WEBVTT 00:00:01.040 --> 00:00:02.790 Hi, My name is Zach Roof, 00:00:02.800 --> 00:00:05.870 and welcome to this cybersecurity course featuring Merlin. 00:00:07.740 --> 00:00:12.030 Merriam‑Webster defines Merlin as a prophet and a magician. 00:00:12.040 --> 00:00:16.350 Dang, that just sounds like a combination of epic proportions. 00:00:17.240 --> 00:00:20.470 And that leaves us wondering, if Merlin is a prophet, 00:00:20.470 --> 00:00:23.670 who is the security prophet behind this tool? 00:00:24.340 --> 00:00:26.160 Hmm. 00:00:26.160 --> 00:00:32.240 Merlin was created by Russel Van Tuyl, also known as Ne0nd0g on GitHub. 00:00:32.250 --> 00:00:34.710 I wanted to take a moment to thank Russel for his 00:00:34.710 --> 00:00:37.060 contributions to the security community. 00:00:37.940 --> 00:00:41.560 At the end of this course, you will find a link to Russel's additional content, 00:00:41.600 --> 00:00:43.020 including his blog posts. 00:00:43.260 --> 00:00:44.560 If you're anything like me, 00:00:44.670 --> 00:00:49.370 you'll find his content to be thoroughly researched and just overall awesome. 00:00:50.240 --> 00:00:53.540 This quote by Russel on the screen helps us witness part 00:00:53.550 --> 00:00:55.550 of his motivation for creating Merlin. 00:00:56.840 --> 00:01:00.550 "Evade network detection during a penetration test/red team 00:01:00.560 --> 00:01:05.120 exercise by using a protocol that existing tools aren't equipped to 00:01:05.120 --> 00:01:09.150 understand or inspect." In the next slide, 00:01:09.160 --> 00:01:11.430 we'll dive into this a little bit deeper and get a 00:01:11.430 --> 00:01:14.160 high‑level overview as well of Merlin. 00:01:19.140 --> 00:01:22.650 Merlin is a C2 framework written in Golang, or simply Go. 00:01:23.140 --> 00:01:27.840 In fact, Russel originally started this project so we could learn more about Go. 00:01:27.850 --> 00:01:33.160 Gee, I wish my first project in a new programming language was this amazing, 00:01:33.640 --> 00:01:35.320 but I digress. 00:01:35.320 --> 00:01:40.670 A unique advantage of Go is the cross‑compilation amongst various platforms. 00:01:41.040 --> 00:01:45.270 Given this, Merlin is available for Mac, Windows, and Linux. 00:01:45.640 --> 00:01:49.750 Additionally, outside of the Go context, a JavaScript agent is available. 00:01:51.240 --> 00:01:54.150 All right, a little housekeeping before we proceed. 00:01:54.940 --> 00:01:58.860 Here is the location of the repo we're going to be using throughout this course. 00:01:59.160 --> 00:02:01.590 If you go to the link, you'll see the course notes, 00:02:01.600 --> 00:02:03.970 which I'll start referencing in the next bullet point. 00:02:04.340 --> 00:02:05.950 All right, let's continue. 00:02:08.039 --> 00:02:10.590 Merlin's readthedocs site is very informative, 00:02:10.710 --> 00:02:12.980 and you'll find all the information you need to start 00:02:12.980 --> 00:02:14.850 leveraging the agents and server. 00:02:15.240 --> 00:02:17.970 This link can be seen at course notes number 1. 00:02:20.040 --> 00:02:23.390 If you're curious to see the source, head over to the GitHub link. 00:02:23.390 --> 00:02:26.070 This is referenced in course notes number 2. 00:02:28.240 --> 00:02:31.740 The protocols that Merlin supports are definitely unique, 00:02:31.740 --> 00:02:39.210 offering a C2 channel over HTTP, HTTP version 2, and HTTP version 3. 00:02:39.210 --> 00:02:43.060 In this course we'll be using HTTP version 3, 00:02:43.540 --> 00:02:46.270 and we'll explore this some more in the next section. 00:02:48.940 --> 00:02:49.500 So, 00:02:49.500 --> 00:02:53.090 before we even get to looking at all the versions 00:02:53.090 --> 00:02:56.570 of HTTP and some of the nuances, you might be wondering, 00:02:56.790 --> 00:02:58.960 where does Merlin land within the kill chain? 00:03:00.540 --> 00:03:02.440 Simply install the Merlin agent, 00:03:02.450 --> 00:03:05.560 also known as the implant, on the compromised device, 00:03:05.570 --> 00:03:08.250 and control the device through the Merlin C2 server. 00:03:09.940 --> 00:03:14.010 Post‑exploitation, Merlin provides opportunities for escalation, 00:03:14.160 --> 00:03:17.060 lateral movement, evasion, and action. 00:03:17.540 --> 00:03:19.760 Most of these topics will be covered in this course. 00:03:20.240 --> 00:03:24.770 Okay, now that we've seen the kill chain, how does Merlin fit into MITRE? 00:03:27.440 --> 00:03:31.330 Given the broad nature of attacks that can be mounted within a C2 framework, 00:03:31.480 --> 00:03:34.160 MITRE coverage for Merlin is going to be quite broad. 00:03:35.540 --> 00:03:36.240 In this course, 00:03:36.240 --> 00:03:42.970 we will focus on a few specific tactics and techniques. Similar to many C2 00:03:42.970 --> 00:03:46.360 frameworks, Merlin has the ability for ingress tool transfer. 00:03:46.840 --> 00:03:47.610 In this course, 00:03:47.620 --> 00:03:51.690 we will use Merlin's upload functionality to plant a recon script on the 00:03:51.690 --> 00:04:00.100 victim's machine. As far as web protocols, Merlin's support for HTTP, HTTP 00:04:00.100 --> 00:04:04.650 version 2, and HTTP version 3 is pretty novel. 00:04:05.340 --> 00:04:06.140 In this course, 00:04:06.140 --> 00:04:11.920 we will be leveraging the latest incarnation of HTTP, also known as HTTP version 00:04:11.920 --> 00:04:17.959 3. Perhaps one of the most novel features of HTTP version 3 is the ability to 00:04:17.959 --> 00:04:23.640 maintain a valid connection while changing IPs, or even ports. This capability 00:04:23.640 --> 00:04:28.870 is huge for C2 services, as implants can change Wi‑Fi networks without losing 00:04:28.870 --> 00:04:30.770 connectivity to the C2 server. 00:04:31.440 --> 00:04:33.870 Okay, let's move on to exfiltration. 00:04:35.240 --> 00:04:37.830 A C2 framework is useless without the ability to 00:04:37.840 --> 00:04:41.110 exfiltrate data. In our simulation environment, we'll 00:04:41.110 --> 00:04:43.160 steal a database backup from the victim, 00:04:43.840 --> 00:04:45.640 and after witnessing this process, 00:04:45.650 --> 00:04:47.950 you'll see how Merlin just makes this a breeze.