# phantom-offensive/phantom architecture

> Architecture diagram of the GitHub repository phantom-offensive/phantom, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-10). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/phantom-offensive/phantom
- Repository: https://github.com/phantom-offensive/phantom

## Overview

Phantom C2 is a red-team command-and-control framework with CLI and Web UI operator interfaces. Its principal workflow is operator authentication and server startup, agent check-in through a listener, task dispatch and result collection, then operator review. Separate capability branches cover listener management and payload generation; the README also documents mobile endpoints, post-exploitation, evasion, and external channels. The graph follows sampled calls and indexed references; links to unsampled subsystems are omitted where their wiring is not shown.

Main entry points: [`internal/server/server.go`](https://github.com/phantom-offensive/phantom/blob/main/internal/server/server.go) (Server Core), [`cmd/server/main.go`](https://github.com/phantom-offensive/phantom/blob/main/cmd/server/main.go) (Server Entry), [`internal/listener/listener.go`](https://github.com/phantom-offensive/phantom/blob/main/internal/listener/listener.go) (C2 Listeners), [`internal/cli/shell.go`](https://github.com/phantom-offensive/phantom/blob/main/internal/cli/shell.go) (CLI Shell)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_control["Operator Control"]
  node_server_entry["Server Entry<br/>[main.go]"]
  node_cli["CLI Shell<br/>[shell.go]"]
  node_webui["Web UI<br/>[webui.go]"]
  node_auth["Operator Auth<br/>[auth.go]"]
end

subgraph group_server["C2 Server"]
  node_core_server["Server Core<br/>[server.go]"]
  node_listeners["C2 Listeners<br/>[listener.go]"]
  node_agent_manager["Agent Manager<br/>[manager.go]"]
  node_task_dispatch["Task Dispatcher<br/>[dispatcher.go]"]
  node_database[("Operational Store<br/>[database.go]")]
  node_protocol["Wire Protocol<br/>[envelope.go]"]
  node_crypto["Comms Crypto<br/>[exchange.go]"]
end

subgraph group_agent["Agent Runtime"]
  node_agent_runtime["Implant Runtime<br/>[implant.go]"]
  node_agent_entry["Agent Entrypoints<br/>[main.go]"]
end

subgraph group_payload["Payload Delivery"]
  node_payload_generator["Payload Generator<br/>[generator.go]"]
  node_payload_loader["Payload Loader<br/>[loader.go]"]
  node_mobile_builder["Mobile Builder<br/>[appbuilder.go]"]
  node_crypter["Payload Crypter<br/>[crypter.go]"]
end

subgraph group_integrations["Integrations"]
  node_external_channel["External Channels<br/>[channel.go]"]
  node_slack_channel["Slack Channel<br/>[slack.go]"]
end

node_operator(("Operator"))
node_agent_actor(("Deployed Agent"))

node_operator -->|"starts server"| node_server_entry
node_server_entry -->|"initializes"| node_core_server
node_server_entry -->|"starts shell"| node_cli
node_server_entry -->|"starts UI"| node_webui
node_server_entry -->|"authenticates"| node_auth
node_cli -->|"operates"| node_core_server
node_core_server -->|"opens and updates"| node_database
node_core_server -->|"loads keys"| node_crypto
node_core_server -->|"configures"| node_listeners
node_core_server -->|"initializes"| node_task_dispatch
node_core_server -->|"registers"| node_external_channel
node_listeners -->|"registers agents"| node_agent_manager
node_listeners -->|"opens envelopes"| node_protocol
node_agent_manager -->|"stores agent records"| node_database
node_task_dispatch -->|"stores tasks and results"| node_database
node_agent_actor -->|"checks in"| node_listeners
node_agent_entry -->|"runs"| node_agent_runtime
node_agent_entry -->|"loads public key"| node_crypto
node_agent_runtime -.->|"communicates"| node_listeners
node_cli -->|"generates payloads"| node_payload_generator
node_payload_loader -->|"uses"| node_crypter
node_webui -.->|"offers generation"| node_payload_generator
node_webui -.->|"offers mobile builds"| node_mobile_builder
node_external_channel -.->|"implements channel"| node_slack_channel

