Phantom-Evasion - Python antivirus evasion tool

项目说明

PHANTOM E 3.0

Phantom-E is an antivirus e 工具 written in python (both compatible with python and python3) capable to generate (almost) fully undetectable executable even with the most common x86 msfvenom payload.

The following OSs officialy support automatic setup:

1. Kali Linux
2. Parrot Security

The following OSs likely support automatic setup but require manual installation of metasploit-框架:

1. OSX (tested on Catalina)
2. Ubuntu
3. Linux Mint
4. Elementary
5. Deepin
6. other Debian distro
7. Centos
8. Fedora
9. Blackarch

The following OSs require manual setup:

1. Windows 10

Simply git clone or download and unzip Phantom-E folder

Setup:

Automatic setup, open a terminal and execute:

or:

or start phantom-e in interactive mode and select option 7

Dependencies (only for manual setup)

1. metasploit-framework
2. mingw-w64 (cygwin on windows)
3. gcc-multilib
4. apktool
5. apksigner
6. strip
7. osslsigncode

CMDLINE/INTERACTIVE:

1. Launch phantom-e in interactive mode:

or:

2. Otherwise to see cmdline mode options:

or:

WINDOWS Modules

-Every windows payload C module and can be compiled (support both x86 and x64) as EXE or DLL/ReflectiveDLL.

-Randomized junkcode injection (intensity,frequency and reinjection probability can be set) and windows antivirus e techniques (frequency can be set).

-Multibyte Xor/ shellcode/file encryption supported in both Shellcode injection and Donwload Exec modules.

-Ntdll unhookapi and Peb process masquerading technique supported.

-Wide range of execution mode supported (both local and remote).

-Wide range of payload memory allocation mode(,/RX,/RWX,Heap_RWX).

-Dynamic loading of Windows api can be set.

-Certificate spoofer and signer supported.

-Strip executable ())

Windows C Shellcode Injection

Msfvenom windows payloads and custom shellcode supported.
Shellcode can be stored as resource and retrieved at runtime with FindResource API.

Shellcode Encryption supported:

1.none

2.Multibyte-Xor

3.Double-key Multibyte-Xor

4.

5.Double-key

1. Local exec method can be one of the following:

Thread

APC

Local Memory allocation mode can be one of the following:

/RX

/RWX

Heap_RWX

2. Remote exec method can be one of the following:

ThreadExecutionHijack (shorten is TEH)

Processinject (shorten is PI)

APCSpray (shorten is APCS)

EarlyBird (shorten is EB)

EntryPointHijack (shorten is EPH)

Remote Memory allocation mode can be one of the following:

/RX

/RWX

Windows Pure C meterpreter stager (C)

Pure C meterpreter stager (TCP/HTTP/HTTPS) modules compatible with msfconsole and cobalt strike beacon. (re/re/re)

Using cmdline mode:

re c stager is WRT

re c stager is WRH

re c stager is WRS

1. Local exec method can be one of the following:

Thread

APC

Local Memory allocation mode can be one of the following:

/RX

/RWX

Heap_RWX

Windows C Download-Exec NoDiskWrite

Download exe/dll from supplied url in memory and execute/load into remote process (without writing on disk).

EXE/DLL Encrypted Download supported:

1.none

2.Multibyte-Xor

3.Double-key Multibyte-Xor

4.

5.Double-key

The Encrypted DLL/EXE will be saved as originalfilename + "crypt" + ".dll" or ".exe" this is the one to be downloaded

1. Windows DownloadExecExe NoDiskWrite (WDE using cmdline mode):

Remote exec method can be one of the following:

ProcessHollowing (shorten is PH)

2. Windows DownloadExecDll NoDiskWrite (WDD using cmdline mode):

Remote loading method can be one of the following:

ReflectiveDll (shorten is RD)

RDAPC (Reflecti)

ManualMap (shorten is MM) ---> only x86

LINUX PAYLOADS

Linux Shellcode Injection Module (C)

Msfvenom linux payloads and custom shellcodes supported.

ANDROID PAYLOADS

1. Android Msfvenom Obfuscate Backdoor:

Obfuscate msfvenom payloads an rebuild (smali/baksmali) with apktool.
Obfuscated payload can be used to backdoor benign apk files.

PERSISTENCE Modules

1. Windows Persistence RegCreateKeyExW Add Registry Key (C)
Compiled executable need to be uploaded to the target machine and excuted specifing the fullpath to file to add to startup as argument.

2. Windows Persistence REG Add Registry Key (CMD)
This module generate persistence cmdline payloads (Add Registry Key via REG.exe).

3. Windows Persistence Keep Process Alive (C)
Compiled executable need to be uploaded to the target machine and executed.
Use CreateToolSnapshoot ProcessFirst and ProcessNext to check if specified process is ali X seconds (if not create a new process using WinExec API)

4. Windows Persistence Schtasks (CMD)

This module generate persistence cmdline payloads (using Schtasks.exe).

5. Windows Persistence Create Service (CMD)

This module generate persistence cmdline payloads (using sc.exe).

PRI ESCALATION Modules

1. Windows DuplicateTokenEx (C)

Create a new process with a token cloned from another process.
Compiled executable need to be uploaded to the target machine and executed.

POSTEXPLOITATION Modules

1. Windows Unload Sysmon (C)
Unload sysmon dri causes the system to stop recording sysmon event logs.
Compiled executable need to be uploaded to the target machine and executed.

2. Windows Unload Sysmon (CMD)
Unload sysmon dri causes the system to stop recording sysmon event logs.

3. Windows Attrib hide file (CMD)
Use attrib to hide file

4. Windows SetFileAttribute hidden (C)
Hide file using SetFileAttribute API
Compiled executable need to be uploaded to the target machine and executed.

5. Windows DumpLsass (C)
Dump Lsass using MiniWriteDumpWrite API.
Compiled executable need to be uploaded to the target machine and executed.

6. Windows DumpLsass (CMD)

Dump Lsass from cmdline.

Phantom-E Cmdline mode examples:

1. windows shellcode injection,output signed exe with spoofed https certificate,local execution method: Thread, mem: , encryption:

2. windows x64 shellcode injection ,output as reflective dll ,remote execution method: ProcessInject (PI), mem: /RX , target process: SkypeApp.exe ,encryption: double key xor

3. windows x64 shellcode injection ,output as stripped dll, shellcode stored as resource, remote execution method: EarlyBird (EB) , mem: /RX , target process: s.exe ,encryption: xor

4. windows x64 reverse https stager ,output as stripped dll,local execution method: Thread , mem: Heap_RWX

5. windows x86 downloadexec dll ,output as stripped exe ,remote execution method: ManualMap (MM), target process: OneDrive.exe ,downloadsize 1000000 bytes

6. windows x64 downloadexec exe ,output as stripped reflective dll,remote execution method: ProcessHollowing (PH), target process: s.exe ,downloadsize 1000000 bytes

License

GPLv3.0

Credits and usefull resources

项目信息

开发语言：Python

Star 数：1447

技术要点

该项目属于黑客技术方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Python antivirus e tool 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。