' :operation not permitted

    ReplyDelete
    Replies
    1. Kali Linux pls. reply to this problem.

      Delete
    2. Are you trying on shodan ? There are so much internet of things are connected with Shodan. I think you connected with some android device (not phone) with no battery and display, Like android tv box or something other. That's why battery is not available.

      Delete
  21. I have a good target, I can connect it from Kali up to date but
    I tried with a docker kali rolling, impossible to connect on my target, also a simple adb connect is functionnal, so the problem is in GHOST, but no verbose mode to find the problem.

    ReplyDelete
    Replies
    1. If you want to check ghost is properly works or not, try ip address from shodan as we described on this tutorial. If this works god then your ghost doesn't have any problem. If not works then tell us again with some more error details.

      Delete
  22. No superuser binary detected.
    Are you rooted?
    Help!!😭😭

    ReplyDelete
  23. sir my ghost server failed to start

    ReplyDelete
    Replies
    1. Failed to start Ghost Server
      In this case ADB (Android Debug Bus) and fastboot need to be install manually. Try following commands if this kind of error comes:

      sudo apt-get update
      sudo apt-get install android-tools-adb
      sudo apt-get install android-tools-fastboot

      Delete
  24. linux:~/ghost$ chmod +x install.sh
    chmod: changing permissions of 'install.sh': Operation not permitted

    how can i solve this issue ?

    ReplyDelete
    Replies
    1. Hey, you forgot to add sudo. Try following command:

      sudo chmod +x install.sh

      Delete
    2. ghost> connect 182.50.123.36
      [*] Connecting to 182.50.123.36...
      [-] Failed to connect to 182.50.123.36!
      I tried that and now i am getting this error.

      Delete
  25. how to expose my oneplus 6 to adb attack, i want to test on my phone.
    It always says failed to connect.

    ReplyDelete
    Replies
    1. Google it. If we said this here, it will go in an unethical section.

      Delete
  26. Can you please tell how to use its commands like shell, download etc.

    ReplyDelete
    Replies
    1. There is an option of installing apk. make a payl0ad and install it. you are done.

      Delete
  27. Whenever i connect my ip it shows fsiled to connect whats the error of this one help me ???

    ReplyDelete
  28. while im try to install it shows installing dependencies.... even after 2 to 3hrs still showing the same although my internet connection is good

    ReplyDelete
  29. hey kali linux:
    im using kali linux 2020.2 (graphical install)
    i installed ghost framework but i cant access it ...it says failed to start ghost server

    ReplyDelete
    Replies
    1. Failed to start Ghost Server
      In this case ADB (Android Debug Bus) and fastboot need to be install manually. Try following commands if this kind of error comes:

      sudo apt-get update
      sudo apt-get install android-tools-adb
      sudo apt-get install android-tools-fastboot

      Delete
    2. Hi,
      I am getting following error
      ghost> connect 192.168.1.111
      [*] Connecting to 192.168.1.111...

      I have enable usb debugging also installed update also..
      I m running it on VM..How do I fix it ?
      plz reply...

      Delete
  30. now i tried downloading the zipfile
    now its says installing dependencies...
    this has been happening for a while...any solutions

    ReplyDelete
  31. it installed successfully ...
    but it says failed to start ghost server

    ReplyDelete
    Replies
    1. Failed to start Ghost Server
      In this case ADB (Android Debug Bus) and fastboot need to be install manually. Try following commands if this kind of error comes:

      sudo apt-get update
      sudo apt-get install android-tools-adb
      sudo apt-get install android-tools-fastboot

      Delete
  32. anything like for remote control windows?

    ReplyDelete
  33. Replies
    1. Failed to start Ghost Server
      In this case ADB (Android Debug Bus) and fastboot need to be install manually. Try following commands if this kind of error comes:

      sudo apt-get update
      sudo apt-get install android-tools-adb
      sudo apt-get install android-tools-fastboot

      Delete
  34. how to open main menu of ghost

    ReplyDelete
    Replies
    1. use command ghost or sudo ghost to open the main menu of this fremework

      Delete
  35. Hi,
    I am getting this when i try to connect
    ghost> connect 192.168.1.111
    [*] Connecting to 192.168.1.111...

    I hv enable usb debugging option...i m running kali on vm..
    plz help who had face this b4...

