Hi, My name is Zach Roof,
and welcome to this cybersecurity course featuring Merlin.
Merriam‑Webster defines Merlin as a prophet and a magician.
Dang, that just sounds like a combination of epic proportions.
And that leaves us wondering, if Merlin is a prophet,
who is the security prophet behind this tool?
Hmm.
Merlin was created by Russel Van Tuyl, also known as Ne0nd0g on GitHub.
I wanted to take a moment to thank Russel for his
contributions to the security community.
At the end of this course, you will find a link to Russel's additional content,
including his blog posts.
If you're anything like me,
you'll find his content to be thoroughly researched and just overall awesome.
This quote by Russel on the screen helps us witness part
of his motivation for creating Merlin.
"Evade network detection during a penetration test/red team
exercise by using a protocol that existing tools aren't equipped to
understand or inspect." In the next slide,
we'll dive into this a little bit deeper and get a
high‑level overview as well of Merlin.
Merlin is a C2 framework written in Golang, or simply Go.
In fact, Russel originally started this project so we could learn more about Go.
Gee, I wish my first project in a new programming language was this amazing,
but I digress.
A unique advantage of Go is the cross‑compilation amongst various platforms.
Given this, Merlin is available for Mac, Windows, and Linux.
Additionally, outside of the Go context, a JavaScript agent is available.
All right, a little housekeeping before we proceed.
Here is the location of the repo we're going to be using throughout this course.
If you go to the link, you'll see the course notes,
which I'll start referencing in the next bullet point.
All right, let's continue.
Merlin's readthedocs site is very informative,
and you'll find all the information you need to start
leveraging the agents and server.
This link can be seen at course notes number 1.
If you're curious to see the source, head over to the GitHub link.
This is referenced in course notes number 2.
The protocols that Merlin supports are definitely unique,
offering a C2 channel over HTTP, HTTP version 2, and HTTP version 3.
In this course we'll be using HTTP version 3,
and we'll explore this some more in the next section.
So,
before we even get to looking at all the versions
of HTTP and some of the nuances, you might be wondering,
where does Merlin land within the kill chain?
Simply install the Merlin agent,
also known as the implant, on the compromised device,
and control the device through the Merlin C2 server.
Post‑exploitation, Merlin provides opportunities for escalation,
lateral movement, evasion, and action.
Most of these topics will be covered in this course.
Okay, now that we've seen the kill chain, how does Merlin fit into MITRE?
Given the broad nature of attacks that can be mounted within a C2 framework,
MITRE coverage for Merlin is going to be quite broad.
In this course,
we will focus on a few specific tactics and techniques. Similar to many C2
frameworks, Merlin has the ability for ingress tool transfer.
In this course,
we will use Merlin's upload functionality to plant a recon script on the
victim's machine. As far as web protocols, Merlin's support for HTTP, HTTP
version 2, and HTTP version 3 is pretty novel.
In this course,
we will be leveraging the latest incarnation of HTTP, also known as HTTP version
3. Perhaps one of the most novel features of HTTP version 3 is the ability to
maintain a valid connection while changing IPs, or even ports. This capability
is huge for C2 services, as implants can change Wi‑Fi networks without losing
connectivity to the C2 server.
Okay, let's move on to exfiltration.
A C2 framework is useless without the ability to
exfiltrate data. In our simulation environment, we'll
steal a database backup from the victim,
and after witnessing this process,
you'll see how Merlin just makes this a breeze.