I'm currently within the agent interaction section within the Merlin server
container. As this tutorial is focused on Wazuh, I'm not going to cover how
I got to this area or how to configure Merlin.
If you're curious about Merlin,
please check out my Pluralsight course, Command and Control with Merlin.
Also, please check out course notes number 6 for the link.
Additionally, the Merlin environment in both courses is nearly identical,
so you can use the commands covered in the Merlin course to fill in any gaps.
As a blue teamer, you need to guard against C2 threats,
and in particular,
you need to look for signs of initial compromise. In this
simulation environment, the attacker has an initial foothold on
the victim's machine through the Merlin agent.
If you want to review the architecture diagram again,
please see course notes number 7.
Anyhow, the Merlin agent's foothold doesn't maintain after a system restart,
so the attacker is going to use a script to escalate their initial foothold.
Let's put on our attacker hat and accomplish this objective.
First,
we're going to upload libprocesshider onto the victim's machine.
Libprocesshider will attempt to make the Merlin agent invisible to
Wazuh. More on this later. I'm going to pause the video while this
upload finishes. Nice, the upload was successful.
Next up is foothold.py.
This script can be seen as the main orchestrator of the foothold,
and I actually created this script myself for this course.
So, a little bit of an aside here,
a real attacker wouldn't make the names this obvious, foothold.py.
However,
I just wanted to make it clear what these scripts
were doing for learning purposes.
Let's go ahead and upload it.
Perfect, foothold.py was successfully uploaded.
Okay,
let's use the Merlin server to run the foothold script on the victim's machine.
As an aside, before running this command,
I waited about 5 minutes to allow the simulation environment to fully bootstrap.
Okay,
let's scroll up here a little bit and see what's going on here with foothold.py.
Okay, we're doing some checks to see if a previous foothold exists.
The main portion here that's important is the Running observability commands.
First we run ps.
Notice how the merlinAgent is clearly visible within
the output. And we scroll down, but we also see netstat output.
Alright, let me zoom out a little bit here.
Okay, we're recentered now.
Notice the PID/Program. So, clearly the Merlin agent is
visible within the netstat output as well.
Zoom back in.
Let's start here, Starting compilation of libprocesshider.
An artifact from this compilation will be injected into
/etc/ld.so.preload. Code injected into this location will run
before any program on the system.
This is a Linux convention.
Once this code is injected,
Merlin should be invisible to commands that are used to monitor processes.
An example is netstat, ps, etc.
By default, Wazuh uses netstat to monitor network
connections, just as a little bit of a heads‑up.
Okay, we see Successfully compiled libprocesshider.
It was injected.
And we also see that the script, foothold.py, is being
injected into bash.bashrc for persistence.
Whenever a user logs into the system, this command will be executed.
Okay, let's scroll down here a little bit.
The observability commands are run again.
Notice in the ps output how the Merlin agent is not visible any longer.
Scroll down here and check out the netstat output. By zooming out, we also see
the Merlin agent isn't visible within the netstat output.
One item to note here is that the listening port still shows; however,
the actual process name is cloaked.
Let's go into Wazuh and see if any alerts were triggered.