Merlin

Merlin 是一个跨平台的命令与控制框架及远程访问工具。它提供了一个用于渗透后协调的服务器和代理系统，利用 HTTP/2 框架进行安全通信，并在多个操作系统上执行命令。

该项目具有内存代码执行引擎，可在进程内直接运行程序集和 shellcode，从而避免将文件写入磁盘。它通过点对点网络实现了去中心化的通信架构，允许代理通过直接绑定或反向连接交换数据。

为了规避检测，该框架包含流量混淆工具，可修改 TLS 指纹并添加可配置的数据包填充以掩盖通信模式。安全性通过加密的代理通信、对称流量加密以及用于身份验证的非对称加密握手来管理。

该系统支持通过命令行界面进行多用户访问协调，从而实现红队基础设施内分布式代理的管理。

Features

HTTP/2 Transport Layers - Provides a command and control transport layer based on HTTP/2 multiplexing for bidirectional data streams.
C2 Communication Protocols - Manages secure data exchange between the central server and distributed agents via modern web protocols.
C2 Frameworks - Implements a comprehensive server and agent system using HTTP/2 for secure post-exploitation coordination.
Shellcode Loaders - Ships a system for executing arbitrary machine code in memory using threading and asynchronous procedure call techniques.
Handshake Credential Validators - Validates agent identities using cryptographic token exchanges during the connection handshake.
C2 Agents - Ships a Go-based remote access tool for executing commands and injecting shellcode across multiple OSs.
Identity Validation - Uses asymmetric cryptographic exchanges to verify the authenticity of connecting agents.
In-Memory Payload Execution - Executes assemblies and shellcode directly in volatile memory to avoid writing files to disk.
Red Teaming Frameworks - Supplies the infrastructure and primitives required for conducting adversary simulation and red team operations.
Payload Traffic Encryptions - Encrypts command and control payload traffic using symmetric ciphers to prevent interception.
Peer-to-Peer Networking - Establishes direct peer-to-peer connections between agents for decentralized data routing.
C2 Relay Networks - Establishes a decentralized network allowing agents to relay data via direct bind or reverse connections.
APC-Based Injection - Implements shellcode execution via asynchronous procedure calls to evade detection.
TLS Fingerprint Emulators - Emulates specific TLS handshake parameters to mimic legitimate browsers and bypass security filters.
TLS Fingerprint Impersonators - Modifies the network handshake hash to impersonate different clients and bypass security filters.
Network Traffic Obfuscators - Modifies TLS fingerprints and packet sizes to evade network traffic analysis and security filters.
Traffic Obfuscation Tools - Includes a communication layer that masks traffic patterns using TLS fingerprinting and packet padding.
Packet Size Randomizers - Inserts random padding into network packets to mask communication sizes and patterns.
Traffic Size Obfuscation Techniques - Implements configurable packet padding to randomize message sizes and mask communication patterns from analysis.
Multi-User Agent Coordination - Coordinates the control of remote agents across a collaborative multi-user environment.
Command and Control - Cross-platform post-exploitation server and agent.
Command and Control - HTTP/2-based cross-platform C2 framework.
Command And Control Frameworks - Post-exploitation framework designed for post-compromise network operations.

Star 历史

Ne0nd0gmerlin

Name: ne0nd0g/merlin
Author: Ne0nd0g

View on GitHub

5,555 星标838 分支GoGPL-3.018 次浏览

Merlin

该系统支持通过命令行界面进行多用户访问协调，从而实现红队基础设施内分布式代理的管理。

Features

HTTP/2 Transport Layers - Provides a command and control transport layer based on HTTP/2 multiplexing for bidirectional data streams.
C2 Communication Protocols - Manages secure data exchange between the central server and distributed agents via modern web protocols.
C2 Frameworks - Implements a comprehensive server and agent system using HTTP/2 for secure post-exploitation coordination.
Shellcode Loaders - Ships a system for executing arbitrary machine code in memory using threading and asynchronous procedure call techniques.
Handshake Credential Validators - Validates agent identities using cryptographic token exchanges during the connection handshake.
C2 Agents - Ships a Go-based remote access tool for executing commands and injecting shellcode across multiple OSs.
Identity Validation - Uses asymmetric cryptographic exchanges to verify the authenticity of connecting agents.
In-Memory Payload Execution - Executes assemblies and shellcode directly in volatile memory to avoid writing files to disk.
Red Teaming Frameworks - Supplies the infrastructure and primitives required for conducting adversary simulation and red team operations.
Payload Traffic Encryptions - Encrypts command and control payload traffic using symmetric ciphers to prevent interception.
Peer-to-Peer Networking - Establishes direct peer-to-peer connections between agents for decentralized data routing.
C2 Relay Networks - Establishes a decentralized network allowing agents to relay data via direct bind or reverse connections.
APC-Based Injection - Implements shellcode execution via asynchronous procedure calls to evade detection.
TLS Fingerprint Emulators - Emulates specific TLS handshake parameters to mimic legitimate browsers and bypass security filters.
TLS Fingerprint Impersonators - Modifies the network handshake hash to impersonate different clients and bypass security filters.
Network Traffic Obfuscators - Modifies TLS fingerprints and packet sizes to evade network traffic analysis and security filters.
Traffic Obfuscation Tools - Includes a communication layer that masks traffic patterns using TLS fingerprinting and packet padding.
Packet Size Randomizers - Inserts random padding into network packets to mask communication sizes and patterns.
Traffic Size Obfuscation Techniques - Implements configurable packet padding to randomize message sizes and mask communication patterns from analysis.
Multi-User Agent Coordination - Coordinates the control of remote agents across a collaborative multi-user environment.
Command and Control - Cross-platform post-exploitation server and agent.
Command and Control - HTTP/2-based cross-platform C2 framework.
Command And Control Frameworks - Post-exploitation framework designed for post-compromise network operations.

