Havoc Framework

Havoc Framework is an open-source command-and-control (C2) framework designed for adversary simulation and red team operations. It provides operators with a modular post-exploitation platform for managing implants (called "Demons") on compromised systems.

Key components:

• Teamserver: A backend server that manages operator connections, listeners, and agent sessions
• Client (GUI): A Qt-based graphical interface for operators to interact with the teamserver and manage sessions
• Demon: The default implant/agent written in C, designed to run on Windows targets with evasion capabilities

Core capabilities include:

• Multi-operator support via a collaborative teamserver
• Listener management supporting multiple protocols (HTTP/HTTPS, SMB)
• Demon agent with support for process injection, token manipulation, and in-memory execution
• Sleep obfuscation and other evasion techniques to avoid detection
• Built-in post-exploitation modules (e.g., shell commands, file operations, process management)
• Python-based extension API for writing custom modules and scripts
• Support for external C2 profiles for traffic customization
• BOF (Beacon Object File) support for running Cobalt Strike-compatible BOFs
• Shellcode injection and execution capabilities
• Pivoting and lateral movement support

The framework is written primarily in C, C++, Go, and Python. The repository was archived by its owner in February 2026 and is now read-only. It is available publicly on GitHub under an open-source license.