oddcod3/Phantom-EvasionArchived
Phantom Evasion
Phantom-Evasion is a security research framework designed for generating obfuscated payloads and automating post-exploitation tasks during authorized security assessments. It provides a suite of utilities for creating custom executables and libraries intended to test the effectiveness of antivirus and endpoint security detection systems.
The framework distinguishes itself through a focus on memory-resident operations, allowing for the execution of encrypted binaries and shellcode directly within system memory. By utilizing techniques such as junk code injection, payload encryption, and remote resource fetching, it minimizes the forensic footprint on a target machine and avoids reliance on disk-based storage.
Beyond payload generation, the tool includes capabilities for maintaining long-term system access through the configuration of registry keys, scheduled tasks, and background services. It also supports stealthy operations by injecting shellcode into legitimate system processes and automating administrative tasks, such as managing security logging drivers and process memory, to facilitate controlled penetration testing scenarios.
Features
- Memory-Only Execution - Provides a framework for fetching and loading encrypted binaries directly into system memory to avoid writing files to the local disk.
- In-Memory Payload Execution - Loads encrypted binaries directly into process memory to bypass disk-based security scanning and forensic file analysis.
- Red Team Workflow Automations - Automates administrative tasks and maintains stealthy access on a compromised system during authorized security assessments.
- Obfuscation Junk Code Injection - Inserts non-functional instructions into the executable structure to alter file signatures and evade static pattern-based detection.
- Registry Persistence - Establishes system persistence by generating payloads that maintain access to a target machine through registry keys, scheduled tasks, or background services.
- Security Persistence Managers - Establishes long-term access to a target machine by configuring background services and registry modifications for authorized security testing scenarios.
- Encrypted Shellcode Injection - Performs process shellcode injection by executing custom shellcode within local or remote processes using memory allocation and execution techniques.
- Shellcode Injection Wrappers - Injects and executes custom shellcode within local or remote processes to maintain stealth during security operations.
- Process Space Injection - Executes custom shellcode within the memory space of legitimate system processes to maintain stealth and evade detection.
- Payload Obfuscators - Applies encryption and polymorphic transformations to executable code at generation time to prevent signature-based antivirus identification.
- Post-Exploitation Toolkits - Automates post-exploitation tasks, including dumping process memory, hiding files, and disabling security logging drivers.
- Memory-Resident Remote Execution - Enables remote execution by fetching and loading encrypted executables or libraries directly into memory from a remote source.
- Post-Exploitation Tools - Executes administrative tasks and maintains system persistence on compromised machines through memory-resident operations.
- Security Payload Generators - Creates custom executable files and libraries with obfuscation techniques to test the effectiveness of antivirus and endpoint security detection systems.
- Persistence Orchestrators - Modifies operating system configuration hooks like registry keys and scheduled tasks to ensure automatic re-execution after system reboots.
