Havoc Framework Documentation

Havoc can download files from the victim's computer.

Havoc has a module for network enumeration including determining IP addresses.

Havoc features a module capable of host enumeration.

Havoc has DLL spawn and injection modules.

Havoc has itself injected into `C:\\Windows\\System32\\Werfault.exe` on targeted systems.

Havoc can enumerate processes on targeted hosts.

Havoc can execute commands via `cmd.exe`.

Havoc can use HTTP/S listeners to establish and maintain C2 communications.

Havoc can use an SMB listener for C2 communication.

The Havoc interface can display a file explorer view of the compromised host.

Havoc has the ability to route HTTP/S communications through designated proxies.

Havoc has the ability to upload files to infected systems.

Havoc can use `NtAllocateVirtualMemory` and `NtCreateThreadEx` to aid process injection.

Havoc can capture screenshots.

Havoc has a module capable of token impersonation.

The Havoc demon agent can be set to sleep for a specified time.

The Havoc SMB demon can use named pipes for communication through a parent demon.

Havoc has the ability to copy files from one location to another.