Merlin v0.10 Beta releases: cross-platform post-exploitation HTTP/2 Command & Control server and agent
Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
An introductory blog post can be found here.
Evade network detection during a penetration test/red team exercise by using a protocol that existing tools aren’t equipped to understand or inspect. Merlin is post-exploitation tool that is easily cross-compiled to run on any platform to achieve command and control of a host.
HTTP/2 is a newly ratified protocol documented under RFC 7540 that aims to solve some of the problems with HTTP/1.x and provide functionality to support current web application operations. HTTP/2 communications are multiplexed, bi-direction connections that do not end after one request and response. Additionally, HTTP/2 is a binary protocol that makes it more compact, easy to parse, and not human readable without the use of an interpreting tool.
An HTTP/2 connection can be setup by upgrading a HTTP/1.x connection using the `Upgrade` header or during the negotiation of a TLS encrypted channel. Application-Layer Protocol Negotiation (ALPN) is a TLS 1.2 extension that is required to setup a HTTP/2 connection identified with the `h2` protocol string. TLS versions less than 1.2 are not equipped to negotiate a HTTP/2 connection. Oddly enough, the client will perform one final check to ensure that the server can speak HTTP/2 by sending the string PRISM. This reminds me of the NSA PRISM program.
Encryption
The HTTP/2 RFC also requires the use of Perfect Forward Secrecy (PFS) cipher suites and recommends that all non-PFS-enable cipher suites are black listed. The RFC reads: “An HTTP/2 implementation MAY treat the negotiation of any of the following cipher suites with TLS 1.2 as a connection error of type INADEQUATE_SECURITY”. The list of adequate cipher suites are comprised of Elliptic Curve Diffie-Helman Exchange (ECDHE) and ephemeral Diffie-Helman Exchange (DHE) key exchange methods that benefit from PFS. When PFS cipher suites are used, captured traffic cannot be decrypted using only the server’s private key. In order to decrypt the traffic, the client’s session keying information is required. If you don’t control the client or you’re not using a client built on the NSS library (i.e. Firefox or cURL), this information can be hard to obtain.
Evasion
HTTP/2 communications are expected to take place over TLS encrypted channels using PFS enabled cipher suites. Therefore, inspecting HTTP/2 traffic proves difficult. Another obstacle is that currently available WAF/IDS/IPS solutions are incapable of understanding the HTTP/2 protocol even if they were able to decrypt traffic for inspection. This combination of encryption and the lack of protocol support from inspecting tools, provide a great opportunity to evade inspection. Some possible solutions are to terminate HTTP/2 connections and downgrade them to HTTP/1.1, but that would remove all of the efficiencies gained with using HTTP/2. Additional options include downgrading the encryption to a non-PFS enable cipher suite or use a terminating proxy.
You can find additional information on HTTP/2 in a paper I wrote titled Practical Approach to Detecting and Preventing Web Application Attacks over HTTP/2.
