Everything in the edition.

The primary implant. Core work — shell, interactive terminal, files, tunnel, peer routing, BOF runtime — ships as modules the agent fetches when tasked, so a quiet agent carries almost nothing. Static embedded builds invert this: there is no loader, so the same modules are compiled in.

On Windows it uses the system HTTP stack or an embedded TLS library and honors the host proxy. On Linux and macOS it uses the embedded library. Every customer build is structurally unique; that is a property of the toolchain, not a setting.

The alternate Windows implant with a wider command set resident in the binary. Same server, campaigns, and console. Choose it when breadth matters more than footprint; choose the C agent when you want on-demand modules, or elevation, which is offered for the C agent only. Both can run in one fleet.

Modularity is the architecture, not a feature line. The depot holds shells and the interactive PTY, the file manager, tunnels and peer routing, the SMB browser, the BOF runtime, the collection set — credentials, LDAP, directory discovery, shares, scanner — and elevation. Windows draws DLLs, Linux draws shared objects routed by build-target profile, macOS draws libraries; static embedded builds compile the set in. The server gates what an agent may fetch by agent type and platform.

Every fetch is deliberate: a one-time download token, a per-module key derived from the session, results streamed back in chunks, key material wiped on unload. A quiet agent therefore carries almost nothing — capability arrives when tasked and leaves when done. The fetch lifecycle, from the operator's side, is the subject of research note N.04.

The complete depot: credentials, LDAP, directory discovery, local material, shares, and elevation on top of the core set. Delivery is widest here — twelve stager formats plus MSI. Persistence spans the standard locations and two AXIS-specific installs. Security products visible to the agent are reported and shown on the host row and dashboard.

For current Ubuntu, Debian, and RHEL-family hosts. Modules load as shared objects. Persistence is Ghost-Systemd: the server builds a launcher per machine, the agent registers a unit, and at boot the agent is reconstituted rather than left on disk as a plain executable.

For filers and appliances whose userland predates the server profile. Still loads shared modules, so an old C library does not force a fully static implant. Where systemd is absent, persistence falls back to Ghost-Cron; the panel treats both as one feature with two triggers.

Fully static builds for QNAP, Synology, OpenWrt, and similar. ARMv5 targets run kernels old enough that newer syscalls are absent; the build does not assume them. Modules are compiled in by partial-linking with symbols localized, so the static binary presents no module inventory to a strings sweep. The installer is aware of ramdisk layouts that erase a naive install on reboot.

C-agent build for Apple silicon and Intel; core modules as libraries or compiled in. A Mach-O stager and a shell bootstrap handle delivery, both behind one-time tokens. Persistence is Ghost-Launchd — daemon when privileged, agent when not — or Ghost-Cron. This agent is unrelated to the operator's desktop client.

New fields are appended where older agents ignore them, in both directions. You can upgrade the teamserver without rebuilding the fleet, and an agent from a newer build still checks in against an older server. Agents that predate a feature are shown as not having it, never as broken.

Each agent agrees a session with an X25519 exchange; check-ins and results are AES-256-GCM. Module bodies use a second key derived from the same handshake. Session identity rotates on a fixed cadence — every fifty check-ins, with a grace window for in-flight replies — so correlation by identifier dies on schedule. Tunnels and the Ghost Chain record use ChaCha20-Poly1305. Operator passwords are bcrypt (cost 12); operator sessions are HMAC-SHA256 tokens with optional TOTP. Sensitive database columns are encrypted at rest.

The server key rotates from the console by an operator holding the keys grant. Previous keys can be kept deprecated long enough for agents that have not checked in, or revoked outright. Agents presenting a deprecated key are flagged, not silently dropped.

A profile makes agent traffic resemble a service the network already carries. The estate you are assessing almost certainly permits one of these. Path maps and header sets are licensed material. What each wire layer buys — and what it cannot buy — is the subject of research note N.14.

SHIPPED  default · ms-graph · ms-update · github-api · google-cloud · oracle-cloud · salesforce-api · atlassian-api · slack-webhook · wordpress-rest · cdn-api · saas-api · bloomberg-beap · hpe-greenlake · storj-dcs · docker-registry · aws-s3 · k8s-api · dropbox-api · fcm-push · doh-dns · prometheus-remote · npm-registry

The teamserver can sit behind a Cloudflare Worker so agent configurations never contain the server's address. Worker configuration lives in the server dialog. Polling passes any front; the interactive terminal and tunnels require a front that permits long-lived connections, and the console says so where the front is configured.

