python script to monitor havoc c2 log file and send notification of new agent connections via ntfy

ntfy-havoc.py

import os
import time
import re
import requests

# Tested / works on Havoc version 0.7 (Bites The Dust)

# Path to havoc log file
log_file_path = 'teamserver.log'

# Regex pattern to match the specified log entry
pattern = re.compile(
    r"\[\d{2}:\d{2}:\d{2}\] \[DBUG\] \[agent\.ParseDemonRegisterRequest:\d+\]:\s*"
    r"Hostname: .*\s*"
    r"Username: .*",
    re.MULTILINE
)

def send_alert(message):
    url = "https://<domain>/<subscription>"
    data = message
    headers = {
        "Title": "New Agent Connected",
        "Tags": "partying_face",
        "Authorization": "Bearer <yourtokenhere>",
    }
    response = requests.post(url, data=data, headers=headers)
    if response.status_code == 200:
        print("Ntfy sent successfully")
    else:
        print(f"Failed to send ntfy: {response.status_code}, {response.text}")

def monitor_havoc_log():
    file_position = 0
    
    while True:
        try:
            with open(log_file_path, 'r') as file:
                file.seek(file_position)
                lines = file.read()
                file_position = file.tell()

                if lines:
                    match = pattern.search(lines)
                    if match:
                        # debugging
                        # print(f"Found the matching log entry:\n{match.group()}")
                        send_alert("Havoc has a new agent.. hack the planet!")
            
        except FileNotFoundError:
            print(f"The log file {log_file_path} does not exist.")
        
        # Wait for 60 seconds before checking again
        time.sleep(60)

if __name__ == "__main__":
    monitor_havoc_log()