Let's get back to the Events view.
To do this,
you might need to click the back button two times just
because sometimes this view can get stuck.
As you can see, there's a lot of alerts here,
both from Wazuh and one from Suricata about the package being installed.
In summary, even though we're leveraging Merlin to execute a command,
the invocation of that command on the victim's host leaks
valuable information out of our C2 channel.
We want to avoid installing via package managers if possible.
Let's change our approach and use the Merlin upload command to
maintain stealth and keep us within the C2 channel.
Okay, on to the upload functionality.
The first parameter is the file we want to upload to the victim's machine.
As an aside,
linenum is a very popular recon script. On the Merlin server,
I've already placed linenum at this path,
and as you might expect,
the second parameter signifies the destination file path.
For stealth,
we'll use the systemd.conf path to make the script
look like a legitimate configuration.
After I run the command, I'm going to pause the video until it finishes.
Nice, we see everything was successful.
Okay, let's go back into Wazuh.
Okay, so I'm going to scroll up to the top here and refresh.
Wow, look at this, File added to the system.
Let's drill into this alert and see the actual log.
I'm going to click on this little triangle over here.
And as we go down, we see the full_log.
Oh, wow, File /etc/systemd.conf added Mode: realtime.
It looks like Wazuh saw the upload.
Wazuh, and many other intrusion detection systems,
monitor directories with sensitive files.
As you might expect,
the etc directory houses some pretty sensitive configurations.
To subvert this alert,
think of non‑sensitive directories that contain transient files.
In other words,
think of directories that would create a lot of false
positives for an intrusion detection system.
Okay, well, hmm, where should we put our recon script then?
A good example would be the tmp directory.
Let's give that a shot.
Okay, it appears to be a swp file for pid1.
So stealthy.
After I run the command,
I'm going to pause the tutorial while the command finishes.
Perfect, looks like everything was successful.
Let's continue our recon and execute the linenum script.
Now I'm going to pause the video until everything finishes.
Okay, awesome, looks like the script concluded.
Let's scroll up here a little bit and see if there's anything juicy.
Oh, whoa, tmp/database.bak.
Looks like the database backup was bound.
Okay, awesome!
We need to get this back onto the C2 server. So I'm
going to look at our help text here.
Oh, I see a download command, okay, sweet.
Nice, successfully downloaded the file, and there it is.
Note the path the backup was saved to.
So let's just take a step back and do a little recap.
We persisted our recon script in the tmp directory and did
exfiltration over the HTTP version 3 C2 channel.
Now, in an ideal world, we'd do our attacks in memory,
and we wouldn't save the recon script to disk.
However,
as you might expect, in‑memory attacks aren't always feasible. Before we end the
tutorial, let's see if Wazuh or Suricata saw these attacks.
Okay, so I'm just going to go scroll back up here and do a refresh.
So let's see if anything new came in. No,
it looks like we still see the last alert.
Wow, it looks like our tactics succeeded against the default
rule sets for Wazuh and Suricata. To note, this isn't a
negative reflection on these projects.
It is assumed that blue team operators will customize
these rules for their environment.