    ReplyDelete
  36. Hi Sir,
    Ghost Script gets stuck at * Installing Dependencies forever...

    ReplyDelete
    Replies
    1. If your using old version of system, Ghost will update all packages. Because of this it takes really very long time to install it.

      Delete
  37. I followed all the isntallation instructions, but when i run the ghost command, it only shows the Ghost picture and
    Ghost Framework v5.0
    --------------------
    ghost>


    That's it. No options are being shown. I tried uninstalling and reinstalling, but that didn't solve the problem.

    ReplyDelete
    Replies
    1. Yes, I also get that. It looks like this when I type in help
      https://user-images.githubusercontent.com/54115104/83800104-922afd80-a6af-11ea-94c8-224550d0db1e.png

      But how do I get to the options menu?

      Delete
    2. Remove it totally and try to install again. We have updated the repository.

      Delete
  38. unrecognized command

    please help!!!!!!
    for any command
    for even exit

    ReplyDelete
    Replies
    1. anyone please help i am getting
      [ - ]unrecognized command for any command

      Delete
    2. Mr. Kali Linux host please help me

      Delete
    3. Which commands u have used to install and run ghost? are you using Kali Linux desktop version? Please send us more details that we can help you.. Or try uninstall ghost and re-install it as we showed in our tutorial.

      Delete
    4. As mentioned above I had used the same commands for installation with help of github clonig and it worked(with sudo).
      Yes I am using kali linux desktop version (version 2). As u said I reinstalled it , again it showed the same "[ - ] unrecognized command for every command i type (even for help or exit)".

      Delete
    5. I am facing the problem too. Whatever command I use it says [-] Unrecognized command

      I followed the steps shown in this page but after installing and starting Ghost framework I just cant give commands. I tried help, connect, e.t.c. but same reply as always.....Kali Linux devs please work this out!

      Delete
    6. This problems comes from Ghost Framework. They are working on it. Ghost Framework v6.0 is coming with bug fixes. We will update whenever it releases. Make sure that you followed us

      Delete
  39. still cant start ghost server after ran the sudo apt command.. its unable locate the package

    ReplyDelete
    Replies
    1. There are no need to use sudo apt command for ghost... By the way to fix unable to locate package try this

      Delete
    2. hey reply to my question

      Delete
  40. can anyone tell me what i done wrong pls
    Traceback (most recent call last):
    File "./ghost", line 9, in
    import readline
    ModuleNotFoundError: No module named 'readline'

    im new to kali linux but learned on win 97 been win xp till 4 weeks ago
    any help is help if i need to learn new program np any help is help

    ReplyDelete
    Replies
    1. use following command:
      pip install pyreadline

      Delete
  41. how can download gohst framework


    ReplyDelete
    Replies
    1. Please,read the article carefully. We have used a command to clone it from GitHub. Cloning=Downloading.

      Delete
  42. Sir kindly help me wuth the problem:
    ibrar@kali:~/ghost$ sudo ghost
    Traceback (most recent call last):
    File "./ghost", line 9, in
    import readline
    ModuleNotFoundError: No module named 'readline'

    ReplyDelete
    Replies
    1. the python module named 'readline' is missing on your machine. You can install it by using following command then run ghost framework:
      sudo pip3 install readline

      Delete
  43. hello eny body can hack android phone by ip adress

    ReplyDelete
  44. am in ghost framework now. but it says unrecognised commands. what might be the problem?

    ReplyDelete
    Replies
    1. This problems comes from Ghost Framework. They are working on it. Ghost Framework v6.0 is coming with bug fixes. We will update whenever it releases. Make sure that you followed us.

      Delete
  45. I think better to do a video for more clarification on this

    ReplyDelete
  46. [-] Failed to connect to 27.34.20.102!
    how to solve it

    ReplyDelete
  47. HOw to to coonect any ip address with ghost frame work

    ReplyDelete
  48. ITs fail to connect every ip address that i try

    ReplyDelete
    Replies
    1. Does your device vulnerable? OK, wait a bit Ghost Framework v6.0 coming soon. Whenever its come we will update our tutorial. To stay tuned follow us.

      Delete
  49. Hi i use that to install and say

    Install.sh: 80: [[:not found
    Install.sh: 9,: [[:not found
    -e [-] installation failed!

    ReplyDelete
    Replies
    1. Hi, Brenoli did you set proper permission for this ? chmod +x . We think we should remove those files and start from the beginning.

