Shell-Eggs · About

About the egg

Shell-Eggs is one Pterodactyl panel egg that hosts every shell direction (incoming, tunneled, reversed, encrypted, covert, web and debug) from a single Docker image. Built by PotenFYR Studios.

• SSH password login + SFTP + generated credentials (sshpass round-trip)
• SSH CA certificates: signed cert login works; wrong principal rejected
• Hardened keys-only: password refused, pubkey accepted
• Telnet: RFC854 server, shadow auth (SHA-512), login OK, bad password rejected
• Reverse shells (python/nc/bash): reach an external listener, command round-trip
• TLS bind shell: socat OPENSSL encrypted round-trip
• Registry coverage: all 54 ids have handlers; all 23 reverse payloads emit + syntax-check
• fd-3 panel stop, SIGTERM shutdown, credential persistence, panel-port binding

No mocks. CI boots the real image and proves real behavior on every push. GitHub Actions.

Shells are dual-use tools. Host them only on servers you own or are explicitly authorized to test. Generated credentials, TLS certs and tokens are written mode-600 inside the container workspace. The hardened and CA profiles exist precisely because defaults matter: keys-only, principal pinning, no root login.

For security-sensitive reports, mark the issue title with [security] or email support@potenfyr.in. Avoid posting exploit details until a fix lands.

Licensed under the Apache License 2.0 with the Commons Clause. Free to fork, modify, use, and build products or services around it, but the software itself may not be sold as a paid product. See the LICENSE file for details; the LICENSE file is authoritative and summaries never override it. A plain-English breakdown lives on the license page.

We welcome shell registry additions, bug fixes and docs improvements. See CONTRIBUTING.md for the contribution flow (edit scripts/shell-registry.sh + SHELLs.md; the docs site auto-syncs on build). Issues welcome at GitHub Issues.