From 9f49b52ff646229b9c29a2b76eb9a1efa957fac8 Mon Sep 17 00:00:00 2001 From: n0mad1k Date: Thu, 24 Apr 2025 14:52:50 -0400 Subject: [PATCH] getting the c2 running --- templates/havoc-config.yaotl.j2 | 188 +++++++++----------------------- 1 file changed, 50 insertions(+), 138 deletions(-) diff --git a/templates/havoc-config.yaotl.j2 b/templates/havoc-config.yaotl.j2 index a6b2b65..a59d0d3 100644 --- a/templates/havoc-config.yaotl.j2 +++ b/templates/havoc-config.yaotl.j2 @@ -8,61 +8,47 @@ Teamserver { Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc" Compiler86 = "/usr/bin/i686-w64-mingw32-gcc" Nasm = "/usr/bin/nasm" - {% if havoc_compiler_flags is defined %} - CompilerFlags = "{{ havoc_compiler_flags }}" - {% else %} - CompilerFlags = "-Os -fno-asynchronous-unwind-tables -fno-ident -fpack-struct=8 -ffunction-sections" - {% endif %} } } Operators { - {{ havoc_admin_user | default('admin') }} { + user "{{ havoc_admin_user | default('admin') }}" { Password = "{{ havoc_admin_password | default(lookup('password', '/dev/null chars=ascii_letters,digits length=24')) }}" - {% if havoc_auth_secret is defined %} - Secret = "{{ havoc_auth_secret }}" - {% else %} - Secret = "{{ lookup('password', '/dev/null chars=hex_lower length=32') }}" - {% endif %} + Secret = "{{ havoc_auth_secret | default(lookup('password', '/dev/null chars=hex_lower length=32')) }}" } {% if havoc_operators is defined %} {% for operator in havoc_operators %} - {{ operator.name }} { + user "{{ operator.name }}" { Password = "{{ operator.password }}" - {% if operator.secret is defined %} - Secret = "{{ operator.secret }}" - {% else %} - Secret = "{{ lookup('password', '/dev/null chars=hex_lower length=32') }}" - {% endif %} + Secret = "{{ operator.secret | default(lookup('password', '/dev/null chars=hex_lower length=32')) }}" } {% endfor %} {% endif %} } Listeners { - http { - Name = "http" - KillDate = "{{ havoc_killdate | default('2030-01-01') }}" + Http { + Name = "http" + KillDate = "{{ havoc_killdate | default('2030-01-01') }}" WorkingHours = "{{ havoc_working_hours | default('0:00-23:59') }}" {% if havoc_hosts is defined %} - Hosts = [ + Hosts = [ {% for host in havoc_hosts %} "{{ host }}"{% if not loop.last %},{% endif %} {% endfor %} ] {% else %} - Hosts = ["0.0.0.0"] + Hosts = ["0.0.0.0"] {% endif %} - HostBind = "0.0.0.0" + HostBind = "0.0.0.0" HostRotation = "{{ havoc_host_rotation | default('round-robin') }}" - Port = {{ havoc_http_port | default(8080) }} - PortBind = {{ havoc_http_port | default(8080) }} + PortBind = {{ havoc_http_port | default(8080) }} {% if havoc_user_agent is defined %} - UserAgent = "{{ havoc_user_agent }}" + UserAgent = "{{ havoc_user_agent }}" {% else %} - UserAgent = "Mozilla/5.0 (Windows NT 10.{{ random_hex[0] | int }}.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/{{ random_hex[1] | int + 80 }}.0.{{ random_hex[2:4] | int }}.{{ random_hex[4:6] | int }} Safari/537.36" + UserAgent = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:{{ random_hex[1] | int + 90 }}.0) Gecko/20100101 Firefox/{{ random_hex[2] | int + 95 }}.0" {% endif %} - Headers = [ + Headers = [ {% if havoc_http_headers is defined %} {% for header in havoc_http_headers %} "{{ header }}"{% if not loop.last %},{% endif %} @@ -73,7 +59,7 @@ Listeners { "X-Requested-With: XMLHttpRequest" {% endif %} ] - Uris = [ + Uris = [ {% if havoc_http_uris is defined %} {% for uri in havoc_http_uris %} "{{ uri }}"{% if not loop.last %},{% endif %} @@ -85,40 +71,39 @@ Listeners { "/wp-includes/{{ random_hex[1:6] }}.js" {% endif %} ] - Secure = false + Secure = false {% if havoc_proxy_enabled | default(false) %} - Proxy = { - Host = "{{ havoc_proxy_host }}" - Port = {{ havoc_proxy_port }} + Proxy { + Host = "{{ havoc_proxy_host }}" + Port = {{ havoc_proxy_port }} Username = "{{ havoc_proxy_username | default('') }}" Password = "{{ havoc_proxy_password | default('') }}" } {% endif %} } - https { - Name = "https" - KillDate = "{{ havoc_killdate | default('2030-01-01') }}" + Http { + Name = "https" + KillDate = "{{ havoc_killdate | default('2030-01-01') }}" WorkingHours = "{{ havoc_working_hours | default('0:00-23:59') }}" {% if havoc_hosts is defined %} - Hosts = [ + Hosts = [ {% for host in havoc_hosts %} "{{ host }}"{% if not loop.last %},{% endif %} {% endfor %} ] {% else %} - Hosts = ["0.0.0.0"] + Hosts = ["0.0.0.0"] {% endif %} - HostBind = "0.0.0.0" + HostBind = "0.0.0.0" HostRotation = "{{ havoc_host_rotation | default('round-robin') }}" - Port = {{ havoc_https_port | default(443) }} - PortBind = {{ havoc_https_port | default(443) }} + PortBind = {{ havoc_https_port | default(443) }} {% if havoc_user_agent is defined %} - UserAgent = "{{ havoc_user_agent }}" + UserAgent = "{{ havoc_user_agent }}" {% else %} - UserAgent = "Mozilla/5.0 (Windows NT 10.{{ random_hex[0] | int }}.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/{{ random_hex[1] | int + 80 }}.0.{{ random_hex[2:4] | int }}.{{ random_hex[4:6] | int }} Safari/537.36" + UserAgent = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:{{ random_hex[1] | int + 90 }}.0) Gecko/20100101 Firefox/{{ random_hex[2] | int + 95 }}.0" {% endif %} - Headers = [ + Headers = [ {% if havoc_https_headers is defined %} {% for header in havoc_https_headers %} "{{ header }}"{% if not loop.last %},{% endif %} @@ -129,7 +114,7 @@ Listeners { "X-Requested-With: XMLHttpRequest" {% endif %} ] - Uris = [ + Uris = [ {% if havoc_https_uris is defined %} {% for uri in havoc_https_uris %} "{{ uri }}"{% if not loop.last %},{% endif %} @@ -141,13 +126,17 @@ Listeners { "/wp-content/plugins/{{ random_hex[1:6] }}" {% endif %} ] - Secure = true - Cert = "{{ havoc_cert_path | default('/root/Tools/havoc/data/certs/havoc.crt') }}" - Key = "{{ havoc_key_path | default('/root/Tools/havoc/data/certs/havoc.key') }}" + Secure = true + + Cert { + Cert = "{{ havoc_cert_path | default('/root/Tools/havoc/data/certs/havoc.crt') }}" + Key = "{{ havoc_key_path | default('/root/Tools/havoc/data/certs/havoc.key') }}" + } + {% if havoc_proxy_enabled | default(false) %} - Proxy = { - Host = "{{ havoc_proxy_host }}" - Port = {{ havoc_proxy_port }} + Proxy { + Host = "{{ havoc_proxy_host }}" + Port = {{ havoc_proxy_port }} Username = "{{ havoc_proxy_username | default('') }}" Password = "{{ havoc_proxy_password | default('') }}" } @@ -155,90 +144,37 @@ Listeners { } {% if havoc_smb_enabled | default(false) %} - smb { - Name = "smb" - PipeName = "{{ havoc_smb_pipename | default('havoc-' ~ random_hex[0:6]) }}" + Smb { + Name = "smb" + PipeName = "{{ havoc_smb_pipename | default('havoc-' ~ random_hex[0:6]) }}" } {% endif %} - - {% if havoc_external_enabled | default(false) %} - external { - Name = "external" - KillDate = "{{ havoc_external_killdate | default('2030-01-01') }}" - WorkingHours = "{{ havoc_external_hours | default('0:00-23:59') }}" - Endpoint = "{{ havoc_external_endpoint }}" - } - {% endif %} - - {% if