Profiles

The Havoc Yaotl configuration language is a configuration file that contains everything that the teamserver needs to run. Yaotl is a fork of the popular configuration language HCL.

Syntax

A small introduction to the Yaotl language syntax.

Yaotl Block:

Block-Name {
    // content here
}

Yaotl Block with label:

Block-Name "label" {
    // content here
}

Yaotl string:

example = "string here"

Yaotl integer:

example = 1234

Yaotl float:

example = 13.23

Yaotl arrays:

array-string = [
    "string",
    "string2"
]

array-int = [
    1,
    2,
    3
]

Example block with different types and values:

my-block "test-label" {
    val-int = 1234
    val-str = "hello world"

    sub-block {

        array-str = [
            "i like cats",
            "and dogs"
        ]

    }

    array-int = [
        400,
        401
    ]
}

The Teamserver block

The Teamserver block holds the necessary information to bind the teamserver on a host and port where it is going to listen and accept client connections.

Both Host and Port are required to be specified. Those values are going to be used to listen to and accept incoming client connections. Example:

Teamserver {
	Host = "0.0.0.0"
	Port = 40056
}

The Teamserver block also has a sub block called Build where you can specify the compiler to use for compiling C and assembly files. If this block is not specified then the teamserver is going to search and use the Available mingw cross compiler (x86_64-w64-mingw32-gcc and i686-w64-mingw32-gcc). If the teamserver doesn't find the mingw/nasm compiler on the system and from the profile then it's going to exit.

Example:

Teamserver {
	Host = "0.0.0.0"
	Port = 40056

	Build {
		Compiler64 = "/usr/bin/x86_64-w64-mingw32-gcc"
		Compiler86 = "/usr/bin/i686-w64-mingw32-gcc"
		Nasm 	   = "/usr/bin/nasm"
	}
}

The Operators block

The Operators block specifies the users that are going to be allowed to connect and interact with the teamserver. To add a new user you only need to specify the username and password. Example User Block:

user "MyUsername" {
	password = "MyPassword" 
}

Example Operator Block:

Operators {
	user "5pider" {
		Password = "password1234"
	}

	user "Neo" {
		Password = "password1234"
	}
}

The Listeners block

The Listeners block allows the operator to start a listener without doing it manually in the client interface.

This block has the following sub-blocks Http and Smb that allows starting a listener with the desired protocol.

The Http block allows configuring and starting an HTTP/HTTPS listener. The following fields can be configured.

Available options for the HostRotation field:

Available fields/values for the Cert block:

Available fields/values for the Proxy block:

Available fields/values for the Response block:

Example Http/s listener configuration:

Listeners {
    Http {
        Name         = "Agent Listener - HTTP/s"
        #KillDate     = "2006-01-02 15:04:05" 
        #WorkingHours = "8:00-17:00"
        Hosts        = [
            "5pider.dev", 
            "havocframework.com:8080"
        ]
        HostBind     = "0.0.0.0"
        PortBind     = 443
        PortConn     = 443
        HostRotation = "round-robin"
        Secure       = true
        UserAgent    = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36"

        Uris = [
            "/funny_cat.gif",
            "/index.php",
            "/test.txt",
            "/helloworld.js"
        ]

        Headers = [
            "Content-type: text/plain",
            "X-Havoc: true",
            "X-Havoc-Agent: Demon",
        ]

        Response {
            Headers = [
                "Content-type: text/plain",
                "X-IsHavocFramework: true",
            ]
        }
    }
}

The Demon block

The Demon block specifies the default behavior of the havoc demon agent.

Available fields/values for the Injection block:

Example:

Demon {
    Sleep = 2
    Jitter = 50
    TrustXForwardedFor = false

    Injection {
        Spawn64 = "C:\\Windows\\System32\\Werfault.exe"
        Spawn32 = "C:\\Windows\\System32\\Werfault.exe"
    }
}

Available fields/values for the Binary block:

Example:

Demon {
    Sleep = 2
    Jitter = 50
    TrustXForwardedFor = false

    Binary {
        ReplaceStrings-x64 = {
            "demon.x64.dll": "",
            "This program cannot be run in DOS mode.": "",
        }

        ReplaceStrings-x86 = {
            "demon.x86.dll": "",
            "This program cannot be run in DOS mode.": "",
        }
    }
}

The Service block

The Service block lets you configure the service API endpoint and password.

The Webhook block

The Webhook block allows you to set where to send and log the initialized agent metadata.

Available fields/values for the Discord block: