phantom-offensive/phantom

How phantom-offensive/phantom works

Phantom C2 is a red-team command-and-control framework with CLI and Web UI operator interfaces. Its principal workflow is operator authentication and server startup, agent check-in through a listener, task dispatch and result collection, then operator review. Separate capability branches cover listener management and payload generation; the README also documents mobile endpoints, post-exploitation, evasion, and external channels. The graph follows sampled calls and indexed references; links to unsampled subsystems are omitted where their wiring is not shown.

Main entry points: server.go Server Core · main.go Server Entry · listener.go C2 Listeners · shell.go CLI Shell

Components 21

Operator Control

Server Entry cmd/server/main.go
CLI Shell internal/cli/shell.go
Web UI internal/webui/webui.go
Operator Auth internal/server/auth.go

C2 Server

Server Core internal/server/server.go
C2 Listeners internal/listener/listener.go
Agent Manager internal/agent/manager.go
Task Dispatcher internal/task/dispatcher.go
Operational Store internal/db/database.go
Wire Protocol internal/protocol/envelope.go
Comms Crypto internal/crypto/exchange.go

Agent Runtime

Implant Runtime internal/implant/implant.go
Agent Entrypoints cmd/agent/main.go

Payload Delivery

Payload Generator internal/payloads/generator.go
Payload Loader internal/payloads/loader/loader.go
Mobile Builder internal/payloads/appbuilder.go
Payload Crypter internal/payloads/crypter/crypter.go

Integrations

External Channels internal/exchannel/channel.go
Slack Channel internal/exchannel/slack.go

Other components

Operator
Deployed Agent

Connections 24

Operator → Server Entry: starts server cmd/server/main.go
Server Entry → Server Core: initializes cmd/server/main.go
Server Entry → CLI Shell: starts shell cmd/server/main.go
Server Entry → Web UI: starts UI cmd/server/main.go
Server Entry → Operator Auth: authenticates cmd/server/main.go
CLI Shell → Server Core: operates internal/cli/shell.go
Server Core → Operational Store: opens and updates internal/server/server.go
Server Core → Comms Crypto: loads keys internal/server/server.go
Server Core → C2 Listeners: configures internal/server/server.go
Server Core → Task Dispatcher: initializes internal/server/server.go
Server Core → External Channels: registers internal/server/server.go
C2 Listeners → Agent Manager: registers agents internal/listener/listener.go
C2 Listeners → Wire Protocol: opens envelopes internal/listener/listener.go
Agent Manager → Operational Store: stores agent records internal/agent/manager.go
Task Dispatcher → Operational Store: stores tasks and results internal/task/dispatcher.go
Deployed Agent → C2 Listeners: checks in README.md
Agent Entrypoints → Implant Runtime: runs cmd/agent/main.go
Agent Entrypoints → Comms Crypto: loads public key cmd/agent/main.go
Implant Runtime → C2 Listeners: communicates
CLI Shell → Payload Generator: generates payloads internal/cli/shell.go
Payload Loader → Payload Crypter: uses internal/payloads/loader/loader.go
Web UI → Payload Generator: offers generation
Web UI → Mobile Builder: offers mobile builds
External Channels → Slack Channel: implements channel

Drawn by GitDiagram on November 10, 2026 from the repository's file tree, README and source files. Read as Markdown ·