Havoc Framework

Havoc Framework is an open-source command-and-control (C2) framework designed for adversary simulation and red team operations. It provides operators with a modular post-exploitation platform for managing implants (called "Demons") on compromised systems. Key components: - Teamserver: A backend server that manages operator connections, listeners, and agent sessions - Client (GUI): A Qt-based graphical interface for operators to interact with the teamserver and manage sessions - Demon: The default implant/agent written in C, designed to run on Windows targets with evasion capabilities Core capabilities include: - Multi-operator support via a collaborative teamserver - Listener management supporting multiple protocols (HTTP/HTTPS, SMB) - Demon agent with support for process injection, token manipulation, and in-memory execution - Sleep obfuscation and other evasion techniques to avoid detection - Built-in post-exploitation modules (e.g., shell commands, file operations, process management) - Python-based extension API for writing custom modules and scripts - Support for external C2 profiles for traffic customization - BOF (Beacon Object File) support for running Cobalt Strike-compatible BOFs - Shellcode injection and execution capabilities - Pivoting and lateral movement support The framework is written primarily in C, C++, Go, and Python. The repository was archived by its owner in February 2026 and is now read-only. It is available publicly on GitHub under an open-source license.