Windows Gather Screen Spy
This module will incrementally take screenshots of the meterpreter host. This allows for screen spying which can be useful to determine if there is an active user on a machine, or to record the screen for later data extraction.
Rank
- Normal
Authors
- Roni Bachar < roni.bachar.blog [at] gmail.com >
- bannedit < bannedit [at] metasploit.com >
- kernelsmith < kernelsmith /x40 kernelsmith /x2E com >
- Adrian Kubok < >
Development
Similar Modules
- post/windows/gather/arp_scanner
- post/windows/gather/bitcoin_jacker
- post/windows/gather/cachedump
- post/windows/gather/checkvm
- post/windows/gather/credentials/coreftp
- post/windows/gather/credentials/credential_collector
- post/windows/gather/credentials/dyndns
- post/windows/gather/credentials/enum_cred_store
- post/windows/gather/credentials/enum_picasa_pwds
- post/windows/gather/credentials/epo_sql
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use post/windows/gather/screen_spy
msf post(screen_spy) > set SESSION [INTEGER]
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use post/windows/gather/screen_spy
msf post(screen_spy) > set SESSION [INTEGER]
Module Options
| BROWSER | Browser to use for viewing screenshots (default: firefox) |
| COUNT | Number of screenshots to collect (default: 60) |
| DELAY | Interval between screenshots in seconds (default: 5) |
| RECORD | Record all screenshots to disk |
| SESSION | The session to run this module on. |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |