Skip to content

Working hours

infosec guy edited this page Mar 30, 2023 · 2 revisions

Havoc supports working hours, which you can set in two ways.

  1. via a command on the agent console: config workinghours 8:30-17:00 (can be changed as many times as desired)
  2. via the profile:
    Http {
        Name         = "foo"
        WorkingHours = "8:30-17:00"
        ...
    }

    Smb {
        Name         = "bar"
        WorkingHours = "8:30-17:00"
        ...
    }

Once set, the agent will only connect back to the teamserver when the time is within the working hours.

If the sleep time is set to 0 and the end of working hours is reached, then the agent will ignore the working hours and continue to operate normally.
This is to avoid interrupting an important task.

Importantly, the start and end time must be in 24 hours format and it will be interpreted as local to the compromised machine, meaning that is the timezone of the victim computer the one that matters, not the one belonging to the operator.

To disable working hours altogether, run: config workinghours 0

Clone this wiki locally