Description
This module binds to an open X11 host to log keystrokes. This is a fairly close copy of the old xspy c program which has been on Kali for a long time. The module works by connecting to the X11 session, creating a background window, binding a keyboard to it and creating a notification alert when a key is pressed.
One of the major limitations of xspy, and thus this module, is that it polls at a very fast rate, faster than a key being pressed is released (especially before the repeat delay is hit). To combat printing multiple characters for a single key press, repeat characters arent printed when typed in a very fast manor. This is also an imperfect keylogger in that keystrokes arent stored and forwarded but status displayed at poll time. Keys may be repeated or missing.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/gather/x11/keyboard_spymsf undefined(keyboard_spy) > show actions ...actions...msf undefined(keyboard_spy) > set ACTION < action-name >msf undefined(keyboard_spy) > show options ...show and set options...msf undefined(keyboard_spy) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub