Run a red team engagement by deploying Merlin agents on target Windows machines and issuing commands from a central server.
Test network detection by generating encrypted, padded C2 traffic over HTTP/2 or HTTP/3 to see if your SIEM catches it.
Coordinate a multi-operator red team where several people control agents simultaneously from the same gRPC-connected server.
Deliver .NET assemblies or shellcode to a compromised Windows host using built-in payload injection techniques.
| ne0nd0g/merlin | kahing/goofys | bililive-go/bililive-go | |
|---|---|---|---|
| Stars | 5,538 | 5,542 | 5,543 |
| Language | Go | Go | Go |
| Setup difficulty | hard | moderate | moderate |
| Complexity | 4/5 | 3/5 | 3/5 |
| Audience | ops devops | ops devops | general |
Figures from each repo's GitHub metadata at analysis time.
Requires 7-Zip to unpack the release archive, Windows shellcode injection features require appropriate privileges on the target.
Merlin is a command-and-control (C2) tool used in security testing, specifically in post-exploitation scenarios where a researcher or red team operator has already gained access to a target system and needs to communicate with it remotely. The project is written in Go and runs on Windows, macOS, and Linux. The core design is a server-and-agent model. You run the Merlin server on a machine you control, then deploy a small agent program on the target machine. The agent connects back to your server over an encrypted connection, and from there you can issue commands. Communication can happen over several network protocols, including HTTP/1.1, HTTP/2, HTTP/3, and peer-to-peer links between agents using SMB, TCP, or UDP. The tool includes features aimed at avoiding network-based detection. Messages between server and agent can be encrypted and encoded in multiple ways, including AES and JSON Web Encryption. Agents can also pad their messages with random data to defeat detection methods that look for fixed-size network packets. Authentication options range from none to an advanced password-based key exchange protocol called OPAQUE. On Windows systems, Merlin agents can run .NET assemblies, execute Windows executables in isolated processes, and inject shellcode using several different techniques. It also integrates with Donut, sRDI, and SharpGen, which are separate open-source tools for packaging and delivering code payloads. Multiple operators can connect to the same Merlin server at once through a command-line interface that communicates over gRPC. Merlin also integrates with Mythic, a separate collaborative red-teaming framework. To get started, you download the server package from the releases page, extract it with 7-Zip, start the server and CLI, configure a listener, and deploy an agent to the target machine.
A post-exploitation command-and-control framework written in Go that lets red team operators communicate with compromised systems over encrypted HTTP/2, HTTP/3, or peer-to-peer channels with multiple detection-evasion options.
Mainly Go. The stack also includes Go, gRPC, HTTP/2.
Setup difficulty is rated hard, with roughly 1h+ to a first successful run.
Mainly ops devops.
This repo across BitVibe Labs
Don't trust strangers blindly. Verify against the repo.