Quickstart

Get up and running with Havoc Framework in minutes

This quickstart guide will walk you through setting up Havoc Framework, starting the teamserver, connecting the client, and generating your first Demon agent.

Prerequisites

Before you begin, ensure you have:

• A supported Linux distribution (Ubuntu 20.04/22.04, Debian 10/11, or Kali Linux)
• All required dependencies installed (see Installation)
• Successfully built both the teamserver and client

Start the teamserver

The teamserver is the backend component that handles agent communications, payload generation, and client connections.

1. Navigate to the Havoc directory

   cd Havoc
   
2. Launch the teamserver with a profile

   sudo ./havoc server --profile ./profiles/havoc.yaotl -v --debug
   

   • --profile: Specifies the configuration profile
   • -v: Enables verbose output
   • --debug: Enables debug logging

   You should see output indicating the teamserver has started and is listening for client connections.

Connect the client

1. Start the Havoc client

   In a new terminal window:

   ./havoc client
   

   The client GUI will launch and display a connection dialog.

2. Configure connection settings

   Enter your connection details:

   • Profile Name: A descriptive name (e.g., “Local Server”)
   • Host: The teamserver address (e.g., 127.0.0.1 for local)
   • Port: The teamserver port (default: 40056)
   • Username: Your operator username (defined in the profile)
   • Password: Your operator password (defined in the profile)

   The default credentials in havoc.yaotl are:

   • Username: 5pider or Neo
   • Password: password1234
3. Connect

   Click Connect to establish the connection. Once connected, you’ll see the main Havoc interface with the session graph, event log, and console.

Create a listener

Listeners are how agents communicate with the teamserver.

1. Open the Listeners view

   In the top menu, navigate to View → Listeners.

   A new pane will appear at the bottom of the window.

2. Add a new listener

   Click the Add button in the Listeners pane.

3. Configure the listener

   In the Create Listener dialog:

   • Name: A descriptive name (e.g., “HTTP Listener”)
   • Payload: Select “Https” or “Http”
   • Hosts: The callback address (e.g., 192.168.1.100)
   • Port (Bind): Port to bind on the teamserver (e.g., 443)
   • Port (Conn): Port agents use to connect (default: same as bind)
   • User Agent: Browser user agent string
   • Headers: Custom HTTP headers (optional)

   For HTTPS listeners, the teamserver will automatically generate a self-signed certificate.

4. Save the listener

   Click Save. The listener will appear in the Listeners pane and begin accepting agent connections.

Generate a payload

1. Open the Payload generator

   In the top menu, click Attack → Payload.

2. Configure the payload

   In the Payload dialog:

   • Listener: Select your HTTP/HTTPS listener
   • Agent: Select “Demon”
   • Format: Choose EXE, DLL, or Shellcode
   • Architecture: x64 (x86 coming soon)

   Optional settings:

   • Sleep: Agent sleep interval in seconds (default: 2)
   • Jitter: Randomness in sleep timing (default: 15%)
   • Indirect Syscall: Enable for EDR evasion
   • Sleep Technique: Choose obfuscation method:
     • WaitForSingleObjectEx (no obfuscation)
     • FOLIAGE
     • Ekko
3. Generate

   Click Generate. The teamserver will compile your payload.

   Compilation output

   You’ll see compilation progress in the client. Once complete, you’ll be prompted to save the payload file.

4. Save and deploy

   Choose a location to save your payload, then deploy it to your target system.

Execute the payload

Transfer your generated payload to the target system and execute it. Within seconds (depending on your sleep configuration), you should see a new agent callback in the Havoc client.

For testing purposes, you can execute the payload on your local system. In production, use appropriate delivery methods for your engagement.

Interact with your agent

1. View the new session

   When an agent checks in, it appears in the session graph and the Sessions pane.

2. Interact with the agent

   Right-click on the session and select Interact.

   A new console tab will open for this agent.

3. Run commands

   Try some basic commands:

   help                    # List all available commands
   whoami                  # Get current user
   hostname                # Get computer name
   pwd                     # Print working directory
   ps                      # List running processes
   

Essential commands

Here are some frequently used Demon commands:

Session management

• checkin - Request full agent check-in
• sleep <seconds> - Change sleep interval
• exit - Terminate the agent

File operations

• ls / dir - List directory contents
• cd <path> - Change directory
• download <file> - Download a file
• upload <local> <remote> - Upload a file

Process management

• ps - List processes
• kill <pid> - Terminate a process
• proc module <pid> - List loaded modules

Token management

• token getuid - Get current token UID
• token steal <pid> - Steal token from process
• token impersonate <id> - Impersonate a stolen token

Code execution

• shell <command> - Execute shell command
• inline-execute <assembly> - Execute .NET assembly
• shellcode inject <pid> <path> - Inject shellcode

Enumeration

• domain - Get domain information
• net logons - Show logged-on users
• net sessions - Show active sessions

Next steps

Explore Demon features

Learn about sleep obfuscation, indirect syscalls, and advanced capabilities

Configure profiles

Customize your C2 infrastructure with YAOTL profiles

Token management

Master privilege escalation and lateral movement techniques

Extend Havoc

Build custom agents, modules, and integrations

Troubleshooting

Agent doesn't callback

Check:

• Firewall rules allow the listener port
• Listener is running (View → Listeners)
• Agent can reach the callback address
• Sleep interval hasn’t elapsed yet (default: 2 seconds)
• Check teamserver logs for connection attempts

Payload compilation fails

Common causes:

• Missing MinGW compiler (run make ts-build again)
• Incorrect compiler paths in profile
• Insufficient disk space

Solution: Check the teamserver output for specific compiler errors.

Client can't connect to teamserver

Check:

• Teamserver is running
• Correct host and port
• Credentials match profile configuration
• Firewall allows teamserver port (default: 40056)

Commands return errors

Common issues:

• Insufficient privileges (try token privs-get)
• Blocked by AV/EDR (check event logs)
• Invalid syntax (use help <command>)

Additional resources

• Command Reference - Complete list of Demon commands
• Listener Configuration - Advanced listener options
• Sleep Obfuscation - Evade memory scanners
• Python API - Automate operations

For more help, join the Havoc Discord or check the FAQ.