{% set random_hex = lookup('password', '/dev/null chars=hex_lower length=8') %} Teamserver { Host = "0.0.0.0" Port = {{ havoc_teamserver_port | default(40056) }} Build { Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc" Compiler86 = "/usr/bin/i686-w64-mingw32-gcc" Nasm = "/usr/bin/nasm" {% if havoc_compiler_flags is defined %} CompilerFlags = "{{ havoc_compiler_flags }}" {% else %} CompilerFlags = "-Os -fno-asynchronous-unwind-tables -fno-ident -fpack-struct=8 -ffunction-sections" {% endif %} } } Operators { {{ havoc_admin_user | default('admin') }} { Password = "{{ havoc_admin_password | default(lookup('password', '/dev/null chars=ascii_letters,digits length=24')) }}" {% if havoc_auth_secret is defined %} Secret = "{{ havoc_auth_secret }}" {% else %} Secret = "{{ lookup('password', '/dev/null chars=hex_lower length=32') }}" {% endif %} } {% if havoc_operators is defined %} {% for operator in havoc_operators %} {{ operator.name }} { Password = "{{ operator.password }}" {% if operator.secret is defined %} Secret = "{{ operator.secret }}" {% else %} Secret = "{{ lookup('password', '/dev/null chars=hex_lower length=32') }}" {% endif %} } {% endfor %} {% endif %} } Listeners { http { Name = "http" KillDate = "{{ havoc_killdate | default('2030-01-01') }}" WorkingHours = "{{ havoc_working_hours | default('0:00-23:59') }}" {% if havoc_hosts is defined %} Hosts = [ {% for host in havoc_hosts %} "{{ host }}"{% if not loop.last %},{% endif %} {% endfor %} ] {% else %} Hosts = ["0.0.0.0"] {% endif %} HostBind = "0.0.0.0" HostRotation = "{{ havoc_host_rotation | default('round-robin') }}" Port = {{ havoc_http_port | default(8080) }} PortBind = {{ havoc_http_port | default(8080) }} {% if havoc_user_agent is defined %} UserAgent = "{{ havoc_user_agent }}" {% else %} UserAgent = "Mozilla/5.0 (Windows NT 10.{{ random_hex[0] | int }}.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/{{ random_hex[1] | int + 80 }}.0.{{ random_hex[2:4] | int }}.{{ random_hex[4:6] | int }} Safari/537.36" {% endif %} Headers = [ {% if havoc_http_headers is defined %} {% for header in havoc_http_headers %} "{{ header }}"{% if not loop.last %},{% endif %} {% endfor %} {% else %} "Accept: */*", "Accept-Language: en-US,en;q=0.9", "X-Requested-With: XMLHttpRequest" {% endif %} ] Uris = [ {% if havoc_http_uris is defined %} {% for uri in havoc_http_uris %} "{{ uri }}"{% if not loop.last %},{% endif %} {% endfor %} {% else %} "/api/v{{ random_hex[6] | int + 1 }}", "/dashboard", "/content/{{ random_hex[1:4] }}", "/wp-includes/{{ random_hex[1:6] }}.js" {% endif %} ] Secure = false {% if havoc_proxy_enabled | default(false) %} Proxy = { Host = "{{ havoc_proxy_host }}" Port = {{ havoc_proxy_port }} Username = "{{ havoc_proxy_username | default('') }}" Password = "{{ havoc_proxy_password | default('') }}" } {% endif %} } https { Name = "https" KillDate = "{{ havoc_killdate | default('2030-01-01') }}" WorkingHours = "{{ havoc_working_hours | default('0:00-23:59') }}" {% if havoc_hosts is defined %} Hosts = [ {% for host in havoc_hosts %} "{{ host }}"{% if not loop.last %},{% endif %} {% endfor %} ] {% else %} Hosts = ["0.0.0.0"] {% endif %} HostBind = "0.0.0.0" HostRotation = "{{ havoc_host_rotation | default('round-robin') }}" Port = {{ havoc_https_port | default(443) }} PortBind = {{ havoc_https_port | default(443) }} {% if havoc_user_agent is defined %} UserAgent = "{{ havoc_user_agent }}" {% else %} UserAgent = "Mozilla/5.0 (Windows NT 10.{{ random_hex[0] | int }}.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/{{ random_hex[1] | int + 80 }}.0.{{ random_hex[2:4] | int }}.