Anthropic-Cybersecurity-Skills/skills/building-red-team-c2-infrastructure-with-havoc/assets/template.md

Havoc C2 Infrastructure Configuration Template

Engagement Details

Field	Value
Engagement ID	RT-YYYY-XXX
Client	[Organization]
Operators	[Names]
Start Date	YYYY-MM-DD
End Date	YYYY-MM-DD
Kill Date	YYYY-MM-DD

Infrastructure Inventory

Teamserver

Field	Value
Provider	[AWS/DigitalOcean/Linode]
IP Address	X.X.X.X
OS	Ubuntu 22.04 LTS
Port	40056
Havoc Version	0.7
Access	SSH Key: [key name]

Redirector(s)

Name	Provider	IP	Domain	SSL Cert	Status
Redirector-1	[Provider]	X.X.X.X	c2.domain.com	Let's Encrypt	Active
Redirector-2	[Provider]	X.X.X.X	cdn.domain2.com	Let's Encrypt	Standby

Domains

Domain	Purpose	Registered	Aged	Categorized	SSL
c2.domain.com	Primary C2	YYYY-MM-DD	Yes (45 days)	Business	Yes
cdn.domain2.com	Backup C2	YYYY-MM-DD	Yes (60 days)	Technology	Yes
phish.domain3.com	Phishing	YYYY-MM-DD	Yes (30 days)	Uncategorized	Yes

Havoc Profile Configuration

Teamserver:
  Host: "0.0.0.0"
  Port: 40056

Operators:
  - Username: operator1
    Password: [REDACTED]
  - Username: operator2
    Password: [REDACTED]

Listeners:
  - Name: "Primary HTTPS"
    Type: HTTPS
    Host: c2.domain.com
    Port: 443
    URIs: ["/api/v2/auth", "/api/v2/status", "/content/images/gallery"]
    User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
    Jitter: 30%

  - Name: "SMB Pivot"
    Type: SMB
    PipeName: "\\ntsvcs"

Demon:
  Sleep: 10
  Jitter: 30
  Spawn64: "C:\\Windows\\System32\\notepad.exe"
  Spawn32: "C:\\Windows\\SysWOW64\\notepad.exe"

Payload Inventory

Payload	Format	Listener	Arch	Hash (SHA256)	Delivery
stage1.bin	Shellcode	Primary HTTPS	x64	[hash]	Custom loader
beacon.dll	DLL	Primary HTTPS	x64	[hash]	DLL sideloading
pivot.exe	Service EXE	SMB Pivot	x64	[hash]	Lateral movement

OPSEC Checklist

Pre-Engagement

• Domains registered 30+ days before engagement start
• Domains categorized in Bluecoat, Fortiguard, Palo Alto
• SSL certificates obtained from trusted CA (not self-signed)
• Teamserver hardened (SSH keys only, fail2ban, UFW)
• Redirector filtering non-C2 traffic to legitimate site
• Malleable profile customized (URIs, headers, user-agent)
• Payloads tested against target AV/EDR in isolated lab
• Kill date configured on all payloads
• Operator logs enabled and encrypted at rest

During Engagement

• Beacon sleep/jitter appropriate for operation phase
• No default Havoc indicators in network traffic
• Post-exploitation tools loaded in-memory only
• Named pipes and service names randomized
• Token manipulation used instead of credential replay where possible

Post-Engagement

• All Demon sessions terminated
• All persistence mechanisms removed from target
• All payloads removed from target systems
• Teamserver logs archived and encrypted
• VPS instances destroyed
• Domains released or parked
• IOC list provided to client

Emergency Procedures

Scenario	Action
Burned domain	Switch to backup redirector
Detected implant	Sleep beacon to 24h, assess exposure
Teamserver compromise	Kill all sessions, rotate infrastructure
Client emergency stop	Execute killall on all active Demons
Legal escalation	Contact [Legal Contact] at [phone]

Operator Communication

Channel	Purpose
Signal Group	Real-time coordination
Encrypted Email	Reports and documentation
Havoc Chat	In-tool session coordination
Emergency Phone	[Phone number] for critical issues