most pieces of malware and penetration testing frameworks include the capability to take screenshots against the remote target this can help capture imagesvideo framesor other sensitive data that you might not see with packet capture or keylogger thankfullywe can use the pywin package (see installing the prerequisitesto make native calls to the windows api to grab them screenshot grabber will use the windows graphics device interface (gdito determine necessary properties such as the total screen sizeand to grab the image some screenshot software will only grab picture of the currently active window or applicationbut in our case we want the entire screen let' get started crack open screenshotter py and drop in the following codeimport win gui import win ui import win con import win api grab handle to the main desktop window hdesktop win gui getdesktopwindow(determine the size of all monitors in pixels width win api getsystemmetrics(win con sm_cxvirtualscreenheight win api getsystemmetrics(win con sm_cyvirtualscreenleft win api getsystemmetrics(win con sm_xvirtualscreentop win api getsystemmetrics(win con sm_yvirtualscreencreate device context desktop_dc win gui getwindowdc(hdesktopimg_dc win ui createdcfromhandle(desktop_dccreate memory based device context mem_dc img_dc createcompatibledc(create bitmap object screenshot win ui createbitmap(screenshot createcompatiblebitmap(img_dcwidthheightmem_dc selectobject(screenshotcopy the screen into our memory device context mem_dc bitblt(( )(widthheight)img_dc(lefttop)win con srccopysave the bitmap to file screenshot savebitmapfile(mem_dc' :\\windows\\temp\\screenshot bmp'free our objects mem_dc deletedc(win gui deleteobject(screenshot gethandle()let' review what this little script does first we acquire handle to the entire desktop which includes the entire viewable area across multiple monitors we then determine the size of the screen(sso that we know the dimensions required for the screenshot we create device context[ using the getwindowdc function call and pass in handle to our desktop next we need to create memory-based device context where we will store our image capture until we store the bitmap bytes to file we then create bitmap object that is set to the device context of our desktop the selectobject call then sets the memory-based device context to point at the bitmap object that we're capturing we use the bitblt function to take bit-for-bit copy of the desktop image and store it in the memory-based context think of this as memcpy call for gdi objects the final step is to dump this image to disk this script is easy to testjust run it from the command line and check the :\windows\temp directory for your screenshot bmp file let' move on to