Skip to main content
After executing the Merlin server binary, interaction continues from the Merlin prompt Merlin». This is the default menu presented when starting the Merlin server. To view available commands for this menu, type help and press enter. Tab completion can be used at any time to provide the user a list of commands that can be selected. Merlin is equipped with a tab completion system that can be used to see what commands are available at any given time. Hit double tab to get a list of all available commands for the current menu context.

!

USAGE: ! command [args]
Any command that begins with a ! (a.k.a bang or exclamation point) will be executed on host itself where the Merlin server is running. This is useful when you want simple information, such as your interface address, without having to open a new terminal.
There must be a space after the ! for the command to be executed.

back

USAGE: back
The back command go to the parent menu, typically the main menu. When the back command is executed from the main menu, nothing will happen.
USAGE: banner
The banner command is used too print the super cool ascii art banner along with the version and build numbers.

clear

USAGE: clear
The clear command will cancel all jobs in the queue that have not been sent to the agent yet. This command will only clear jobs for ALL agents.

debug

USAGE: debug
The debug command is a switch used to enable or disable debug output to the console.

group

USAGE: group {add agentID groupName | list [groupName] |remove agentID groupName}
The group command interacts with server-side groups that agents can be added to and removed from. Arbitrary agent commands and modules can be executed against an entire group at one time.

add

USAGE: group add agentID groupName
The group add command adds an agent to a named group. If the group name does not exist, it will be created. The list of available agents can be tab completed.

list

USAGE: group list
The group list command displays all existing group names to include agents that are members of a group. The all group always exists and is used to task every known agent.

remove

USAGE: group remove agentID groupName
The group remove command is used to remove an agent from a named group. The list of ALL agents is tab completable but does not mean the agent is in the group. The list of existing groups can also be tab completed.

interact

USAGE: interact {agentID|listenerID}
The interact command takes one argument, the agent or listener ID. The current menu determines what type of entity the command will interact with. The default is to interact with Agents across all menus. To interact with a Listener, use the ‘listeners’ menu.” Use tab completion to cycle through and select available Agents or Listeners.

jobs

USAGE: jobs
The jobs command displays unfinished jobs for ALL agents when executed from the main menu.

modules

USAGE: modules
The modules command will move into the Modules menu.

queue

USAGE: queue {agentID|groupName} command [args]
The queue command can be used to pre-load, or queue, arbitrary commands/jobs against an agent or a group. Additionally, the agent does not have to exist for this command to be used. When an agent with that ID checks in, it will receive the job. Queue a command for one agent:
Queue a command for a group:
Queue a command for an agent that has never checked in before and is currently unknown to the server:
Some agent control commands such as sleep can not be queued because the agent structure must exist on the server to calculate the JWT

quit

USAGE: quit [-y]
The quit command is used to stop and exit the Merlin server. The user will be prompted for confirmation to prevent from accidentally quitting the program. The confirmation prompt can be skipped with quit -y.

listeners

USAGE: listeners
The listeners command will move into the Listeners menu.

remove

USAGE: remove agentID
The remove command is used to remove or delete an agent from the server so that it will not show up in the list of available agents.
Removing an active agent will cause that agent to fail to check in and it will eventually exit.

sessions

USAGE: sessions
The sessions command is used to quickly list information about established agents from the main menu to include their status. The sessions command is available from any menu in the CLI.
  • AGENT GUID: A unique identifier for every running instance
  • TRANSPORT: The protocol the agent is communicating over
  • PLATFORM: The operating system and architecture the agent is running on
  • HOST: The hostname where the agent is running
  • USER: The username that hte agent is running as
  • PROCESS: The Agent’s process name followed by its Process ID (PID) in parenthesis
  • STATUS: The Agent’s communiction status of either active, delayed, or dead
  • LAST CHECKIN: The amount of time that has passed since the agent last checked in
  • NOTE: A free-form text area for operators to record notes about a specific agent; tracked server-side only

socks

USAGE: socks {list | start [interface:]port agentID |stop [interface:]port agentID}
The socks command is used to start, stop, or list SOCKS5 listeners. There can only be one SOCKS5 listener per agent.

socks list

USAGE: socks list
The list command will list active SOCKS5 listeners per agent. If the SOCKS5 listener was configured to listen on all interfaces (e.g., 0.0.0.0), then the interface will be listed as [::]:

socks start

USAGE: socks start [interface:]port agentID
SOCKS5 listeners do not require authentication. Control access accordingly using firewall rules or SSH tunnels.
In most cases you should only bind to the loopback adapter, 127.0.0.1, to prevent unintentionally exposing the port.
The start command will start a SOCKS5 listener for the current agent. This command requires four arguments. The third argument is the interface and port, or just the port, that you want to bind the listener to. The fourth argument is the agent (tab completable) that you want to start the SOCKS5 listener for.

socks stop

USAGE: socks stop [interface:]port agentID
The stop command will stop and remove the SOCKS5 listener for the current agent. This command requires four arguments. The third argument is the interface and port, or just the port, that you want to bind the listener to. This value doesn’t really matter, but it is need for consistency to keep the agent ID in the fourth spot. The fourth argument is the agent (tab completable) that you want to start the SOCKS5 listener for.

verbose

USAGE: verbose
The verbose command is a switch used to enable or disable verbose output to the console.

version

USAGE: version
The version command is used to simply print the version numbers of the running Merlin server.