Now it's time to start our simulation environment.
This command might take a little while to run,
so I'm going to pause the video after the command is executed.
All right,
let's go ahead and the hop into the Merlin Server
container so we can configure Merlin.
Okay, lets start Merlin.
Dang, that's a nice little hat.
That Russell, he thinks of everything.
Okay, to start our exploration of Merlin, let's use the help functionality.
In our first step,
we need to create a listener so our agent can connect to the Merlin Server.
Perfect.
We see that Merlin has a listeners command.
Let's use it.
Notice how the command prompt has changed.
Okay, let's see now what options are available.
As previously stated, we're going to use HTTP version 3.
Let's check out the help text now.
(Loading) Okay, further,
let's look at the info command to see what configuration
options are available for the listener.
As we spoke about before, you'd want to change the pre‑shared key,
also known as the PSK, in a real engagement.
For stealth,
you'd also want to update the X509 fields to add a
custom certificate that isn't self‑sign.
Please see notes number 5 for more context.
For us, we want our server to listen to all network interfaces,
not just the loopback interface.
In your engagements, you'll likely want to change this option as well.
But how do we modify these values that we're seeing here?
That's where the set command comes in.
All right, now, we start the listener.
(Loading) Perfect.
There's the connection.
As a reminder, when you run Merlin within a red team exercise,
you'd want to start the server before distributing the agents.
In the simulation environment,
I have a script that invokes the agent once the listener is instantiated.
As you might recall, in a previous section,
we went over how the agent is invoked.
If you want to see the exact script that invokes the agent,
please check out course notes number 6.
Before we proceed with our attack,
let's log into the Wazuh server so we can check on the alert status.