Desktop Control

To interact with a desktop on a target host, go to [beacon] -> Explore -> Desktop (VNC). This will stage a VNC server into the memory of the current process and tunnel the connection through Beacon

When the VNC server is ready, Cobalt Strike will open a tab labeled Desktop HOST@PID

You may also use Beacon’s desktop command to inject a VNC server into a specific process. Use desktop pid architecture low|high. The last parameter let’s you specify a quality for the VNC session.

The bottom of the desktop tab has several buttons. These are:

1) Refresh the Screen (Circling Arrows)

2) View Only (Guy with a hat)

3) Decrease Zoom

4) Increase Zoom

5) Zoom to 100%

6) Adjust Zoom to Fit Tab

7) Send Ctrl+Escape (Windows Icon)

8) Lock the Ctrl key (Ctrl Key)

9) Lock the Alt Key (Alt Key)

If you can’t type in a Desktop tab, check the state of the Ctrl and Alt buttons. When either button is pressed, all of your keystrokes are sent with the Ctrl or Alt modifier. Press the Ctrl or Alt button to turn off this behavior. Make sure View only isn’t pressed either. To prevent you from accidentally moving the mouse, View only is pressed by default.