Phoenix C2

Single-port C2 with SYSTEM-ready payloads. No migration protocol breaks.

// What is this?

A single-port C2 framework designed to blend traffic into normal web connections and survive infrastructure loss.

Phoenix (ShellChain) is a research C2 framework focused on the migration problem — what happens when an implant loses its C2 server. It uses AES-256-CBC encryption, a sentinel-based command protocol, and stores redirect configuration (ip.txt/port.txt) so the implant can recover without re-compromise. The design prioritises operational resilience and traffic blending over raw feature count.

PowerShell — C2 Framework Detection

→ Blue Team

# Beaconing detection (regular interval connections)
Get-NetTCPConnection -State Established | Group-Object RemoteAddress |
  Where-Object { $_.Count -gt 3 } | Select-Object Name, Count

# Processes with network connections to external IPs
Get-NetTCPConnection -State Established | Where-Object {
  $_.RemoteAddress -notmatch "^(127\.|10\.|192\.168\.|172\.(1[6-9]|2|3[0-1])\.|::)"
} | ForEach-Object { Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue } |
  Select-Object Name, Id, Path | Sort-Object -Unique

# DNS requests to dynamic DNS providers
Get-DnsClientCache | Where-Object { $_.Name -match "duckdns|ngrok|no-ip|ddns" }

If this flags: Regular interval connections = beacon behavior. Dynamic DNS domains are C2 infrastructure. Check process executable for persistence mechanism.

Single-Port Architecture NSudo Integration AES-256-CBC Dual Persistence

Live Demo

Dual-view demonstration: Attacker C2 panel and victim desktop during authorized engagement

Overview

Phoenix solves the SYSTEM shell problem. Previous C2 architectures used migration protocols that broke when running as NT AUTHORITY\SYSTEM - the process couldn't follow port redirection commands.

Phoenix uses a single-port architecture: connect once, stay connected. USER, ADMIN, and SYSTEM shells all work on the same connection.

Features

Single-Port C2

No migration protocol. SYSTEM shells stay connected.

NSudo Escalation

Admin → SYSTEM escalation that actually works.

Dual Persistence

Roaming + Local + ProgramFiles folders.

SetupComplete.cmd

Survives Windows reset and reinstall.

C2 Redirection

ip.txt/port.txt for mid-session handoff.

Anti-Sandbox

Configurable lifetime timer.

Documentation

🔒

Authorized Access Only

Phoenix documentation is available to verified security professionals and authorized red team operators. Access requires NDA and proof of legitimate security research or penetration testing engagement.

Request Access →

Documentation includes:

Operators Guide - Full operational manual
Technical Workbook - Deep-dive into techniques
EXE Build Guide - Building Windows payloads
Feature Checklist - Implementation status

Access

Phoenix is a private framework for authorized penetration testing engagements only.

For access inquiries: Contact Us