Merlin 的开源替代方案

相似的开源项目，按与 Merlin 的功能重合度排序。

n1nj4sec/pupy
n1nj4sec/pupy
8,942在 GitHub 上查看
Pupy is a command and control framework and post-exploitation suite used for remote administration and system management. It functions as a cross-platform tool for deploying payloads and controlling multiple remote agents through encrypted communication channels. The framework features a multi-platform payload generator that creates custom executable files using configurable network launchers. It employs a network traffic obfuscator that stacks encryption and obfuscation protocols to hide communication from observation. The system provides capabilities for in-memory code execution, remote pr
Pythonandroidbackdoorlinux
在 GitHub 上查看8,942
byt3bl33d3r/offensivenim
byt3bl33d3r/OffensiveNim
3,033在 GitHub 上查看
OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of low-level primitives and a Windows API wrapper designed for offensive security operations, including malware development and shellcode loading. The project focuses on evasion and obfuscation through techniques such as API unhooking, direct system calls, and anti-debugging mechanisms. It features diverse payload delivery methods, including reflective binary loading, the execution of .NET assemblies via CLR hosting, and various shellcode injection techniques using fibers, COM obje
Nim
在 GitHub 上查看3,033
specterops/bloodhound
SpecterOps/BloodHound
2,789在 GitHub 上查看
BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity relationships and permissions in Active Directory. It functions as a security tool for auditing directory services, uncovering unintended privilege relationships, and visualizing sequences of permissions that can lead to domain compromise. The project differentiates itself as a comprehensive adversary emulation framework that coordinates remote agents and executes post-exploitation commands. It includes a reverse proxy for bypassing multi-factor authentication via real-time session hij
Go
在 GitHub 上查看2,789
its-a-feature/mythic
its-a-feature/Mythic
4,571在 GitHub 上查看
Mythic is a red teaming framework and command and control server designed for managing post-exploitation activities. It provides a centralized system for issuing tasks and receiving telemetry from agents deployed across diverse target platforms and operating systems. The platform features a collaborative operator interface that allows multiple security researchers to coordinate operations and track target activity within a shared environment. It supports the deployment and updating of diverse agent payloads through a multi-platform payload manager. The framework utilizes a plugin-based archi
JavaScript
在 GitHub 上查看4,571

查看 Merlin 的所有 30 个替代方案

常见问题解答

ne0nd0g/merlin 是做什么的？

ne0nd0g/merlin 的主要功能有哪些？

ne0nd0g/merlin 的主要功能包括：HTTP/2 Transport Layers, C2 Communication Protocols, C2 Frameworks, Shellcode Loaders, Handshake Credential Validators, C2 Agents, Identity Validation, In-Memory Payload Execution。

ne0nd0g/merlin 有哪些开源替代品？

ne0nd0g/merlin 的开源替代品包括： n1nj4sec/pupy — Pupy is a command and control framework and post-exploitation suite used for remote administration and system… byt3bl33d3r/offensivenim — OffensiveNim is a red teaming framework and post-exploitation toolkit developed in Nim. It provides a collection of… specterops/bloodhound — BloodHound is an identity risk management platform and graph-based attack path analyzer used to map identity… cobbr/covenant — Covenant is a .NET-based command and control framework designed for red team operations and adversary simulation. It… its-a-feature/mythic — Mythic is a red teaming framework and command and control server designed for managing post-exploitation activities.… bats3c/shad0w — A post exploitation framework designed to operate covertly on heavily monitored environments.

Merlin

Features

Star 历史

Merlin

Features

Merlin 的开源替代方案

n1nj4sec/pupy

byt3bl33d3r/OffensiveNim

SpecterOps/BloodHound

its-a-feature/Mythic

常见问题解答

Star 历史

常见问题解答

Merlin 的开源替代方案

n1nj4sec/pupy

byt3bl33d3r/OffensiveNim

SpecterOps/BloodHound

its-a-feature/Mythic