Changelog v0.10 Beta
Added
- Added
windows/x64/go/exec/createProcess
extended module with redirected STDOUT/STDERR over anonymous pipes- Added
windows/x64/go/exec/donut
extended module that leveraged go-dounut- Added
windows/x64/csharp/misc/SharpGen
extended module that leverages SharpGen
- Requires .NET Core 2.1 SDK to be manually installed by the operator
- Added
execute-assembly
,execute-pe
, andsharpgen
commands to Agent menu- Added
ExecuteAssembly
,ExecutePE
, andSharpGen
functions to Agent API- New Jobs structure so that multiple jobs and results can be sent between client and server during a single interaction
- Job processing checks to ensure returned results have a valid request token and had not previously completed
- Created constants for message types for easier comparison and switching
- Added a new
jobs
command to view created and sent jobs- Added a new
clear
command to remove any jobs that have not been sent to the agent- Added
killdate
,maxretry
,useragent
,padding
,skew
to Merlin Agent command line arguments and Makefile- Added checks to OPAQUE handling to ensure resiliency if server is not available or has an error during registration
- Added Makefile
agent-windows-debug
build target to enable viewing verbose and debug messages- Added Mythic client so Merlin agent can be used with the Mythic Framework
Changes
- All commands typed into the
Merlin»
are immediately parsed with go-shellwords- Removed
go-shellwords
processing from Agent API functions CD, Download, Upload, and LS- Modified agent structure to contain an input and out job channel
- Changed Agent go routine from messageHandler to function that continuously checks the job channel
- Job results are returned when the agent checks in again, not immediately after executed
- Moved OPAQUE functions to its own package at
pkg/opaque
- Reduced base message payload types to just opaque, jobs, and checkin; Jobs payload now contains all other types
- Removed argument parsing from Agent’s exec command. All parsing is done server side before being sent to the agent
- Removed RSA key exchange since it wasn’t being used for anything
- Moved functions that output tables to the agent API that returns rows; CLI package prints them
- Removed CLI completer functions from
pkg/agents
and implemented functionality in agent API and CLI package- Restructured Merlin Agent code into multiple go files
- Created generic MerlinClient interface to facilitate using different protocols
- Changed HTTP server timeout from 10 seconds to 30 seconds
- Changed the
shell
command to actually use the operating system’s default shell- Changed the old
cmd
&shell
commands to just therun
which executes the program directly without a shellRemoved
- Removed the
cmd
command from the Agents menu
Getting Started
The quickest and easiest way to start using Merlin is to download the pre-compiled binary files found in the Releases section. The files are compressed into 7z archives and are password protected to prevent Anti-Virus inspection when downloading. The password is merlin.
Install GO
In order to run Merlin from source, or to compile Merlin yourself, the Go programing language must be installed on the system. However, if you just want to run a pre-compiled version, you do not need to install Go.
Download and install GO: https://golang.org/doc/install
Ensure your GOPATH environment variable is set
Running Merlin Server
Merlin Server can be run as a script or compiled and run as a standalone binary file.
It is recommended to download the compiled binaries from the Releases section
Run Merlin Server as a script:
git clone https://github.com/Ne0nd0g/merlin/ go run cmd/merlinserver/main.go
Compile Merlin Server into an executable:
make server-windows or make server-linux or make server-darwin
Merlin Server Usage
Merlin Server Commands
Merlin is equipped with a tab completion system that can be used to see what commands are available at any given time. Hit double tab to get a list of all available commands.
exit Exit and close Merlin help Show Merlin help menu quit Exit and close Merlin ? Show Merlin help menu
Agent Commands
These are the commands to control an agent from the server. Tab completion can be used to select an Agent’s identifier.
agent cmd <agent id> <command> A command to run on a remote agent
agent control <agent id> <command> Configure/Control a remote agent (not the host)
[kill,sleep,padding,maxretry]agent info <agent id> Display all information for an agent
agent list List agents
TLS Certificates
By default, Merlin will load server.crt and server.key from the data/x509/ directory. You must generate your own certificate pair and place them in this directory.
Third Party Libraries
The 3rd party libraries used with Merlin are kept in the vendor directory. This project will default to using the library files in that folder.
Running Merlin Agent
The agent portion of Merlin should be run as a compiled binary file on a target host.
It is recommended to download the compiled binaries from the Releases section
Ensure your GOPATH environment variable is set!
Compile Merlin Agent into an executable
make agent-windows or make agent-linux or make agent-darwin
Merlin Agent can also be compiled without Make, using just go. To compile Merlin Agent with your hard-coded Merlin Server’s address, so it doesn’t have to specify on the command line, including -ldflags -X main.URL=https://acme.com:443/
Example: go build -o merlinagent.exe -ldflags “-X main.URL=https://acme.com:443/” cmd/merlinagent/main.go
Run Merlin Agent as a script: go run cmd/merlinagent/main.go
USAGE
Copyright (C) 2017 Ne0nd0g
Source: https://github.com/Ne0nd0g