oddcod3/Phantom-EvasionArchived
Phantom Evasion
Phantom-Evasion es un framework de investigación de seguridad diseñado para generar payloads ofuscados y automatizar tareas de post-explotación durante evaluaciones de seguridad autorizadas. Proporciona un conjunto de utilidades para crear ejecutables y bibliotecas personalizados destinados a probar la eficacia de los sistemas de detección de antivirus y seguridad de endpoints.
El framework destaca por su enfoque en operaciones residentes en memoria, permitiendo la ejecución de binarios cifrados y shellcode directamente dentro de la memoria del sistema. Al utilizar técnicas como la inyección de código basura, el cifrado de payloads y la obtención remota de recursos, minimiza la huella forense en una máquina objetivo y evita la dependencia del almacenamiento en disco.
Más allá de la generación de payloads, la herramienta incluye capacidades para mantener el acceso al sistema a largo plazo mediante la configuración de claves de registro, tareas programadas y servicios en segundo plano. También admite operaciones sigilosas inyectando shellcode en procesos legítimos del sistema y automatizando tareas administrativas, como la gestión de controladores de registro de seguridad y la memoria de procesos, para facilitar escenarios de pruebas de penetración controladas.
Features
- Memory-Only Execution - Provides a framework for fetching and loading encrypted binaries directly into system memory to avoid writing files to the local disk.
- In-Memory Payload Execution - Loads encrypted binaries directly into process memory to bypass disk-based security scanning and forensic file analysis.
- Red Team Workflow Automations - Automates administrative tasks and maintains stealthy access on a compromised system during authorized security assessments.
- Obfuscation Junk Code Injection - Inserts non-functional instructions into the executable structure to alter file signatures and evade static pattern-based detection.
- Registry Persistence - Establishes system persistence by generating payloads that maintain access to a target machine through registry keys, scheduled tasks, or background services.
- Security Persistence Managers - Establishes long-term access to a target machine by configuring background services and registry modifications for authorized security testing scenarios.
- Encrypted Shellcode Injection - Performs process shellcode injection by executing custom shellcode within local or remote processes using memory allocation and execution techniques.
- Shellcode Injection Wrappers - Injects and executes custom shellcode within local or remote processes to maintain stealth during security operations.
- Process Space Injection - Executes custom shellcode within the memory space of legitimate system processes to maintain stealth and evade detection.
- Payload Obfuscators - Applies encryption and polymorphic transformations to executable code at generation time to prevent signature-based antivirus identification.
- Post-Exploitation Toolkits - Automates post-exploitation tasks, including dumping process memory, hiding files, and disabling security logging drivers.
- Memory-Resident Remote Execution - Enables remote execution by fetching and loading encrypted executables or libraries directly into memory from a remote source.
- Post-Exploitation Tools - Executes administrative tasks and maintains system persistence on compromised machines through memory-resident operations.
- Security Payload Generators - Creates custom executable files and libraries with obfuscation techniques to test the effectiveness of antivirus and endpoint security detection systems.
- Persistence Orchestrators - Modifies operating system configuration hooks like registry keys and scheduled tasks to ensure automatic re-execution after system reboots.
