Install globally (recommended for Kali):
https://github.com/EntySec/Ghost
Ghost is perfect for CTFs, OSCP labs, and quick internal assessments where you don't want to trigger EDR with standard Metasploit patterns. Customizing from GitHub Source Since you have the repo, you can write your own modules. Ghost modules live in ghost/modules/ . The structure is dead simple: ghost framework kali linux github
| Command | What it does | |---------|---------------| | sysinfo | OS, hostname, architecture, uptime | | persist | Install startup persistence (Registry/Run key) | | keylog | Capture keystrokes from the target | | screenshot | Grab remote desktop (Windows GDI) | | shell | Drop into an interactive cmd.exe | | upload /local/path /remote/path | Exfil tools | | download C:\secret\data.txt | Steal files | Install globally (recommended for Kali): https://github
The primary workflow is: build -> deploy -> listen -> interact . 1. Create a payload (Windows example) ghost > build windows/x64 my_beacon.exe This generates a position-independent executable. Use UPX if you want smaller size: The structure is dead simple: | Command |
cd Ghost Ghost requires Python 3.9+ and a handful of pip packages. The framework includes an installer script, but I prefer to inspect dependencies first.