Bella: A pure python, post-exploitation, data mining tool and remote administration tool for macOS.

Here's a command list of supported features (other than bash shell) once connected. The Find my iPhone/Find my Friends payload is brutal

Chat History
Download the user's macOS iMessage database.
Usage: chat_history
Requirements: None

Check Backups
Enumerate the user's local iOS backups.
Usage: check_backups
Requirements: None

Chrome Dump
Decrypt user passwords stored in Google Chrome profiles.
Usage: chrome_dump
Requirements: Chrome SS Key [see chrome_safe_storage]

Chrome Safe Storage
Prompt the keychain to present the user's Chrome Safe Storage Key.
Usage: chrome_safe_storage
Requirements: None

Current Users
Find all currently logged in users.
Usage: currentUsers
Requirements: None

Get Root
Attempt to escalate Bella to root through a variety of attack vectors.
Usage: get_root
Requirements: None

Find my iPhone
Locate all devices on the user's iCloud account.
Usage: iCloud_FMIP
Requirements: iCloud Password [see iCloud_phish]

Find my Friends
Locate all shared devices on the user's iCloud account.
Usage: iCloud_FMF
Requirements: iCloud Token or iCloud Password

iCloud Contacts
Get contacts from the user's iCloud account.
Usage: iCloud_contacts
Requirements: iCloud Token or iCloud Password

iCloud Password Phish
Trick user into verifying their iCloud password through iTunes prompt.
Usage: iCloudPhish
Requirements: None

iCloud Query
Get information about the user's iCloud account.
Usage: iCloud_query
Requirements: iCloud Token or iCloud Password

iCloud Token
Prompt the keychain to present the User's iCloud Authorization Token.
Usage: iCloud_token
Requirements: None

Insomnia Load
Loads an InsomniaX Kext to prevent laptop from sleeping, even when closed.
Usage: insomnia_load
Requirements: root, laptops only

Insomnia Unload
Unloads an InsomniaX Kext loaded through insomnia_load.
Usage: insomnia_unload
Requirements: root, laptops only

Bella Info
Extensively details information about the user and information from the Bella instance.
Usage: bella_info
Requirements: None

Keychain Download
Downloads all available Keychains, including iCloud, for offline processing.
Usage: keychain_download
Requirements: None

Mike Stream
Streams the microphone input over a socket.
Usage: mike_stream
Requirements: None

MITM Start
Injects a Root CA into the System Roots Keychain and redirects all traffic to the CC.
Usage: mitm_start
Requirements: root.

MITM Kill
Ends a MITM session started by MITM start.
Usage: mitm_kill
Requirements: root.

Reboot Server
Restarts a Bella instance.
Usage: reboot_server
Requirements: None.

Safari History
Downloads user's Safari history in a nice format.
Usage: safari_history
Requirements: None.

Screenshot
Take a screen shot of the current active desktop.
Usage: screen_shot
Requirements: None.

Shutdown Server
Unloads Bella from launchctl until next reboot.
Usage: shutdown_server
Requirements: None.

System Information
Returns basic information about the system.
Usage: sysinfo
Requirements: None.

User Pass Phish
Will phish the user for their password with a clever dialog.
Usage: user_pass_phish
Requirements: None.
/r/netsec Thread Link - github.com