Post Exploitationpost-exploitationcommand-and-controlhttp2cross-platformagent

Merlin Agent

Cross-platform post-exploitation HTTP/2 Command & Control agent. This package contains the Agent code for the Merlin post-exploitation command and control framework.

Description

Merlin-agent is part of the Merlin post-exploitation command and control framework, providing the agent code for cross-platform operations. It enables communication over HTTP/2 protocols for post-exploitation activities in penetration testing and red team engagements.

The tool is designed for use in controlled environments where persistent access and command execution are required after initial compromise. It supports configurable authentication and communication parameters to blend with network traffic.

Installed size is 11.55 MB with dependency on libc6, making it lightweight for deployment on various systems.

How It Works

The agent communicates using HTTP/2 protocol by binding to a specified address in interface:port format, defaulting to 127.0.0.1:7777. Authentication is handled via methods like OPAQUE. Additional HTTP headers can be specified for evasion. Debug output is available for troubleshooting internals.

Installation

bash
sudo apt install merlin-agent

Flags

-addrThe address in interface:port format the agent will use for communications (default "127.0.0.1:7777")
-authThe Agent's authentication method (e.g, OPAQUE (default "opaque")
-debugEnable debug output
-headersA new line separated (e.g., \n) list of additional HTTP headers to use

Examples

Display help output showing available flags
merlin-agent -h
Run agent with default settings on 127.0.0.1:7777 using OPAQUE auth
merlin-agent
Bind agent to all interfaces on port 443
merlin-agent -addr 0.0.0.0:443
Explicitly set authentication method to OPAQUE
merlin-agent -auth OPAQUE
Enable debug output for troubleshooting
merlin-agent -debug
Add custom HTTP headers separated by newlines
merlin-agent -headers "X-Custom: value\nUser-Agent: Mozilla/5.0"
Run agent on remote host port 80 with debug enabled
merlin-agent -addr example.com:80 -debug
Updated 2026-04-16kali.org ↗