metasploit-framework icon indicating copy to clipboard operation
metasploit-framework copied to clipboard

meterpreter screenshotting/screensharing in real time not working

Open Frogyfucious opened this issue 2 years ago • 4 comments

Hi, so when i get a session so lets say windows 10, when i try to get a screenshot i get a black square as a photo, like 900p or somewhere there. I tried with post module for screenshareing, same shit. i updated my kali with apt update and apt upgrade, metasploit is latest version. Tryed On LAN windows and WAN windows too, no luck

Tryed on VM and it works there (Another Kali install)

Can it be becausue i use windows/meterpreter/reverse_tcp and not /meterpreter/x64/ ? (The windows's are 64bit)

Frogyfucious avatar Oct 04 '22 09:10 Frogyfucious

There is not much information to go on. You're suggesting that the captured screenshot is a black square and the session may or may not be on a Windows 10 host of no particular version.

Was the Windows screensaver on when you took the screenshot?

How are you taking screenshots?

  • screenshot Meterpreter command
  • post/multi/manage/screenshare
  • post/windows/gather/screen_spy
  • something else?

I tried all of the above as a local Administrator on Windows Server 2016. I also tried the screenshot command and post/multi/manage/screenshare on Windows 11. All worked fine.

What user is the session running as? What type of session? PowerShell / Shell / Meterpreter.

Tryed on VM and it works there (Another Kali install)

If it works on one VM but not on another then the answer to your question is highly likely to be found within the differences between the two.

Can it be becausue i use windows/meterpreter/reverse_tcp and not /meterpreter/x64/ ? (The windows's are 64bit)

That shouldn't matter, but you can easily verify this yourself.

bcoles avatar Oct 05 '22 11:10 bcoles

Hi, i tried screenshot/post-screenshare/screenspy types of screenshot on meterpreter. the winwows version is 21h2 or somewhere there (not the newest). windows session is running as nt authority.

Frogyfucious avatar Oct 05 '22 11:10 Frogyfucious

windows session is running as nt authority.

You may need to migrate to a process running as a user who has something to screenshot, rather than service accounts (nt authority\system, nt authority\network service, ...).

bcoles avatar Oct 05 '22 11:10 bcoles

Well, on the vm i am able to do every method for screenshotting or sharing without problem directly from the meterpreter on nt auth. rn i am at work and when i get back imma try to migrate and see if this gets fixed

Frogyfucious avatar Oct 05 '22 11:10 Frogyfucious

Hi!

This issue has been left open with no activity for a while now.

We get a lot of issues, so we currently close issues after 60 days of inactivity. It’s been at least 30 days since the last update here. If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.

github-actions[bot] avatar Nov 04 '22 15:11 github-actions[bot]

Hi again!

It’s been 60 days since anything happened on this issue, so we are going to close it. Please keep in mind that I’m only a robot, so if I’ve closed this issue in error please feel free to reopen this issue or create a new one if you need anything else.

As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request.

github-actions[bot] avatar Dec 05 '22 15:12 github-actions[bot]