How jayaram-yalla/ghost_in_the_ide works
GHOST IN THE IDE is an authorized-lab research platform demonstrating IDE plug-ins that register with a C2 service, gather workstation and developer-activity data, and receive commands; the server dashboard presents clients, collected data, results, analytics, and timelines. The principal workflow runs from IDE plug-in startup through monitoring and client communication to server-side storage and dashboard analysis. The three plug-in families share capabilities but have separate implementations. README capability descriptions supplement the sampled excerpts; backend routes and some plug-in wiring were not sampled, so those links are kept at the documented subsystem level.
Main entry points: c2_pycharm.py C2 API service · main.js Dashboard UI · C2Client.ts VS Code transport · extension.ts VS Code extension
Components 20
IDE Clients
- VS Code extension
VSCODE_PLUGIN/VSC_PLUGIN/src/extension.ts - JetBrains plugin
JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/SecurityDemoPlugin.java - Eclipse plugin
ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/Activator.java
Collection Services
- VS Code monitors
VSCODE_PLUGIN/VSC_PLUGIN/src/services - VS Code commands
VSCODE_PLUGIN/VSC_PLUGIN/src/services/CommandExecutorService.ts - VS Code transport
VSCODE_PLUGIN/VSC_PLUGIN/src/utils/C2Client.ts - JetBrains monitors
JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/monitors - JetBrains exfiltration
JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/exfiltration/ExfiltrationService.java - JetBrains commands
JETBRAINS_PLUGIN/JB_PLUGIN/src/main/java/com/securitydemo/pycharm/rce - Eclipse monitors
ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services - Eclipse exfiltration
ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services/ExfiltrationService.java - Eclipse commands
ECLIPSE_PLUGIN/EC_PLUGIN/src/com/securitydemo/eclipse/services/CommandExecutorService.java
C2 Server
- C2 API service
C2/c2_pycharm.py - Stored lab data
C2/persistence.py - Analytics
C2/analytics.py
Dashboard
- Dashboard UI
C2/static/js/main.js - Dashboard charts
C2/static/js/charts.js - Live updates
C2/static/js/websocket.js
Other components
- Lab operator
- IDE workstation
Connections 27
- IDE workstation → VS Code extension: hosts extension
- IDE workstation → JetBrains plugin: hosts plugin
- IDE workstation → Eclipse plugin: hosts plugin
- VS Code extension → VS Code monitors: starts monitoring
- VS Code extension → VS Code commands: starts commands
- VS Code monitors → VS Code transport: sends telemetry
- VS Code commands → VS Code transport: polls and reports
- JetBrains plugin → JetBrains monitors: starts monitoring
- JetBrains monitors → JetBrains exfiltration: submits collected data
- JetBrains plugin → JetBrains commands: starts command handling
- JetBrains commands → JetBrains exfiltration: submits results
- Eclipse plugin → Eclipse monitors: starts services
- Eclipse monitors → Eclipse exfiltration: submits collected data
- Eclipse commands → Eclipse exfiltration: submits results
- VS Code transport → C2 API service: communicates
- JetBrains exfiltration → C2 API service: sends telemetry
- JetBrains commands → C2 API service: polls commands
- Eclipse exfiltration → C2 API service: sends telemetry
- Eclipse commands → C2 API service: polls commands
- C2 API service → Stored lab data: stores client data
- C2 API service → Analytics: requests analysis
- Lab operator → Dashboard UI: views and operates
- Dashboard UI → C2 API service: calls API
- Dashboard UI → Dashboard charts: renders metrics
- Dashboard UI → Live updates: subscribes updates
- Live updates → C2 API service: receives updates
- C2 API service → VS Code transport: returns commands