Merlin».
This is the default menu presented when starting the Merlin server.
To view available commands for this menu, type help and press enter.
Tab completion can be used at any time to provide the user a list of commands that can be selected.
Merlin is equipped with a tab completion system that can be used to see what commands are available at any given time.
Hit double tab to get a list of all available commands for the current menu context.
!
USAGE:
! command [args]! (a.k.a bang or exclamation point) will be executed on host itself where the Merlin
server is running. This is useful when you want simple information, such as your interface address, without having to
open a new terminal.
There must be a space after the
! for the command to be executed.back
USAGE:
backback command go to the parent menu, typically the main menu. When the back command is executed from the
main menu, nothing will happen.
banner
USAGE:
bannerbanner command is used too print the super cool ascii art banner along with the version and build numbers.
clear
USAGE:
clearclear command will cancel all jobs in the queue that have not been sent to the agent yet.
This command will only clear jobs for ALL agents.
debug
USAGE:
debugdebug command is a switch used to enable or disable debug output to the console.
group
USAGE:
group {add agentID groupName | list [groupName] |remove agentID groupName}group command interacts with server-side groups that agents can be added to and removed from.
Arbitrary agent commands and modules can be executed against an entire group at one time.
add
USAGE:
group add agentID groupNamegroup add command adds an agent to a named group. If the group name does not exist, it will be created.
The list of available agents can be tab completed.
list
USAGE:
group listgroup list command displays all existing group names to include agents that are members of a group.
The all group always exists and is used to task every known agent.
remove
USAGE:
group remove agentID groupNamegroup remove command is used to remove an agent from a named group. The list of ALL agents is tab completable
but does not mean the agent is in the group. The list of existing groups can also be tab completed.
interact
USAGE:
interact {agentID|listenerID}interact command takes one argument, the agent or listener ID. The current menu determines what type of entity
the command will interact with. The default is to interact with Agents across all menus. To interact with a Listener,
use the ‘listeners’ menu.” Use tab completion to cycle through and select available Agents or Listeners.
jobs
USAGE:
jobsjobs command displays unfinished jobs for ALL agents when executed from the main menu.
modules
USAGE:
modulesmodules command will move into the Modules menu.
queue
USAGE:
queue {agentID|groupName} command [args]queue command can be used to pre-load, or queue, arbitrary commands/jobs against an agent or a group.
Additionally, the agent does not have to exist for this command to be used.
When an agent with that ID checks in, it will receive the job.
Queue a command for one agent:
quit
USAGE:
quit [-y]quit command is used to stop and exit the Merlin server. The user will be prompted for confirmation to prevent
from accidentally quitting the program. The confirmation prompt can be skipped with quit -y.
listeners
USAGE:
listenerslisteners command will move into the Listeners menu.
remove
USAGE:
remove agentIDremove command is used to remove or delete an agent from the server so that it will not show up in the list of available agents.
Removing an active agent will cause that agent to fail to check in and it will eventually exit.
sessions
USAGE:
sessionssessions command is used to quickly list information about established agents from the main menu to include their status.
The sessions command is available from any menu in the CLI.
- AGENT GUID: A unique identifier for every running instance
- TRANSPORT: The protocol the agent is communicating over
- PLATFORM: The operating system and architecture the agent is running on
- HOST: The hostname where the agent is running
- USER: The username that hte agent is running as
- PROCESS: The Agent’s process name followed by its Process ID (PID) in parenthesis
- STATUS: The Agent’s communiction status of either active, delayed, or dead
- LAST CHECKIN: The amount of time that has passed since the agent last checked in
- NOTE: A free-form text area for operators to record notes about a specific agent; tracked server-side only
socks
USAGE:
socks {list | start [interface:]port agentID |stop [interface:]port agentID}socks command is used to start, stop, or list SOCKS5 listeners. There can only be one SOCKS5 listener per agent.
socks list
USAGE:
socks listlist command will list active SOCKS5 listeners per agent. If the SOCKS5 listener was configured to listen on
all interfaces (e.g., 0.0.0.0), then the interface will be listed as [::]:
socks start
USAGE:
socks start [interface:]port agentIDIn most cases you should only bind to the loopback adapter, 127.0.0.1, to prevent unintentionally exposing the port.
start command will start a SOCKS5 listener for the current agent. This command requires four arguments.
The third argument is the interface and port, or just the port, that you want to bind the listener to.
The fourth argument is the agent (tab completable) that you want to start the SOCKS5 listener for.
socks stop
USAGE:
socks stop [interface:]port agentIDstop command will stop and remove the SOCKS5 listener for the current agent. This command requires four arguments.
The third argument is the interface and port, or just the port, that you want to bind the listener to.
This value doesn’t really matter, but it is need for consistency to keep the agent ID in the fourth spot.
The fourth argument is the agent (tab completable) that you want to start the SOCKS5 listener for.
verbose
USAGE:
verboseverbose command is a switch used to enable or disable verbose output to the console.
version
USAGE:
versionversion command is used to simply print the version numbers of the running Merlin server.