WEBVTT

00:00:01.340 --> 00:00:04.850
At this time, we're at the beginning of our post‑exploitation journey.

00:00:05.340 --> 00:00:08.610
Our agent has successfully connected to the Merlin server, and

00:00:08.610 --> 00:00:10.770
we're ready to do some additional recon.

00:00:11.140 --> 00:00:12.370
Let's go to the main menu.

00:00:17.240 --> 00:00:19.250
Okay, let's see what commands are available.

00:00:24.240 --> 00:00:27.870
Perfect, we see the agent command. Let's dig in a little bit further.

00:00:29.540 --> 00:00:33.450
And also, I'm going to adjust the text size just so you can see the next command.

00:00:37.040 --> 00:00:39.950
Okay, let's get a little bit more granular information about the agent.

00:00:44.940 --> 00:00:47.580
Perfect, wow, we even have root.

00:00:47.590 --> 00:00:51.030
Let's get back to the normal text size. For this command to

00:00:51.030 --> 00:00:53.160
work, we must type in the agent's GUID.

00:00:53.540 --> 00:00:56.450
Luckily, Merlin has tab completion to make this easier.

00:00:59.040 --> 00:01:00.560
Boom, much better.

00:01:02.940 --> 00:01:05.250
Okay, once again, let's check out the help text.

00:01:10.740 --> 00:01:13.650
Ooh, that shell command looks pretty promising.

00:01:16.540 --> 00:01:21.540
So in order for us to get our recon script, linenum, on the host,

00:01:21.540 --> 00:01:22.870
we need to install Curl.

00:01:23.440 --> 00:01:24.970
Let's go ahead and start that off.

00:01:28.740 --> 00:01:31.470
Okay, it looks like the command was successful.

00:01:32.240 --> 00:01:36.260
Hmm, I wonder what Suricata and Wazuh think about this installation.