RedTeamOps-Havoc-101 - Materials for the workshop "Red Team Ops: Havoc 10

项目说明

Red Team Ops: Havoc 101

Learn how to compromise an Acti Infrastructure by simulating ad Tactics, Techniques and Procedures (TTPs) using Ha.

Agenda

Chapter 1: Intro to C2

1. Basic Functionalities of Havoc
2. Malleable C2 Profile
3. C2 Infrastructure Design

Chapter 2: OPSEC & E

1. Built-In E Mechanism of Havoc
2. A (Custom Injector)
3. EDR Bypass
4. Post-Exploitation Defense E

Chapter 3: Acti

> Blogpost by
1. Local Pri Escalation
2. Kerberos Attacks
3. Lateral Mo
4. Pi

Lab Setup

| Machine | Username | Password | RAM | Storage | Note | Used In (Chapter) | Download Link |
|---------------------|:-------------:|:------------:|:-------:|:-----------:|:--------------:|:---------------------:|:-----------------:|
| Attacker Linux | havoc | havoc | 4 GB | 18 GB | Semi-Mandatory | 1, 2, 3 | OneDrive |
| Attacker Windows | Havoc | havoc | 4 GB | 25 GB | Mandatory | 1, 2 | OneDrive |
| Redirector | redirector | havoc | 1 GB | 5 GB | Optional | 1, 2 | OneDrive |
| Domain Controller | - | - | 2 GB | 15 GB | Mandatory | 3 | OneDrive |
| Workstation 1 | - | - | 1 GB | 15 GB | Mandatory | 3 | OneDrive |
| Workstation 2 | - | - | 1 GB | 15 GB | Mandatory | 3 | OneDrive |

Chapter 1: Intro to C2

C2 Malleable Profile

C2 Infrastructure Design


#### [[Redirector]]() [[Stager]]()

Chapter 2: OPSEC & E

Runner

Runner is the 1st out of 5 Proof-of-Concept Process Injectors that takes an arbitrary shellcode from a remote URL and perform shellcode injection on a sacrificial process notepad.exe using Win32 API calls. It also supports Parent Process ID (PPID) Spoofing, allowing the sacrificial process to spawn under an arbitrary process using it's PID. If the target -t, --target is not specified, it will perform self-injection instead.

OPSEC Tips: Allocating RWX region is a major outlier for detection as programs will rarely ha region of RWX. Always allocate RW then flip it to RX.

Stalker

Stalker is a Proof-of-Concept loader for code injection using NT\*API calls to defeat Kernel32 API Monitoring. All Win32 APIs are mapped to the respective NT level API as follows:
| Win32 API | NT\*API |
|--------------------|--------------------------------------------------------------|
| | NtAllocate |
| WriteProcessMemory | NtWrite |
| | NtProtect |
| CreateRemoteThread | NtCreateThreadEx |

SylantStrike

Home-made Endpoint Detection & Response (EDR) to hook NT*API calls. The hooking logic is not implemented perfectly and has a high chance of false positive. Use only for demonstrating EDR bypass. (Credit to )

Clicker

Clicker is a wrapper used to side-load Stalker for demonstrating Process Mitigation Policy. This technique prevents security from reflectively loading EDR DLLs that are not digitally signed by Microsoft. As a result, kernel32.dll and ntdll.dll of newly spawned processes will not be hooked by EDR unless they ha Certificates handed out by Microsoft.

Bloater

Bloater is the successor of Stalker as it uses the same boilerplate to perform process injection. At runtime, a fresh copy of ntdll.dll is loaded into the process. The original ntdll.dll that was hooked by EDR is left untouched. All NT*API are exported and called from the clean copy of ntdll.dll instead. This EDR e method is especially effecti the integrity of EDR hooks are not tampered with.

RatKing

RatKing is an adapted of Bloater on steroids, written in Rust. The intention is to make Reverse Engineering significantly harder.