When an agent has been unable to reach its servers for more than 24 hours, it reads a replacement address list from a signed record on Polygon. You publish the record from a wallet you control; the teamserver never holds wallet keys, and contract deployment is guided from the panel.

Choose per build whether the record is baked in or pushed later to selected agents. The console shows each agent's state — none, baked, pushed-and-acknowledged — and pushes are per-agent with explicit acknowledgment, so you know exactly which hosts received a new way home.

A module download does not travel under the module's real name. Capable agents accept a random per-download cover name, so the request resembles an ordinary asset fetch. Legacy agents keep the earlier form; the append-only protocol lets both coexist on one server.

New agents can wait pending until an operator approves or rejects them. Hosts get aliases and campaigns; the dashboard and table filter on both. The server keeps fleet-count history for the timeline, rate-limits noisy clients, and can purge records past a quiet threshold you set — cleanup is its own permission, with a count before you confirm.

Two executable stagers (a full ≈ 47 KB build and a minimal ≈ 21 KB build), an in-memory variant of the minimal stager, raw shellcode for a loader you already run, a DLL for sideloading, and script or project wrappers for PowerShell, HTA, MSBuild, and JScript — the PowerShell and HTA wrappers with fully in-memory forms.

TARGETS  exe-full · exe-minimal · exe-minimal-mem · shellcode · dll · ps1 · hta · ps1-mem · hta-mem · msbuild · jscript · v4 (legacy, hidden from the builder form)

Linux stagers follow the agent profiles — dynamic, compat, static — across their architectures. macOS has a Mach-O stager and a shell bootstrap for one-time fetch. Pools apply: the server can hold several variants per architecture and serve a different one to each delivery.

An MSI delivery path in which the package you hand over is not itself the agent; the agent is assembled as the package runs. A conventional custom-action MSI path exists alongside it. Both build from the MSI tab, which is a separate permission. What Ghost Stream splits and how those pieces meet is the proprietary core of the feature and is not published.

Payload pools serve a different variant to each delivery on Windows, Linux, and macOS. Pools come in two lines — normal and persist-only — with a random pool pick and a random overlay appended per delivery, and every served Windows PE is re-mutated per download: a backdated build timestamp, a fabricated compiler-provenance header, a recomputed checksum, fresh padding — so two fetches of the same payload share no hash either. Polymorphic builds make every customer build structurally unique before any pool is involved. Windows artifacts — exe, dll, msi — can be Authenticode-signed in the pipeline; script formats cannot be, and the builder says so. The toolchain also ships the supporting utilities: payload validation and encryption helpers, and the wrapper generators behind the script formats.

Mint, inspect, and revoke tokens; see whether a token has been used; upload or fetch the payload stagers will receive. Token management and build rights are separate grants. The builder groups targets by platform, streams a live log, keeps artifacts and history, and lets you cancel. Ghost Chain and macOS persistence choices sit in the connection section of the forms, where they belong.

Queued tasking with results on the next check-in: cmd, PowerShell, or Phantom on Windows; sh or bash elsewhere. Phantom is the in-process shell for hosts where starting the usual interpreters is the wrong shape. Tasks carry a working directory and the active token; history is searchable and exportable; a pending queue shows what is already waiting.

A real terminal — resize, themes, autocomplete, fullscreen, session timer — over a long-lived connection. Sessions start in one of eight modes, so the terminal's shape can match what the host tolerates. Windows sessions can set a chosen parent process, block third-party library injection into children, and apply the script-scanning and event-tracing controls described in chapter 09. The web panel holds one interactive session at a time so two operators cannot fight over the same tty unnoticed.

Assemblies run inside the agent: through a hosted runtime on the interactive path, or through a BOF from the AXIS collection for ordinary tasking. The managed interpreter is never started as its own program.

Standard x64 COFF objects run in the agent's process with Beacon API parity, so libraries your team already trusts load without rewrite. An unhandled fault inside an object is trapped and returned as an error; the session survives. Memory is prepared per run and scrubbed on release. The server keeps a repository — single objects, companion scripts, or zip archives — tasked per agent.