click node_server_entry "https://github.com/phantom-offensive/phantom/blob/main/cmd/server/main.go"
click node_cli "https://github.com/phantom-offensive/phantom/blob/main/internal/cli/shell.go"
click node_webui "https://github.com/phantom-offensive/phantom/blob/main/internal/webui/webui.go"
click node_auth "https://github.com/phantom-offensive/phantom/blob/main/internal/server/auth.go"
click node_core_server "https://github.com/phantom-offensive/phantom/blob/main/internal/server/server.go"
click node_listeners "https://github.com/phantom-offensive/phantom/blob/main/internal/listener/listener.go"
click node_agent_manager "https://github.com/phantom-offensive/phantom/blob/main/internal/agent/manager.go"
click node_task_dispatch "https://github.com/phantom-offensive/phantom/blob/main/internal/task/dispatcher.go"
click node_database "https://github.com/phantom-offensive/phantom/blob/main/internal/db/database.go"
click node_protocol "https://github.com/phantom-offensive/phantom/blob/main/internal/protocol/envelope.go"
click node_crypto "https://github.com/phantom-offensive/phantom/blob/main/internal/crypto/exchange.go"
click node_agent_runtime "https://github.com/phantom-offensive/phantom/blob/main/internal/implant/implant.go"
click node_agent_entry "https://github.com/phantom-offensive/phantom/blob/main/cmd/agent/main.go"
click node_payload_generator "https://github.com/phantom-offensive/phantom/blob/main/internal/payloads/generator.go"
click node_payload_loader "https://github.com/phantom-offensive/phantom/blob/main/internal/payloads/loader/loader.go"
click node_mobile_builder "https://github.com/phantom-offensive/phantom/blob/main/internal/payloads/appbuilder.go"
click node_crypter "https://github.com/phantom-offensive/phantom/blob/main/internal/payloads/crypter/crypter.go"
click node_external_channel "https://github.com/phantom-offensive/phantom/blob/main/internal/exchannel/channel.go"
click node_slack_channel "https://github.com/phantom-offensive/phantom/blob/main/internal/exchannel/slack.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_server_entry,node_cli,node_webui,node_auth toneBlue
class node_core_server,node_listeners,node_agent_manager,node_task_dispatch,node_database,node_protocol,node_crypto toneAmber
class node_agent_runtime,node_agent_entry toneMint
class node_payload_generator,node_payload_loader,node_mobile_builder,node_crypter toneRose
class node_external_channel,node_slack_channel,node_operator,node_agent_actor toneIndigo
```

## Components

### Operator Control

- [Server Entry](https://github.com/phantom-offensive/phantom/blob/main/cmd/server/main.go): `cmd/server/main.go`
- [CLI Shell](https://github.com/phantom-offensive/phantom/blob/main/internal/cli/shell.go): `internal/cli/shell.go`
- [Web UI](https://github.com/phantom-offensive/phantom/blob/main/internal/webui/webui.go): `internal/webui/webui.go`
- [Operator Auth](https://github.com/phantom-offensive/phantom/blob/main/internal/server/auth.go): `internal/server/auth.go`

### C2 Server

- [Server Core](https://github.com/phantom-offensive/phantom/blob/main/internal/server/server.go): `internal/server/server.go`
- [C2 Listeners](https://github.com/phantom-offensive/phantom/blob/main/internal/listener/listener.go): `internal/listener/listener.go`
- [Agent Manager](https://github.com/phantom-offensive/phantom/blob/main/internal/agent/manager.go): `internal/agent/manager.go`
- [Task Dispatcher](https://github.com/phantom-offensive/phantom/blob/main/internal/task/dispatcher.go): `internal/task/dispatcher.go`
