Phantom

Ghost ended at “you got a shell.” Phantom starts there and does not stop until the operation is complete. This is the complete chain a real operator runs against a real compromised environment in 2026.

Who this is for: operatives who have finished Ghost or can do equivalent work on a fresh Linux box without thinking. Phantom assumes you live in a shell — it will not teach you how to move a file or read a log. It teaches what happens after the initial foothold and does not soften the 2026 reality: modern kernel protections, container runtimes, Kubernetes RBAC, cloud IAM, and the specific CVEs that still matter this year.

Phantom is structured as a single escalating operation. Each act builds on the last. By graduation you will have executed the full attack lifecycle.

• I. Escalation (0–9) — Ten levels covering every real-world privilege escalation vector: SUID/GTFOBins, sudo misconfigurations, library hijacking, capabilities, writable sensitive files, cron and systemd abuse, polkit CVEs, ptrace injection, and kernel exploits.
• II. Harvest & Persist (10–15) — Six levels on credential harvesting (memory dumps, SSH keys, tokens, config files), persistence mechanisms (SSH, cron, systemd, PAM backdoors), defense evasion (auditd bypass, LOLBins, fileless execution), and anti-forensics (log wipe, timestomping).
• III. Lateral Movement (16–19) — Four levels on SSH tunneling, ligolo-ng, internal network reconnaissance, credential spraying, and a full three-machine pivot chain.
• IV. Container & Cloud (20–26) — Seven levels on container detection, Docker socket and privileged escapes, Leaky Vessels CVE-2024, exposed Docker API, Kubernetes pod escape, cluster takeover via service account abuse, and cloud IAM pivot through IMDS.
• V. Operations (27–31) — Five levels on custom tooling, data exfiltration (DNS/HTTPS/ICMP), network traffic interception, multi-host cleanup, and a time-limited graduation mission across the full attack chain.

Thirty-one public levels plus one hidden graduation. After Phantom you can:

• Walk onto any Linux host with an unprivileged shell and identify every realistic escalation path in under ten minutes.
• Exploit SUID binaries, sudo rules, capabilities, writable files, cron jobs, and kernel CVEs — the full privesc arsenal.
• Harvest credentials from memory, history files, config files, environment variables, SSH keys, and service tokens.
• Install persistence that survives reboots and detection — SSH keys, cron, systemd, PAM backdoors.
• Operate invisibly: bypass auditd, use LOLBins, execute fileless payloads, and clean every log artifact.
• Pivot through multi-segment networks using SSH tunnels, ligolo-ng, and covert channels.
• Detect that you are inside a container, identify the runtime, and escape through five distinct techniques.
• Escape a Kubernetes pod, reach the API server with curl and a service account token, and take over the cluster.
• Harvest cloud credentials from IMDS and pivot into cloud infrastructure.
• Write custom reverse shells, adapt public exploits, and build simple C2 callbacks.
• Exfiltrate data through DNS tunneling, HTTPS, and ICMP — the channels that bypass every firewall.
• Clean up a multi-host operation leaving zero forensic artifacts.