| name | building-red-team-c2-infrastructure-with-havoc |
| description | Deploy and configure the Havoc C2 framework with teamserver, HTTPS listeners, redirectors, and Demon agents for authorized red team operations. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["havoc-c2","command-and-control","red-team-infrastructure","post-exploitation","adversary-emulation","demon-agent"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_ai_rmf | ["GOVERN-1.1","MEASURE-2.7","MANAGE-3.1"] |
| d3fend_techniques | ["File Metadata Consistency Validation","Certificate Analysis","Application Protocol Command Analysis","Content Format Conversion","File Content Analysis"] |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Building Red Team C2 Infrastructure with Havoc
Overview
Havoc is a modern, open-source post-exploitation command and control (C2) framework created by C5pider. It provides a collaborative multi-operator interface similar to Cobalt Strike, featuring the Demon agent for Windows post-exploitation, customizable profiles for traffic malleable configurations, and support for HTTP/HTTPS/SMB listeners. This skill covers deploying production-grade Havoc C2 infrastructure with proper OPSEC considerations for authorized red team engagements.
When to Use
- When deploying or configuring building red team c2 infrastructure with havoc capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Most Often Missed & How to Confirm
- Default Demon agent with no sleep obfuscation. Stock Havoc Demon is heavily signatured by EDR. Enable a sleep-mask technique (Ekko/Foliage/Zilean), indirect syscalls, and stack spoofing in the payload build.
- Unmodified malleable profile. Default
havoc.yaotl URIs/headers/User-Agent are public IOCs. Customize Uris, Headers, and Response blocks per engagement.
- Teamserver port 40056 exposed. Operators leave the teamserver reachable from the internet instead of firewalling it to the redirector IP only.
- Self-signed certs. Use Let's Encrypt/purchased certs; self-signed TLS gets flagged.
- No detonation against target EDR before go-live. AMSI/ETW patching and syscall behavior must be validated in a representative AV/EDR snapshot.
- How to confirm: the Demon checks in — it appears in the session table with its sleep/jitter values,
proc list returns processes, and dotnet inline-execute runs an assembly successfully. OPSEC check: detonate in a Defender/EDR lab snapshot first and confirm no alert. Don't conclude the listener is broken until you have curl'd a configured URI (e.g. /api/v2/status) through the redirector and confirmed it forwards to the teamserver while non-matching paths 301 to the decoy site.
Prerequisites
- Ubuntu 22.04 LTS or Debian 11+ (for Teamserver)
- Kali Linux 2023+ (for Client)
- VPS providers: DigitalOcean, Linode, or AWS EC2 (minimum 2GB RAM, 2 vCPU)
- Domain name aged 30+ days with valid SSL certificate
- Written authorization for red team engagement
