Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
An introductory blog post can be found here: https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a
- Download the latest compiled version of Merlin Server from the releases section
- Extract the files with 7zip using the
xfunction. The password is:merlin - Start Merlin
- Deploy an agent. See Agent Execution Quick Start Guide for examples
- Pwn, Pivot, Profit
mkdir /opt/merlin;cd /opt/merlin
wget https://github.com/Ne0nd0g/merlin/releases/download/v0.1.4/merlinServer-Linux-x64-v0.1.4.7z
7z x merlinServer-Linux-x64-v0.1.4.7z
sudo ./merlinServer-Linux-x64
- The latest development build of Merlin can be downloaded from AppVeyor
- To compile Merlin from source, view the Building or Running from Source wiki page
- For a full list of available commands view the Main Menu, Agent Menu, and Module Menu wiki pages
- View the FAQ wiki page for Frequently Asked Questions
- View the Blog Posts page for additional information
./merlinServer-Linux-x64 -h
Version: 0.8.0.BETA
Build: nonRelease
-debug
Enable debug output
-i string
The IP address of the interface to bind to (default "127.0.0.1")
-p int
Merlin Server Port (default 443)
-proto string
Protocol for the agent to connect with [h2, hq] (default "h2")
-psk string
Pre-Shared Key used to encrypt initial communications (default "merlin")
-v Enable verbose output
-x509cert string
The x509 certificate for the HTTPS listener (default "/opt/merlin/data/x509/server.crt")
-x509key string
The x509 certificate key for the HTTPS listener (default "/opt/merlin/data/x509/server.key")
./merlinAgent-Linux-x64 -h
Merlin Agent
-debug
Enable debug output
-proto string
Protocol for the agent to connect with [h2, hq] (default "h2")
-psk string
Pre-Shared Key used to encrypt initial communications (default "merlin")
-sleep duration
Time for agent to sleep (default 30s)
-url string
Full URL for agent to connect to (default "https://127.0.0.1:443")
-v Enable verbose output
-version
Print the agent version and exit
Join the #merlin channel in the BloodHoundGang Slack to chat about Merlin