{{ random_hex[4:6] | int }} Safari/537.36" {% endif %} Headers = [ {% if havoc_https_headers is defined %} {% for header in havoc_https_headers %} "{{ header }}"{% if not loop.last %},{% endif %} {% endfor %} {% else %} "Accept: */*", "Accept-Language: en-US,en;q=0.9", "X-Requested-With: XMLHttpRequest" {% endif %} ] Uris = [ {% if havoc_https_uris is defined %} {% for uri in havoc_https_uris %} "{{ uri }}"{% if not loop.last %},{% endif %} {% endfor %} {% else %} "/api/v{{ random_hex[6] | int + 2 }}", "/content", "/static/{{ random_hex[2:5] }}", "/wp-content/plugins/{{ random_hex[1:6] }}" {% endif %} ] Secure = true Cert = "{{ havoc_cert_path | default('/root/Tools/havoc/data/certs/havoc.crt') }}" Key = "{{ havoc_key_path | default('/root/Tools/havoc/data/certs/havoc.key') }}" {% if havoc_proxy_enabled | default(false) %} Proxy = { Host = "{{ havoc_proxy_host }}" Port = {{ havoc_proxy_port }} Username = "{{ havoc_proxy_username | default('') }}" Password = "{{ havoc_proxy_password | default('') }}" } {% endif %} } {% if havoc_smb_enabled | default(false) %} smb { Name = "smb" PipeName = "{{ havoc_smb_pipename | default('havoc-' ~ random_hex[0:6]) }}" } {% endif %} {% if havoc_external_enabled | default(false) %} external { Name = "external" KillDate = "{{ havoc_external_killdate | default('2030-01-01') }}" WorkingHours = "{{ havoc_external_hours | default('0:00-23:59') }}" Endpoint = "{{ havoc_external_endpoint }}" } {% endif %} {% if havoc_additional_listeners is defined %} {% for listener in havoc_additional_listeners %} {{ listener.name }} { {% for key, value in listener.config.items() %} {{ key }} = {% if value is string %}"{{ value }}"{% else %}{{ value }}{% endif %} {% endfor %} } {% endfor %} {% endif %} } Demon { Sleep = {{ havoc_sleep | default(random_hex[0:2] | int % 5 + 2) }} SleepJitter = {{ havoc_jitter | default(random_hex[2:4] | int % 30 + 20) }} Injection = {{ havoc_injection_method | default(random_hex[4] | int % 3) }} IndirectSyscalls = {{ havoc_indirect_syscalls | default(true) | lower }} Injection { {% if havoc_spawn64 is defined %} Spawn64 = "{{ havoc_spawn64 }}" {% else %} {% set process_list = [ "C:\\Windows\\System32\\notepad.exe", "C:\\Windows\\System32\\RuntimeBroker.exe", "C:\\Windows\\System32\\dllhost.exe", "C:\\Windows\\System32\\smartscreen.exe", "C:\\Windows\\System32\\ctfmon.exe", "C:\\Windows\\System32\\sihost.exe", "C:\\Windows\\System32\\taskhostw.exe" ] %} Spawn64 = "{{ process_list[random_hex[5] | int % process_list|length] }}" {% endif %} {% if havoc_spawn32 is defined %} Spawn32 = "{{ havoc_spawn32 }}" {% else %} {% set process32_list = [ "C:\\Windows\\SysWOW64\\notepad.exe", "C:\\Windows\\SysWOW64\\dllhost.exe", "C:\\Windows\\SysWOW64\\ctfmon.exe" ] %} Spawn32 = "{{ process32_list[random_hex[6] | int % process32_list|length] }}" {% endif %} {% if havoc_allocation_method is defined %} AllocationMethod = {{ havoc_allocation_method }} {% else %} AllocationMethod = {{ random_hex[7] | int % 3 }} {% endif %} {% if havoc_execution_method is defined %} ExecutionMethod = {{ havoc_execution_method }} {% else %} ExecutionMethod = {{ random_hex[3] | int % 2 }} {% endif %} {% if havoc_execution_options is defined %} ExecuteOptions = {{ havoc_execution_options }} {% else %} ExecuteOptions = 1 {% endif %} } {% if havoc_evasion_enabled | default(true) %} Evasion { StackSpoofing = {{ havoc_stack_spoofing | default(true) | lower }} SleazeUnhook = {{ havoc_sleaze_unhook | default(true) | lower }} AmsiEtwPatching = {{ havoc_amsi_etw_patching | default(true) | lower }} ApiFiltering = {{ havoc_api_filtering | default(true) | lower }} {% if havoc_syscall_method is defined %} SyscallMethod = {{ havoc_syscall_method }} {% else %} SyscallMethod = {{ random_hex[4] | int % 3 }} {% endif %} } {% endif %} {% if havoc_masking_enabled | default(true) %} Masking { HeapType = {{ random_hex[1] | int % 2 }} SleepMaskTechnique = {{ random_hex[2] | int % 4 }} } {% endif %} {% if havoc_binary_signing_enabled | default(false) %} Binary { SignTemplate = { Name = "{{ havoc_sign_template_name | default('MicrosoftLLC') }}" {% if havoc_sign_template_extra_options is defined %} Options = { {% for key, value in havoc_sign_template_extra_options.items() %} {{ key }} = "{{ value }}" {% endfor %} } {% endif %} } } {% endif %} {{ havoc_additional_options | default('') }} }