Desktop Control

To interact with a desktop on a target host, go to [beacon] -> Explore -> Desktop (VNC). This will stage a VNC server into the memory of the current process and tunnel the connection through Beacon.

When the VNC server is ready, Cobalt Strike will open a tab labeled Desktop HOST@PID.

You may also use Beacon’s desktop command to inject a VNC server into a specific process. Use desktop pid architecture low|high. The last parameter let’s you specify a quality for the VNC session.

figure 59 - Cobalt Strike Desktop Viewer

The bottom of the desktop tab has several buttons. These are:

	Refresh the screen
	View only
	Decrease Zoom
	Increase Zoom
	Zoom to 100%
	Adjust Zoom to Fit Tab
	Send Ctrl+Escape
	Lock the Ctrl key
	Lock the Alt key

If you can’t type in a Desktop tab, check the state of the Ctrl and Alt buttons. When either button is pressed, all of your keystrokes are sent with the Ctrl or Alt modifier. Press the Ctrl or Alt button to turn off this behavior. Make sure View only isn’t pressed either. To prevent you from accidentally moving the mouse, View only is pressed by default.

 

Related Topics