rapid7/metasploit-framework — pull request #2240 by jvennix-r7 (2013-08-18 21:46:02+00:00)
Title: OSX keylogger post module... in Ruby!

This is an OSX keylogger using the Carbon GetKeys() API. Since OSX ships with a system Ruby, I wrote the "payload" in Ruby and used Ruby's DL libraries to dynamically link and call the Carbon framework on the victim's machine. This works better than dropping a (properly assembled and linkable) MachO exe, since:

1. You can call with `ruby -e`, so no code ever hits the disk
2. It should theoretically work on all architectures
3. It's ruby, so its very easy to fork() a bg process that we can read logs from in chunks (reliably) via IPC

The main drawback is some incompatibility between 1.9/1.8 DL library (on victim machine), I added some patches to handle this. I have only tested this on MacOS 10.7 and 10.8, so earlier versions of OSX Ruby's DL lib might very well have problems. Also, this script probably leaks a bit (on the victim machine), since I played it fast and loose with the DL::CPtrs.

Note: The method used by this keylogger (GetKeys()) does not return characters entered in password inputs. A kernel extension is needed for this (to bypass Apple's SecureTextEntry protection by hooking straight into the keyboard device).