PHANTOM-STRIKE

A multi-protocol C2 beacon with Telegram integration and DNS exfiltration for authorized security testing and educational purposes.

Disclaimer: This software is provided for authorized security testing and educational purposes only. Unauthorized use is illegal and unethical.

Overview

PHANTOM-STRIKE is a C2 beacon that uses multiple communication channels including Telegram bots, TCP/SSL, and DNS tunneling for command and control operations.

Features

Feature	Description
Telegram Integration	Bot-based command interface
TCP/SSL Fallback	Direct encrypted C2 connection
DNS Tunneling	Data exfiltration via DNS queries
AES-256 Encryption	Secure communications
In-Memory Execution	Shellcode execution on Windows
Anti-Analysis	Debugger and VM detection
Multi-Platform	Windows and Linux support

Project Structure

phantom-strike/
├── phantom_strike.py    # Main beacon payload
├── README.md            # This file
├── LICENSE              # MIT License
├── SECURITY.md          # Security policy
└── CONTRIBUTING.md      # Contribution guidelines

Prerequisites

pip install pyinstaller cryptography

Build

pyinstaller --onefile --noconsole --uac-admin phantom_strike.py

Build Options

Option	Description
--onefile	Single binary output
--noconsole	Hidden console window
--uac-admin	Request admin privileges

Configuration

Edit the following variables in phantom_strike.py:

TELEGRAM_BOT_TOKEN = "YOUR_BOT_TOKEN_HERE"    # Telegram bot token
TELEGRAM_CHAT_ID   = "YOUR_CHAT_ID_HERE"      # Telegram chat ID
C2_DOMAIN          = "your-c2-server.com"      # C2 domain
C2_IP              = "192.168.1.100"           # C2 IP address
C2_PORT            = 443                        # C2 port

Usage

Setup

1. Create a Telegram bot via @BotFather
2. Get your chat ID (send a message to @userinfobot)
3. Configure the beacon with your credentials
4. Build and deploy to target

Commands

Send commands via Telegram:

Command	Description
task <command>	Execute a system command
status	Check beacon status
exit	Terminate beacon

Communication Channels

┌─────────────────────────────────────────────────────────┐
│                    TELEGRAM                             │
│  - Primary C2 channel                                   │
│  - Bot-based command interface                          │
│  - Encrypted communications                             │
└─────────────────────────────────────────────────────────┘
                           │
┌─────────────────────────────────────────────────────────┐
│                    TCP/SSL                              │
│  - Fallback C2 channel                                  │
│  - Direct connection to C2 server                       │
│  - AES-256 encryption                                   │
└─────────────────────────────────────────────────────────┘
                           │
┌─────────────────────────────────────────────────────────┐
│                  DNS TUNNELING                          │
│  - Data exfiltration                                    │
│  - Subdomain-based encoding                             │
│  - Covert channel                                       │
└─────────────────────────────────────────────────────────┘

Detection Indicators

• Telegram API connections from unusual processes
• DNS queries with encoded subdomains
• Outbound connections on port 443
• Process injection patterns

Legal Notice

This software is provided for authorized security testing and educational purposes only.

• Authorization Required: You must have explicit written permission from the system owner
• Legal Compliance: Unauthorized access to computer systems is illegal
• No Warranty: This software is provided "as is" without warranty
• Liability: The author assumes no responsibility for misuse

Contributing

See CONTRIBUTING.md for guidelines on contributing to this project.

Security

For reporting security vulnerabilities, see SECURITY.md.

License

This project is licensed under the MIT License - see the LICENSE file for details.

Author

wsuits6 - GitHub