NOTE: RatKing does not support HTTPS payload download and PPID spoofing. Additionally, target process has to be opened manually prior to running RatKing. --target must be exact match.
`.
-.._ | | _..-'
\ , ,' /
'= ,/ \, =
'= ( ) =
.\ / \ /.
/ ,.' .,' \
\ . ,' /
\ \ / /
\ .. __.---. ,. /
\.' .'` . ./
\.' -'''-.. ./
/ / '. \
/ / .-- .-''' '.
' | ,---. _ \
/-----._.-. \ / ,-. '-' '. .-._.-----\
\__ . | : .' ((O)) ,-. \ : | . __/
. '-...\_ | '-' ((O)) | '_/...- .'
.----..) \ \ / '-' / / ' (..----.
(o . / \ \ /\ .' / \ .' o)

-. . /. . .' .'\ .' .-'
.. / .' - - - ' .' \ '..'
/ / \ \
/ ,' . \
\ ,'. .'. /
/ \ / \'
,= ( ) =,
,= '\ / =,
RatKing / .' . \
.-''' | |

Chapter 3: Acti

> Before we start, please ensure the Automatic Sample Submission in Windows Defender AV is disabled and Real-Time Protection is up and running.

Acti Network Diagram

!image

Acti Network Addresses

1. DC01
- Secure Network
- Static IPv4: 10.10.101.131
- Subnet Mask: 255.255.255.0
- Default Gateway: 10.10.101.1
- Preferred DNS: 127.0.0.1
- Alternate DNS: 8.8.8.8

2. WORKSTATION-01
- External Network
- Dynamic IPv4: 192.168.25.xxx (DHCP will assign)
- Subnet Mask: auto-assigned
- Default Gateway: auto-assigned
- Preferred DNS: auto-assigned
- Alternate DNS: auto-assigned

- Internal Network
- Static IPv4: 10.10.100.128
- Subnet Mask: 255.255.255.0
- Default Gateway:
- Preferred DNS: 10.10.100.129
- Alternate DNS: 8.8.8.8

- Secure Network
- Static IPv4: 10.10.101.129
- Subnet Mask: 255.255.255.0
- Default Gateway: 10.10.101.1
- Preferred DNS: 10.10.101.131
- Alternate DNS: 8.8.8.8

3. WORKSTATION-02
- Internal Network
- Static IPv4: 10.10.100.129
- Subnet Mask: 255.255.255.0
- Default Gateway:
- Preferred DNS: 10.10.100.128
- Alternate DNS: 8.8.8.8

- Secure Network
- Static IPv4: 10.10.101.132
- Subnet Mask: 255.255.255.0
- Default Gateway: 10.10.101.1
- Preferred DNS: 10.10.101.131
- Alternate DNS: 8.8.8.8

Acti Users and Computers

| First Name | Last Name | Username | Password | Group | In |
|----------------|---------------|--------------|----------------------|----------------------------------|---|
| | | administrator| P@$$w0rd! | Domain Admins | * |
| Aaron | Adams | a.adams | C0nc0Rd1776! | Senior Management, Domain Admins | |
| Jonathan | Taylor | j.taylor | Lexington1776! | IT Admins, Administrators | |
| Jillian | Anthony | j.anthony | H1dD3n! | Engineering | |
| Tabitha | Carter | t.carter | AhArGuY5Nm7U3!@ | Engineering | |
| Megan | Phillips | m.phillips | L4k3Li! | Engineering, Group Policy Creator Owners | |
| Richard | Smith | r.smith | Baseball123! | Engineering | |
| Samantha | Chisholm | s.chisholm | FallOutBoy1! | Sales | * |
| Margaret | Seitz | m.seitz | Phi11i35@44 | Engineering | * |
| Aaron | Tarolli | a.tarolli | Password123! | Sales | * |
| Zane | Dickens | z.dickens | M0t0rH3Ad65^$# | Sales | |

| Machines | Local Admin | Domain Users |
|----------------------------|--------------|--------------------|
| WORKSTATION-01.ha | s.chisholm | m.seitz, a.tarolli |
| WORKSTATION-02.ha | m.seitz | |
| DC01.ha | administrator| |

Acti Flag Details

Flag Format: HAVOC{MD5}

Flag Amount: 3

Flag Location: \\COMPUTER-NAME\C$\Users\localadmin-or-administrator\Desktop\flag.txt

项目信息

开发语言：C#

Star 数：402

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Materials for the workshop "Red Team Ops: Havoc 101"展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。