WEBVTT

00:00:01.740 --> 00:00:02.530
In this section.

00:00:02.530 --> 00:00:06.160
We'll get your workstation ready for the attack simulation environment.

00:00:06.160 --> 00:00:09.180
While Merlin has support for Mac and Windows,

00:00:09.370 --> 00:00:11.870
in this course we'll be leveraging Kali Linux.

00:00:12.840 --> 00:00:17.010
This should be an environment that is pretty familiar with red teams.

00:00:17.010 --> 00:00:21.860
Specifically, we'll leverage Kali 2020.3.0.

00:00:22.440 --> 00:00:25.860
If you're having issues with your environment, try switching to this version.

00:00:27.840 --> 00:00:28.930
To make things easier,

00:00:28.940 --> 00:00:31.100
I'm providing an install script to get you up and

00:00:31.100 --> 00:00:32.670
running as quickly as possible.

00:00:33.440 --> 00:00:34.600
To avoid any headaches,

00:00:34.610 --> 00:00:37.760
I recommend running the script on a fresh install of Kali.

00:00:41.040 --> 00:00:44.850
First, let's clone down the repo and CD into the repo's directory.

00:00:49.140 --> 00:00:51.050
Okay, let's check out the script.

00:00:55.140 --> 00:00:59.970
This script installs Docker, docker‑compose, the merlinServer, and Merlin agent.

00:01:00.440 --> 00:01:05.770
Docker isn't mandatory for Merlin usage and similar with docker‑compose.

00:01:06.540 --> 00:01:08.550
Let's scroll down here a little bit.

00:01:09.440 --> 00:01:13.620
Oh, you know what, before I forget, the Merlin host directory at the top,

00:01:13.740 --> 00:01:16.460
that is where Merlin is going to be installed into.

00:01:16.470 --> 00:01:18.940
If you need, feel free to customize that.

00:01:18.940 --> 00:01:20.950
And one other small item.

00:01:20.950 --> 00:01:24.450
The sudo sysctl command,

00:01:24.450 --> 00:01:28.230
that is just setting the virtual memory for the Elasticsearch container,

00:01:28.240 --> 00:01:29.600
used by Wazuh.

00:01:29.600 --> 00:01:36.660
Okay, we see the installation of the merlinServer, and that's pretty much it.

00:01:37.140 --> 00:01:38.460
All right, let's get out of this script.

00:01:41.640 --> 00:01:44.160
Let's go ahead and install the dependencies through that script.

00:01:52.540 --> 00:01:53.170
(Working) Now we're done.

00:01:54.140 --> 00:01:57.170
Note the paths for the Linux agent and the server,

00:01:57.940 --> 00:02:02.170
and additionally, non‑Linux agents can be found within the bin directory.

00:02:03.040 --> 00:02:04.840
In our Docker‑based attack environment,

00:02:04.920 --> 00:02:09.160
the Merlin server and agent are already installed within the docker containers.

00:02:09.539 --> 00:02:10.050
However,

00:02:10.440 --> 00:02:12.550
I just wanted Merlin to be available outside the

00:02:12.550 --> 00:02:15.630
containers so you could easily experiment.

00:02:15.630 --> 00:02:19.010
Before we instantiate the simulation environment,

00:02:19.010 --> 00:02:20.770
let's check out the agent's help text.

00:02:25.540 --> 00:02:27.830
I suggest reviewing the various command line options.

00:02:27.830 --> 00:02:31.290
In a real engagement, you should change the Pre‑shared Key.

00:02:31.290 --> 00:02:35.950
For simplicity, we're just going to leverage the default argument in this case.

00:02:42.840 --> 00:02:44.720
We are going to execute this command now,

00:02:44.730 --> 00:02:47.150
but this should give you an understanding of how the agent is

00:02:47.150 --> 00:02:49.050
being invoked within our simulation environment.

00:02:49.440 --> 00:02:53.550
In general, the Merlin server should be online before trying to run the agents.

00:02:53.940 --> 00:02:55.460
Let's discuss the command line flags.

00:02:55.940 --> 00:02:59.450
The ‑‑url flag points to the Docker container of our Merlin server,

00:03:00.240 --> 00:03:04.650
and the ‑‑proto flag allows us to declare HTTP version 3 as our protocol.

00:03:05.340 --> 00:03:06.660
Luckily for stealth,

00:03:06.750 --> 00:03:10.020
Merlin allows the command line flags to be compiled into the agent.

00:03:10.270 --> 00:03:13.260
Instructions for doing this can be seen at course notes number 4.

00:03:14.240 --> 00:03:15.880
You might be wondering, all right, Zach,

00:03:15.880 --> 00:03:19.160
well, how do we configure the Merlin server or start it?

00:03:19.840 --> 00:03:22.270
Well, that part can't be easily scripted.

00:03:22.330 --> 00:03:24.480
So once we start up our simulation environment,

00:03:24.490 --> 00:03:27.160
we'll go into the Merlin container and configure everything.