OK all you VB kiddies

I'm starting a small Keylogger project for win32 (der!)

Here is what I have so far.

The application when run will first Add auto-run Registry key, then opens "KEYLOG.SYS" and start logging all key strokes to it.

I've attached the source code (below).

What other cool stuff should a Keylogger have.

Email capabilities, encrypted logs, etc.

Comments / Questions are welcome

Great suggestion for a project coder. Pity i have no vb skills, but i do have a suggestion.

Is it possible to bundle it with netcat and have it call home at specified time(s)? In other wotrds create a small back door at times which u can set before hand...

Just an idea..

Thanks for taking my idea into consideration

I was under the impression that most keyloggers required good knowledge of asm.
Anyways I´m here to learn so I hope we can all get something out of this.
I´ve been doing some research...not all of it is VB related but could come in handy:

http://www.codeguru.com/system/KeyLoggerMore.html

http://www.astalavista.com/code/vb/keylogg...croix-src11.rar

Im also reading some of the Hitchhiker´s world guides.My Win32 programming isn´t good though
http://packetstormsecurity.nl/groups/hh/

Also can u make the keylogger upload the log to a remote ftp server?

well as far as the drop method (dropping the keystrokes) - you guys should pick one decent method... that way i have somthing to start with

Maybe something HTTP (less suspicious)

erm...what do you mean by dropping? where to save the keystrokes?

ok, ketex (don't "erm.." me anymore smartass )

vnet suggested that we upload the keystrokes to a FTP, the code you posted uses a SMTP client... I was thinking maybe something along the lines of HTTP POST to a specialized cgi (this would not look too suspicious in the logs)... Another good thing to have might be it's own SMTP server (this way the keylogger would work from by it-self , needing no helper applications)...

We should all put our heads together and try to come up with something sneaky so far- i'm interested in packaging it in a r00tkit with it's own SMTP engine...

as far as making it call home with netcat that could be done easily with a shell command. all you need to do is write log to a file then make a variable

private phonehome as double

then do

phonehome = shell(cmd.exe /c whatever command you need)

you could easily use ftp tftp or maybe put with http to accomplish this.

P.S. whats with all the vb bashing. its very usefull and quick.

ifits using smtp wouldn't norton detect outgoing messages...

http looks less suspicious

i've decided to go with a DLL based system... any objections?

i was also thinking of bundling it with the vanquish rootkit?

any other ideas? btw- I'd really appreciate any help i can get any VB coders out there?

yea i use to code vb6 when i used windwows , its been a while sense ive used the langague but i can try to help if you have ne problems.

Guys,

Theres an issue, do you think that you can hide ur keylogger from Norton or other F*cking antivirus programs, if you can, it will be excellent and currently I am facing that problem, Anyway, I wish if I could help you guys in anyway.. Thanks, and waiting for a good result...

Manu

hmm...? i think i'm going to have a problem with norton. I was hoping that the rootkit would hide it from norton? I don't have norton, so i can't really test against it.

could someone run that rootkit + keylogger & test it against norton?

rootkit: vanquish
keylogger: posted above


ok- about the drop method? i was thinking about using some CGI scripts... this way the keystrokes can be dumped into CGI encrypted (with some bullsh*t encoding- to make it look real) here is the perl script...

I think that`s the best way to dump the keystrokes in a "stealthy" manner since it might get past the firewalls specially if it can be done with the IE framework.

OT:I`ve been kinda away from the board because of college stuff but I`m reading some stuff I printed about linux keyloggers...my VB is not good.I only know some VBA (excel,word) that I took on my second semester in college.I`m thinking about takning some java classes next semester even though I`m not very fond of the language (I find it slow and clunky).Any java coders here?

.s

I cant attach files(yet?) but i have a smtp module coded in VB (works to send to hotmail at least)

as well as a module to access socks to eliminate having to use the winsock control(not programmed by me)

and working code using Getasynckeystate and GetKeyState for keylogging
when i made it i used simple form of encryption for the log files using ascii offset

also have semi icq pager working...the method icq pager works has changed, but could update it to work with the new pager

basacly i got lotsa time on my hands, bored, and looking for somthing to do and have had lots of experience in VB / making keyloggers - so if u need any help

about the idea using the IE control, ill give it a test when i get home posting to a asp page and see what zone alarm has to say about it.


and making the program stealth, could use the method those guys used to get the HL2 source code, cant remember the name, but it hides ur app completly on 2k/xp/etc


also have u thought about how the program will store its info on who to send to etc... i used a method of making 3 large variables in the code and puting strings to search for <ID1> ..lots of space... <EOID1>, then openign the exe in binary and writing the email address, icq#, etc.. into it

a problem with using the IE control is it might want to add urls, etc. to its Histroy, we had a problem like this when using XSS, i havnt had much experience with the IE control, but there is away around it if need be

The only problem with using VB for a keylogger i ever ran into is the need for the vb runtimes...but most systems have them these days anyway with XP


anyone know why i cant attach files?

About the anti-virus thing, isn't there anyway you could polymorph some of the keylogging code to avoid being picked up by the Anti-Virus as a common keylogging checksum?

Keep us posted.


-Shaun.

Another thing, have you thought about how your going to set the options for the keylogger when u make it, (e.g. the email address to send the log files to, etc...)

i used a system like sub7's edit server

http://a.1asphost.com/PiP1/keylogEditor.JPG