- [Operational Store](https://github.com/phantom-offensive/phantom/blob/main/internal/db/database.go): `internal/db/database.go`
- [Wire Protocol](https://github.com/phantom-offensive/phantom/blob/main/internal/protocol/envelope.go): `internal/protocol/envelope.go`
- [Comms Crypto](https://github.com/phantom-offensive/phantom/blob/main/internal/crypto/exchange.go): `internal/crypto/exchange.go`

### Agent Runtime

- [Implant Runtime](https://github.com/phantom-offensive/phantom/blob/main/internal/implant/implant.go): `internal/implant/implant.go`
- [Agent Entrypoints](https://github.com/phantom-offensive/phantom/blob/main/cmd/agent/main.go): `cmd/agent/main.go`

### Payload Delivery

- [Payload Generator](https://github.com/phantom-offensive/phantom/blob/main/internal/payloads/generator.go): `internal/payloads/generator.go`
- [Payload Loader](https://github.com/phantom-offensive/phantom/blob/main/internal/payloads/loader/loader.go): `internal/payloads/loader/loader.go`
- [Mobile Builder](https://github.com/phantom-offensive/phantom/blob/main/internal/payloads/appbuilder.go): `internal/payloads/appbuilder.go`
- [Payload Crypter](https://github.com/phantom-offensive/phantom/blob/main/internal/payloads/crypter/crypter.go): `internal/payloads/crypter/crypter.go`

### Integrations

- [External Channels](https://github.com/phantom-offensive/phantom/blob/main/internal/exchannel/channel.go): `internal/exchannel/channel.go`
- [Slack Channel](https://github.com/phantom-offensive/phantom/blob/main/internal/exchannel/slack.go): `internal/exchannel/slack.go`

### Other components

- **Operator**
- **Deployed Agent**

## Connections

- Operator → Server Entry: starts server (evidence: `cmd/server/main.go`)
- Server Entry → Server Core: initializes (evidence: `cmd/server/main.go`)
- Server Entry → CLI Shell: starts shell (evidence: `cmd/server/main.go`)
- Server Entry → Web UI: starts UI (evidence: `cmd/server/main.go`)
- Server Entry → Operator Auth: authenticates (evidence: `cmd/server/main.go`)
- CLI Shell → Server Core: operates (evidence: `internal/cli/shell.go`)
- Server Core → Operational Store: opens and updates (evidence: `internal/server/server.go`)
- Server Core → Comms Crypto: loads keys (evidence: `internal/server/server.go`)
- Server Core → C2 Listeners: configures (evidence: `internal/server/server.go`)
- Server Core → Task Dispatcher: initializes (evidence: `internal/server/server.go`)
- Server Core → External Channels: registers (evidence: `internal/server/server.go`)
- C2 Listeners → Agent Manager: registers agents (evidence: `internal/listener/listener.go`)
- C2 Listeners → Wire Protocol: opens envelopes (evidence: `internal/listener/listener.go`)
- Agent Manager → Operational Store: stores agent records (evidence: `internal/agent/manager.go`)
- Task Dispatcher → Operational Store: stores tasks and results (evidence: `internal/task/dispatcher.go`)
- Deployed Agent → C2 Listeners: checks in (evidence: `README.md`)
- Agent Entrypoints → Implant Runtime: runs (evidence: `cmd/agent/main.go`)
- Agent Entrypoints → Comms Crypto: loads public key (evidence: `cmd/agent/main.go`)
- Implant Runtime → C2 Listeners: communicates
- CLI Shell → Payload Generator: generates payloads (evidence: `internal/cli/shell.go`)
- Payload Loader → Payload Crypter: uses (evidence: `internal/payloads/loader/loader.go`)
- Web UI → Payload Generator: offers generation
- Web UI → Mobile Builder: offers mobile builds
- External Channels → Slack Channel: implements channel