      Delete
    2. Yes, i do. Wrote
      chmod +x install.sh
      sudo ./install.sh
      The first time said
      [-] No internet connection!
      Then i tried with
      chmod +x install.sh
      sudo sh install.sh
      And the answer was
      -e [*] Installing dependences...
      Install.sh: 80:[[:not found
      Install.sh: 90:[[:not found
      -e[-] installation failed!

      Delete
    3. Okay, You can edit the installer script and remove the Internet connection checker part . This tool is misbehaving and the developer is trying to release version 6 with a update. We also cover it please stay tuned.

      Delete
    4. You should wait for next update. The work is in progress according to the developer.

      Delete
    5. The Update is live. Check this article again. Thanks

      Delete
  50. please help screen command is not working in ghost frame

    work in kali linux

    ReplyDelete
  51. Everyone getting errors with Ghost framework, we suggest to wait because it will come with a new update (6.0) with lots of more feature. The work is under progress according to the author/developer of Ghost Framework. Everyone can contribute in the project.

    ReplyDelete
  52. where can i see the taken screen shot and screen rec pleasee can u tell me?

    ReplyDelete
    Replies
    1. Everyone getting errors with Ghost framework, we suggest to wait because it will come with a new update (6.0) with lots of more feature. The work is under progress according to the author/developer of Ghost Framework. Everyone can contribute in the project.

      Delete
  53. fails to connect to even the shodan IPs.. all IPs fail..

    ReplyDelete
    Replies
    1. Everyone getting errors with Ghost framework, we suggest to wait because it will come with a new update (6.0) with lots of more feature. The work is under progress according to the author/developer of Ghost Framework. Everyone can contribute in the project.

      Delete
  54. failed to connect to Shodan - x.x.x.x Kali VM. tried both NAT and bridged (even put vm outside of the firewall for a few minutes).. Removed, Reinstalled, Updated.. Is there a fix yet?

    ReplyDelete
    Replies
    1. Everyone getting errors with Ghost framework, we suggest to wait because it will come with a new update (6.0) with lots of more feature. The work is under progress according to the author/developer of Ghost Framework. Everyone can contribute in the project.

      Delete
  55. bro how i connect my mobile in ghost can you help me../

    ReplyDelete
  56. Hey bro i got this error :
    raceback (most recent call last):
    File "./ghost", line 37, in
    from core.ghostcat import GhostCat
    File "/root/ghost/core/ghostcat.py", line 32, in
    from core.ghost import ghost
    File "/root/ghost/core/ghost.py", line 32, in
    from core.transfer import transfer
    ModuleNotFoundError: No module named 'core.transfer'

    Can you help ?

    ReplyDelete
    Replies
    1. Have you installed it with install.sh?
      If yes then try process again it is fixed by the developer.
      Check what the developer said on this error.

      Delete
    2. Thank you man <3

      Delete
  57. unable to open ghost second time as root user
    error is


    root@kali:~# ghost
    Traceback (most recent call last):
    File "./ghost", line 37, in
    from core.server import server
    File "/root/ghost/core/server.py", line 32, in
    from core.ghost import ghost
    File "/root/ghost/core/ghost.py", line 32, in
    from core.transfer import transfer
    ModuleNotFoundError: No module named 'core.transfer'

    ReplyDelete
    Replies
    1. and i also reinstalled it but error is still coming

      Delete
    2. and also it is looking like this






      .__ __
      ____ | |__ ____ _______/ |_
      / ___\| | \ / _ \/ ___/\ __\
      / /_/ > Y ( <_> )___ \ | |
      \___ /|___| /\____/____ > |__|
      /_____/ \/ \/

      Delete
    3. The developer fixing issues hour by hour. You should remove ghost and re clone and install again to see some effects.

      Delete
    4. now its working but saying failed to connect through ip

      Delete
    5. According to the author of Ghost that it is not Ghost's problem Shodan is showing us offline IP's. You can check what he said by here.

      Delete
    6. can you tell me how to install v5.0 version of ghost

      Delete
    7. Hey man, I have forked Ghost v5.0 on my github. V5.0 is really good idk why I don't like the new version. You can check this link.

      https://github.com/3v1lW1th1n/ghost

      Delete

Please do not spam here. It is comment box not a spambox. Promotional links are not allowed.

Powered by Blogger.