In this section.
We'll get your workstation ready for the attack simulation environment.
While Merlin has support for Mac and Windows,
in this course we'll be leveraging Kali Linux.
This should be an environment that is pretty familiar with red teams.
Specifically, we'll leverage Kali 2020.3.0.
If you're having issues with your environment, try switching to this version.
To make things easier,
I'm providing an install script to get you up and
running as quickly as possible.
To avoid any headaches,
I recommend running the script on a fresh install of Kali.
First, let's clone down the repo and CD into the repo's directory.
Okay, let's check out the script.
This script installs Docker, docker‑compose, the merlinServer, and Merlin agent.
Docker isn't mandatory for Merlin usage and similar with docker‑compose.
Let's scroll down here a little bit.
Oh, you know what, before I forget, the Merlin host directory at the top,
that is where Merlin is going to be installed into.
If you need, feel free to customize that.
And one other small item.
The sudo sysctl command,
that is just setting the virtual memory for the Elasticsearch container,
used by Wazuh.
Okay, we see the installation of the merlinServer, and that's pretty much it.
All right, let's get out of this script.
Let's go ahead and install the dependencies through that script.
(Working) Now we're done.
Note the paths for the Linux agent and the server,
and additionally, non‑Linux agents can be found within the bin directory.
In our Docker‑based attack environment,
the Merlin server and agent are already installed within the docker containers.
However,
I just wanted Merlin to be available outside the
containers so you could easily experiment.
Before we instantiate the simulation environment,
let's check out the agent's help text.
I suggest reviewing the various command line options.
In a real engagement, you should change the Pre‑shared Key.
For simplicity, we're just going to leverage the default argument in this case.
We are going to execute this command now,
but this should give you an understanding of how the agent is
being invoked within our simulation environment.
In general, the Merlin server should be online before trying to run the agents.
Let's discuss the command line flags.
The ‑‑url flag points to the Docker container of our Merlin server,
and the ‑‑proto flag allows us to declare HTTP version 3 as our protocol.
Luckily for stealth,
Merlin allows the command line flags to be compiled into the agent.
Instructions for doing this can be seen at course notes number 4.
You might be wondering, all right, Zach,
well, how do we configure the Merlin server or start it?
Well, that part can't be easily scripted.
So once we start up our simulation environment,
we'll go into the Merlin container and configure everything.