Capturing Logon Credentials with Meterpreter

In the previous post, we described the keystroke sniffing capabilities of the Meterpreter payload. One of the key restrictions of this feature is that it can only sniff while running inside of a process with interactive access to the desktop. In the case of the MS08-067 exploit, we had to migrate into Explorer.exe in order to capture the logged-on user’s keystrokes. . . . → Read More: Capturing Logon Credentials with Meterpreter

Using Meterpreter For Remote Keystroke Sniffing

The development version of Metasploit now allows keystroke sniffing through Meterpreter sessions. This has been implemented as set of new commands for the stdapi extension of Meterpreter. This works with the help of the keyscan_start command, which spawns a new thread inside of the process where Meterpreter was injected and this thread in turn allocates a large 1Mb buffer to store captured keystrokes. . . . → Read More: Using Meterpreter For Remote Keystroke Sniffing