search

Ne0nd0g / merlin

Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.
GNU General Public License v3.0
5.08k stars 803 forks source link

Too much time (26+ seconds) to get response from agent #91

Closed g3rzi closed 4 years ago

g3rzi commented 4 years ago

Prerequisite

Expected Behavior

Fast output on server (maximum 4 seconds)

Actual Behavior

On local server with agent that runs on the same machine it takes more than 26 seconds for the server to get response from the agent. I am not sure why, is it because of HTTP/2? I shouldn't take so much time.
I don't know what is the problem exactly but there couple of options to check where it take most of the time:

  1. Before it goes to the agent
  2. Time to get to the agent - less likely
  3. Before it goest to the server
  4. Time to get to the server - less likely

Steps to Reproduce Behavior

  1. Start terminal with root sudo -s
  2. Download agent and server for Linux from the releases
  3. Start the server: root# ./merlinServer-Linux-x64 -p 1338
  4. Start the agent: root# ./merlinAgent-Linux-x64 -url https://127.0.0.1:1338
  5. After the server will get this kind of message: 
    [+]New authenticated agent checkin for 40295678-2713-40ef-b6c7-9b0da1d4e84c at 2020-06-13T10:26:06Z

    Run: 

    Merlin» agent interact 40295678-2713-40ef-b6c7-9b0da1d4e84c
Merlin[agent][40295678-2713-40ef-b6c7-9b0da1d4e84c]» 
Merlin[agent][40295678-2713-40ef-b6c7-9b0da1d4e84c]» 
Merlin[agent][40295678-2713-40ef-b6c7-9b0da1d4e84c]» ls /
[-]Created job pzSzPrhLIf for agent 40295678-2713-40ef-b6c7-9b0da1d4e84c at 2020-06-13T10:26:24Z
Merlin[agent][40295678-2713-40ef-b6c7-9b0da1d4e84c]»
  6. Wait for output, it will take something like 25-28 seconds

    Misc Information

    The agent is connected with HTTP/2 (h2):

    
Merlin» agent list

+--------------------------------------+-------------+------+--------+-------------+--------+ | AGENT GUID | PLATFORM | USER | HOST | TRANSPORT | STATUS | +--------------------------------------+-------------+------+--------+-------------+--------+ | 40295678-2713-40ef-b6c7-9b0da1d4e84c | linux/amd64 | root | ubuntu | HTTP/2 (h2) | Active | +--------------------------------------+-------------+------+--------+-------------+--------+



#### Demo
![merlin_time](https://user-images.githubusercontent.com/11998736/84566150-b9509180-ad77-11ea-99ed-a4b6d013e59b.gif)
Ne0nd0g commented 4 years ago

The default sleep time is 30 seconds before the agent checks back in. You can change that with set sleep 10s so that it calls back every 10 seconds instead.

Ne0nd0g commented 4 years ago

You can also use the -sleep command line argument when start the agent.

Ne0nd0g commented 4 years ago

@g3rzi Were you able to change the sleep time?

g3rzi commented 4 years ago

Yes, it looks better but let me do one more test and I will update here tomorrow

g3rzi commented 4 years ago

It seems to work much better, thanks.

I will keep work with this setup, thanks