LIBRARY  65 situation-awareness objects (network · users & groups · system info · AD/CS queries · registry · services · scheduled tasks · files & modules · security policy · hashes · sessions · DPAPI system · WMI · utilities) + axis-clr-exec (in-process .NET) + axis-exec-pe (in-process unmanaged PE)

Duplicate a token the agent can reach, or create a network-only logon from credentials, then apply that context once. Shell, interactive terminal, LDAP, the credential module, and local tasks all see the same context and update together when it changes. The active context is always visible in the workspace.

Browse, upload, download, create, delete, copy, move, search, compress, extract. On Windows, alternate data streams are visible and transferable. Transfers are chunked without scratch files in temp directories; results too large for one check-in return in pieces and reassemble server-side. SMB sessions to remote shares open from the same view, under the active token.

A SOCKS proxy and a reverse tunnel ride the existing channel, toggled per agent. A fleet view lists every open tunnel with its local port, and the console shows the local invocations — proxychains, curl, a browser — that point your tools at it. Tunnels are a dedicated permission, separate from shell access. A standalone reverse-SOCKS package ships in the licensed build as well — a BOF-packaged worker with its own multi-agent listener, bolting onto an operation without touching the server or agent core.

Windows agents pass traffic to each other over named pipes, so a host with no route to the teamserver can still be tasked through a peer that has one. Topology is operator-directed; agents do not form a mesh on their own.

Port and service discovery from the pivot you already hold: ranges and ports, optional reachability check first, banner grabbing, light web identification. Concurrency is bounded so the sweep can be slowed to what the segment tolerates. Results return as sortable data, not a text blob.

Connect with explicit credentials or the current logon, over LDAP or TLS. Browse, attribute lookup, search, export. Searches page past Active Directory's 1000-entry cap and the panel shows real totals. Distinguished names in results are links, and export works on a selection, not only the full result set.

A structured pass over the questions an AD assessment actually asks, as the current user, as explicit credentials, or under the active token: service-principal names, pre-authentication-disabled accounts, password policy, logon scripts, certificate services, principals holding replication rights, LAPS, shadow credentials, DPAPI backup exposure, and delegation in its unconstrained, constrained, and resource-based forms.

Ticket requests return hashcat-ready; certificate-services findings are checked against the ESC1–11 and ESC13–14 condition set; and replication itself — DCSync, where your rights carry it — runs through a managed library hosted in-process rather than a signatured binary, the subject of research note N.10. Delegation and certificate-services results export as BloodHound-compatible JSON. Paged queries are used wherever the directory would otherwise truncate.

Collects material the current context can already unwrap, in memory, without a live inspection of the security process. User scope covers Chromium-family browsers and Firefox; the Windows credential vault; certificates; Remote Desktop, PuTTY, WinSCP, MobaXterm, mRemoteNG, FileZilla; mail and common chat clients; git, SSH, AWS, Azure, Docker, VS Code, Postman; Wi-Fi profiles; and desktop vaults including KeePass databases present as files.

A machine-context pass covers Wi-Fi, SCCM, the machine vault, and machine certificates. You select the types per task. The C implementation is current; the older Go build remains for compatibility. Chromium's App-Bound Encryption — the browser vault scheme Chrome introduced in mid-2024 — is handled in its AES-GCM and CNG-wrapped variants.

Reads the local account database, and the directory database on a domain controller, plus local users, groups, sessions, and privileges. The account database can be read via registry, shadow copy, backup, or memory; the directory database via volume shadow or backup. The right choice depends on the host and the rules of the test — that judgment is the manual's, not this page's.

Discovers hosts from the directory, an address range, or link-local neighbors, then enumerates shares including hidden and DFS. Readable locations are flagged when filenames look like password databases, connection profiles, or backups. Once a share matters, open it in the file manager under the same token.

Two moves: a preflight that reports whether elevation is plausible from this process, and elevate. Token theft and duplication are part of the capability and visible as such. Further methods ship inside the licensed build and are selected in the same view, with an automatic choice and explicit choices.

Those methods are not named on this site. They are a competitive part of the product, and naming them would also be a recipe. Evaluations run under the license see the full list.

Run and RunOnce keys, Startup folder, scheduled task, Windows service, WMI subscription, COM hijack, DLL sideload, BITS job. Separate choices because a host will tolerate some and watch others. The sideload set draws on two dozen vetted targets — several absent from the public LOLBAS lists — with automatic fallback when a target ages out. Implemented with tracked install and removal, not as scripts someone has to remember. What each location buys and costs under modern telemetry is the subject of research note N.13.

Registers through more than one standard mechanism at once, so a single cleanup pass does not have to end the agent. Status reports it as one install; remove clears it as one install. The combination is proprietary.

A service-hosted install whose files are produced for that one machine — the right shape when the host expects a service and you do not want that service byte-identical to the last engagement's. The launcher is exactly that: the service starts, spawns the detached agent, and stops — C2 traffic never comes from a service-host process, and the running service nobody can find is the one that already exited. In the NLD variant, the loader core exists only as shellcode in the registry, so the on-disk stub carries no loader signature. The updater knows how to find what the install wrote, because persistence and update are not independent systems.

An installer path that stages through file-system metadata streams and performs the install from inside a process the operating system itself started — so the install event never carries the stager's name, and storyline attribution breaks one event earlier. Tracked like every other install: status reports it, removal clears it.

Ghost-Systemd builds a launcher per machine, registers a unit, and reconstitutes the agent at boot rather than storing it as a plain executable. Ghost-Cron is the same package model behind a cron trigger, for hosts without systemd — most NAS and router-class devices. A small on-disk pointer records the choice, so status and remove work for whichever operator shows up next week.

A root agent installs a LaunchDaemon (boot, before login); a user agent installs a LaunchAgent (login). Ghost-Cron is the alternative trigger. Same package model as Linux: per-machine launcher, the agent's own image carried with it.

Check-in interval, jitter and jitter mode, and a working-hours gate, changed without a rebuild. The table's next-check-in column reflects what you set, so a second operator can tell a slow agent from a lost one.

The workspace can request a cleaned view of system libraries, apply the agent's script-scanning and event-tracing controls before managed code runs, choose a parent process, and block third-party library injection into children it starts. While idle, the agent's memory does not have to sit in the clear. Phantom Gate is the component behind the script-scanning and event-tracing controls; how it works is licensed material.

Stagers can separately decline to run when a machine looks like an analysis environment. Thresholds are build settings and are not published.

Agents report the products they can see. Rows and dashboard show them with recognizable marks for the common enterprise and consumer lines and a plain mark with the name on hover for anything unfamiliar. This is reporting, not a claim about any specific product.

Push a new build to a live agent, including an in-memory replacement path. If the next start is interrupted, a recovery path prevents a half-applied update from becoming an unreachable host. Updates are a separate permission from ordinary tasking.

Revoke cuts the agent off. Remove takes off what it installed on the host. Delete drops the server-side record. Three different endings, labeled as three different endings — deleting the record without removing the install is how fleets get haunted.

Administrators see the server; operators see the agents they were assigned and the features they were granted. Grants are specific and independent, so the person who mints tokens is not automatically the person who can open a tunnel.

GRANTS  builder.agent · builder.stager · builder.ghost · modules · stager tokens · files · tunnel · update · bof · database · cleanup · server info · keys

Password sign-in, then a six-digit time-based second factor for enrolled operators (RFC 6238, 30-second period), with eight single-use recovery codes. There is no ambient trust of the network the browser happens to be on.

The activity log records sign-in, sign-out, user changes, and permission changes; it filters and exports to CSV. Addresses you mark silent stay out of it. Campaigns, aliases, keys, sessions, and fleet statistics live in the same store, with sensitive columns encrypted. Large task results are accepted in chunks so a directory export never has to fit inside one check-in.

An installable, ground-up native reimplementation of the panel — not a wrapper around a web view — for operators who want one: multiple server profiles, credentials in the OS keychain, tray, native notifications, its own updater, and — in the licensed build — a wizard that deploys the teamserver onto a host you administer. The panel loses nothing by not using it; that is the “on the go” promise.

Validated on the teamserver with no callback. Bound to your organization, not to a machine, so you can rebuild the server freely. Builds are marked to the customer. Expiry behavior is on the licensing page.

The panel interface ships in English and Russian, per operator, remembered per browser. This website is English for now; the Russian edition and the product catalog are separate deliverables.