Commands

​

Merlin Command Reference

​

Available Commands

​

File System Operations

• cd - Change the current working directory
• download - Download a file from the target host
• ls - List directory contents
• pwd - Print the current working directory
• rm - Remove a file from the target host

​

Execution

• createprocess - Create a new process on the target host
• execute-assembly - Execute a .NET assembly in memory
• execute-pe - Execute a Windows PE (Portable Executable) in memory
• execute-shellcode - Execute shellcode in memory
• run - Execute a program on the target host
• runas - Execute a program as another user
• shell - Execute a command using the system’s default shell

​

Credential & Token Operations

• make_token - Create a new logon session with credentials
• mimikatz - Execute Mimikatz commands
• rev2self - Revert to the original process token
• steal_token - Steal a token from another process
• token - Manage Windows access tokens

​

Code Generation & Transformation

• donut - Convert PE files or .NET assemblies to position-independent shellcode
• sharpgen - Compile and execute C# code dynamically
• srdi - Convert DLLs to position-independent shellcode (Shellcode Reflective DLL Injection)

​

Network Operations

• nslookup - Perform DNS lookups
• socks - Start a SOCKS5 proxy server
• ssh - Execute commands over SSH

​

Agent Configuration

• exit - Exit and terminate the agent
• ja3 - Set the JA3 signature for TLS connections
• killdate - Set a date when the agent will automatically exit
• maxretry - Set the maximum number of failed checkins before the agent exits
• memory - Configure in-memory execution settings
• memfd - Execute files in memory using memfd_create (Linux)
• parrot - Rotate through JA3 signatures
• skew - Set jitter/skew for agent sleep intervals
• sleep - Set the agent’s sleep interval and jitter