Command and Control

Command and Control consists of techniques that adversaries may use to communicate with systems under their control within a victim network.

This chapter is in-progress.

Check the index on the right to navigate this page more easily.

Havoc

Havoc is a modern, malleable post-exploitation command and control framework made for penetration testers, red teams, and blue teams. It's free and open source on github written and maintained by Paul Ungur (C5pider)

Starting the Teamserver

./havoc server --profile profiles/havoc.yaotl

Starting the Client

./havoc client

Demon Commands

Command	Type	Description
help	Command	Shows help message of specified command
sleep	Command	sets the delay to sleep
checkin	Command	request a checkin request
job	Module	job manager
task	Module	task manager
proc	Module	process enumeration and management
transfer	Command	download transfer module
dir	Command	list specified directory
download	Command	downloads a specified file
upload	Command	uploads a specified file
cd	Command	change to specified directory
cp	Command	copy file from one location to another
remove	Command	remove file or directory
mkdir	Command	create new directory
pwd	Command	get current directory
cat	Command	display content of the specified file
screenshot	Command	takes a screenshot
shell	Command	executes cmd.exe commands and gets the output
powershell	Command	executes powershell.exe commands and gets the output
inline-execute	Command	executes an object file
shellcode	Module	shellcode injection techniques
dll	Module	dll spawn and injection modules
exit	Command	cleanup and exit
token	Module	token manipulation and impersonation
dotnet	Module	execute and manage dotnet assemblies
net	Module	network and host enumeration module
config	Module	configure the behaviour of the demon session
pivot	Module	pivoting module
rportfwd	Module	reverse port forwarding
socks	Module	socks4a proxy