havoc_additional_listeners is defined %} - {% for listener in havoc_additional_listeners %} - {{ listener.name }} { - {% for key, value in listener.config.items() %} - {{ key }} = {% if value is string %}"{{ value }}"{% else %}{{ value }}{% endif %} - {% endfor %} - } - {% endfor %} - {% endif %} } Demon { - Sleep = {{ havoc_sleep | default(random_hex[0:2] | int % 5 + 2) }} - SleepJitter = {{ havoc_jitter | default(random_hex[2:4] | int % 30 + 20) }} - Injection = {{ havoc_injection_method | default(random_hex[4] | int % 3) }} - IndirectSyscalls = {{ havoc_indirect_syscalls | default(true) | lower }} + Sleep = {{ havoc_sleep | default(random_hex[0:2] | int % 5 + 2) }} + Jitter = {{ havoc_jitter | default(random_hex[2:4] | int % 30 + 20) }} Injection { {% if havoc_spawn64 is defined %} Spawn64 = "{{ havoc_spawn64 }}" {% else %} - {% set process_list = [ - "C:\\Windows\\System32\\notepad.exe", - "C:\\Windows\\System32\\RuntimeBroker.exe", - "C:\\Windows\\System32\\dllhost.exe", - "C:\\Windows\\System32\\smartscreen.exe", - "C:\\Windows\\System32\\ctfmon.exe", - "C:\\Windows\\System32\\sihost.exe", - "C:\\Windows\\System32\\taskhostw.exe" - ] %} - Spawn64 = "{{ process_list[random_hex[5] | int % process_list|length] }}" + Spawn64 = "C:\\Windows\\System32\\dllhost.exe" {% endif %} {% if havoc_spawn32 is defined %} Spawn32 = "{{ havoc_spawn32 }}" {% else %} - {% set process32_list = [ - "C:\\Windows\\SysWOW64\\notepad.exe", - "C:\\Windows\\SysWOW64\\dllhost.exe", - "C:\\Windows\\SysWOW64\\ctfmon.exe" - ] %} - Spawn32 = "{{ process32_list[random_hex[6] | int % process32_list|length] }}" - {% endif %} - - {% if havoc_allocation_method is defined %} - AllocationMethod = {{ havoc_allocation_method }} - {% else %} - AllocationMethod = {{ random_hex[7] | int % 3 }} - {% endif %} - - {% if havoc_execution_method is defined %} - ExecutionMethod = {{ havoc_execution_method }} - {% else %} - ExecutionMethod = {{ random_hex[3] | int % 2 }} - {% endif %} - - {% if havoc_execution_options is defined %} - ExecuteOptions = {{ havoc_execution_options }} - {% else %} - ExecuteOptions = 1 + Spawn32 = "C:\\Windows\\SysWOW64\\dllhost.exe" {% endif %} } {% if havoc_evasion_enabled | default(true) %} Evasion { - StackSpoofing = {{ havoc_stack_spoofing | default(true) | lower }} - SleazeUnhook = {{ havoc_sleaze_unhook | default(true) | lower }} + StackSpoofing = {{ havoc_stack_spoofing | default(true) | lower }} + SleazeUnhook = {{ havoc_sleaze_unhook | default(true) | lower }} AmsiEtwPatching = {{ havoc_amsi_etw_patching | default(true) | lower }} - ApiFiltering = {{ havoc_api_filtering | default(true) | lower }} + ApiFiltering = {{ havoc_api_filtering | default(true) | lower }} {% if havoc_syscall_method is defined %} SyscallMethod = {{ havoc_syscall_method }} @@ -247,28 +183,4 @@ Demon { {% endif %} } {% endif %} - - {% if havoc_masking_enabled | default(true) %} - Masking { - HeapType = {{ random_hex[1] | int % 2 }} - SleepMaskTechnique = {{ random_hex[2] | int % 4 }} - } - {% endif %} - - {% if havoc_binary_signing_enabled | default(false) %} - Binary { - SignTemplate = { - Name = "{{ havoc_sign_template_name | default('MicrosoftLLC') }}" - {% if havoc_sign_template_extra_options is defined %} - Options = { - {% for key, value in havoc_sign_template_extra_options.items() %} - {{ key }} = "{{ value }}" - {% endfor %} - } - {% endif %} - } - } - {% endif %} - - {{ havoc_additional_options | default('') }} } \ No newline at end of file