Skip to content

Communication protocol

infosec guy edited this page Mar 25, 2023 · 1 revision

The teamserver and the Havoc agent communicate with each other by sending raw binary data.

Each packet is composed of a header:

 Header:
    [ SIZE         ] 4 bytes
    [ Magic Value  ] 4 bytes
    [ Agent ID     ] 4 bytes
    [ Request ID   ] 4 bytes
    [ COMMAND ID   ] 4 bytes

 Packed data:
    ... (depends on the COMMAND ID)

The SIZE is the size of the entire packet.
The Magic Value is set to 0xdeadbeef.
The Agent ID is a 32 bit value that is randomly generated by the agent when it starts. It uniquely identifies each agent.
The Request ID is a random 32 bit value generated by the teamserver every time the operator enters a command. This value is sent to the agent, which sends it back together with the task result. The teamserver then checks that the RequestID is valid and parses the task response.

There are some tasks (like the dotnet inline-execute module) that send several messages to the teamserver, all with the same Request ID. The teamserver generates the RequestID when the operator enters the command and removes it when the dotnet program has completed its execution.

Clone this wiki locally