Documentation Index

Fetch the complete documentation index at: https://mintlify.com/HavocFramework/Havoc/llms.txt

Use this file to discover all available pages before exploring further.

​

Architecture Overview

​

Three-Tier Architecture

​

Component Roles

​

Client Layer

• User Interface: Modern dark-themed interface for operators
• WebSocket Connection: Connects to the teamserver over WSS (WebSocket Secure)
• Multi-operator Support: Multiple clients can connect to the same teamserver
• Session Management: Interact with agents, view output, and issue commands
• Python API: Extend functionality with custom scripts

​

Teamserver Layer

• Registers new agents and maintains session state
• Dispatches commands from operators to agents
• Processes responses and relays them to connected clients
• Persists agent data in SQLite database

• Spawns HTTP/HTTPS listeners for agent callbacks
• Manages SMB named pipe listeners for pivoting
• Supports External C2 endpoints
• Handles listener configuration from profiles

• WebSocket server for operator clients
• Multiplayer session synchronization
• Authentication and authorization
• Event broadcasting to all connected clients

• Compiles Demon agents (EXE, DLL, shellcode)
• Uses MinGW cross-compilers and NASM
• Applies profile-based configurations

​

Demon Agent Layer

// From Demon.h
struct {
    ULONG SleepMaskTechnique;     // Ekko, Zilean, or FOLIAGE
    ULONG SleepJmpBypass;
    BOOL  StackSpoof;              // Return address spoofing
    BOOL  SysIndirect;             // Indirect syscalls
    BYTE  ProxyLoading;
    BYTE  AmsiEtwPatch;            // Hardware breakpoint patching
} Implant;

• HTTP/HTTPS for C2 communication
• SMB named pipes for peer-to-peer pivoting
• Encrypted traffic using AES

• Token vault and impersonation
• Process injection and migration
• .NET assembly execution (in-process)
• BOF (Beacon Object File) support via CoffeeLdr
• Kerberos ticket manipulation
• File system operations
• Screenshot capture

​

Communication Flow

​

Client to Teamserver

1. Client connects to Teamserver WebSocket endpoint (wss://host:40056/havoc/)
2. Client sends authentication package with hashed password
3. Teamserver validates credentials against YAOTL profile
4. On success, teamserver sends session state (agents, listeners, events)
5. Client sends commands; teamserver broadcasts events to all clients

​

Agent to Teamserver

1. Demon agent generates AgentID from system metadata
2. Agent sends DEMON_INIT request to HTTP/HTTPS listener
3. Teamserver parses header, validates magic value (0x4156_4F48)
4. Agent encrypts payload with AES (Key + IV embedded in binary)
5. Teamserver decrypts, processes commands, queues responses
6. Agent polls for jobs using COMMAND_GET_JOB
7. Teamserver responds with queued tasks or COMMAND_NOJOB

type Header struct {
    MagicValue uint32      // 0x4156_4F48 for Demon
    AgentID    int         // Unique agent identifier
    Data       parser.Parser  // Encrypted payload
}

​

Pivoting Architecture

[Teamserver] <--HTTP--> [Demon A] <--SMB--> [Demon B] <--SMB--> [Demon C]

• Parent agents relay traffic for child agents
• Teamserver tracks pivot relationships in database
• Commands are recursively wrapped and encrypted per agent

​

Data Storage

• agents: Agent metadata, configuration, encryption keys
• listeners: Listener configurations
• links: Pivot relationships between agents
• misc: Session state and loot

​

Security Model

• Operators authenticate with SHA3-256 hashed passwords
• Agents use embedded AES keys unique per compiled binary

• Client ↔ Teamserver: TLS over WebSocket
• Agent ↔ Teamserver: AES-256 encrypted payloads
• Each agent has unique AES key and IV

• Each agent session is isolated with unique encryption keys
• Operators can work independently on different agents
• Event system synchronizes state across all clients

​

Extensibility

​

Service API (External C2)

// From teamserver.go
if t.Profile.Config.Service != nil {
    t.Service = service.NewService(t.Server.Engine)
    t.Service.Teamserver = t
    t.Service.Start()
}

​

Python API

• Register custom event handlers
• Create UI widgets and dialogs
• Automate workflows
• Extend Demon commands

​

Summary

• Scalability: Multiple operators, agents, and listeners
• Flexibility: Custom agents and protocols via Service API
• Persistence: Database-backed session state
• Security: Layered encryption and authentication
• Extensibility: Python API and modular design