WEBVTT

00:00:01.640 --> 00:00:04.070
Now it's time to start our simulation environment.

00:00:04.540 --> 00:00:06.570
This command might take a little while to run,

00:00:06.680 --> 00:00:09.460
so I'm going to pause the video after the command is executed.

00:00:12.640 --> 00:00:12.970
All right,

00:00:12.980 --> 00:00:15.100
let's go ahead and the hop into the Merlin Server

00:00:15.100 --> 00:00:17.050
container so we can configure Merlin.

00:00:22.640 --> 00:00:24.350
Okay, lets start Merlin.

00:00:28.740 --> 00:00:30.950
Dang, that's a nice little hat.

00:00:31.340 --> 00:00:33.350
That Russell, he thinks of everything.

00:00:33.740 --> 00:00:37.850
Okay, to start our exploration of Merlin, let's use the help functionality.

00:00:42.540 --> 00:00:43.410
In our first step,

00:00:43.530 --> 00:00:47.160
we need to create a listener so our agent can connect to the Merlin Server.

00:00:47.940 --> 00:00:48.450
Perfect.

00:00:48.510 --> 00:00:50.550
We see that Merlin has a listeners command.

00:00:51.240 --> 00:00:51.870
Let's use it.

00:00:55.740 --> 00:00:57.570
Notice how the command prompt has changed.

00:00:58.440 --> 00:01:01.170
Okay, let's see now what options are available.

00:01:06.140 --> 00:01:10.460
As previously stated, we're going to use HTTP version 3.

00:01:15.340 --> 00:01:16.660
Let's check out the help text now.

00:01:22.140 --> 00:01:23.130
(Loading) Okay, further,

00:01:23.130 --> 00:01:26.230
let's look at the info command to see what configuration

00:01:26.230 --> 00:01:28.350
options are available for the listener.

00:01:33.940 --> 00:01:37.660
As we spoke about before, you'd want to change the pre‑shared key,

00:01:38.140 --> 00:01:40.750
also known as the PSK, in a real engagement.

00:01:41.240 --> 00:01:41.880
For stealth,

00:01:41.890 --> 00:01:44.950
you'd also want to update the X509 fields to add a

00:01:44.950 --> 00:01:47.150
custom certificate that isn't self‑sign.

00:01:47.840 --> 00:01:50.450
Please see notes number 5 for more context.

00:01:51.140 --> 00:01:54.550
For us, we want our server to listen to all network interfaces,

00:01:54.560 --> 00:01:56.400
not just the loopback interface.

00:01:56.560 --> 00:01:59.870
In your engagements, you'll likely want to change this option as well.

00:02:00.740 --> 00:02:03.470
But how do we modify these values that we're seeing here?

00:02:03.840 --> 00:02:06.360
That's where the set command comes in.

00:02:09.539 --> 00:02:12.060
All right, now, we start the listener.

00:02:19.940 --> 00:02:20.390
(Loading) Perfect.

00:02:20.400 --> 00:02:21.540
There's the connection.

00:02:21.800 --> 00:02:25.270
As a reminder, when you run Merlin within a red team exercise,

00:02:25.410 --> 00:02:28.370
you'd want to start the server before distributing the agents.

00:02:28.670 --> 00:02:30.050
In the simulation environment,

00:02:30.060 --> 00:02:33.760
I have a script that invokes the agent once the listener is instantiated.

00:02:33.760 --> 00:02:36.530
As you might recall, in a previous section,

00:02:36.580 --> 00:02:38.360
we went over how the agent is invoked.

00:02:38.840 --> 00:02:42.070
If you want to see the exact script that invokes the agent,

00:02:42.160 --> 00:02:44.270
please check out course notes number 6.

00:02:44.940 --> 00:02:46.530
Before we proceed with our attack,

00:02:46.530 --> 00:02:50.760
let's log into the Wazuh server so we can check on the alert status.