screenshot implemented

2025-10-30 16:31:21 +01:00
parent d18a773265
commit ad85e06458
12 changed files with 546 additions and 6 deletions
@@ -199,6 +199,7 @@ For more information, see the [Mythic documentation on customizing public agents
 | Command | Description | Example |
 |---------|-------------|---------|
 | `ps` | List running processes with Process Browser support | `ps` |
+| `screenshot` | Capture full-screen screenshot (Mythic screenshot UI) | `screenshot` |

 **Note**: The `ps` command integrates with Mythic's Process Browser, allowing unified process management across multiple callbacks. Process lists are automatically synchronized and viewable from the Process Browser UI.

@@ -512,6 +513,8 @@ Cazalla automatically reports artifacts created during command execution, allowi
 - **Process Create Tracking**: Every `shell` command execution creates an artifact showing the command line
 - **Artifact Management**: Artifacts appear in Mythic's Artifacts page (click the fingerprint icon)
 - **Extensible**: Easy to add artifact reporting for other commands (File Write, Network Connection, etc.)
+- **API Call**: Reported for:
+  - `screenshot` - GDI Screen Capture (GetDC, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, GetDIBits)

 ### How It Works

@@ -568,6 +571,8 @@ Currently supported:
  - `rm` (delete) - reports deleted file/directory path
 - **File Read**: Automatically reported for:
  - `download` - reports file path when downloading files
+- **API Call**: Reported for:
+  - `screenshot` - GDI Screen Capture (GetDC, CreateCompatibleDC, CreateCompatibleBitmap, BitBlt, GetDIBits)

 **Note**: The following commands don't require artifacts as they are read-only or don't modify system state:
 - `ls`, `cd`, `pwd` - read-only file system operations