Havoc

Open-source post-exploitation command-and-control framework with a Go teamserver, C++/Qt operator client, and C/ASM Demon agent. The client supports GUI-based payload generation; Demon supports HTTP/HTTPS listeners, SMB named-pipe communication through a parent Demon, sleep and process/token operations, raw-shellcode injection, and .NET inline execution. The README lists a hardware-breakpoint AMSI/ETW patch capability; the archived documentation does not detail its internal implementation. The .NET inline-execute path separately creates a CLR in the Demon process and patches amsi.dll in memory. Framework deployment covers Linux/macOS; Demon is a Windows agent.