WEBVTT Kind: captions Language: en 00:00:01.420 --> 00:00:03.900 Previously, we spoke about Keyloggers. 00:00:04.220 --> 00:00:09.900 We discussed why you'd want to use it instead of a backdoor and we seen how to use a program 00:00:09.900 --> 00:00:14.560 called ZLogger to generate a remote keylogger for Windows. 00:00:15.440 --> 00:00:20.020 In this lecture, I wanna show you how to generate a remote key logger for Linux 00:00:20.940 --> 00:00:25.460 and to do that we're going to use the exact same program, ZLogger. 00:00:26.320 --> 00:00:31.560 So to do that, first of all I'm gonna navigate to the location where we installed Z logger. 00:00:31.560 --> 00:00:37.520 So if you don't remember where you installed it or how to install it, please go back and revise the lecture, 00:00:37.520 --> 00:00:41.800 where I downloaded and installed it, when we were targeting windows. 00:00:42.540 --> 00:00:47.180 So I'm gonna do 'cd/opt/ZLogger/' 00:00:48.740 --> 00:00:52.720 and if we do 'ls', we'll see all the files for this program 00:00:53.300 --> 00:01:00.500 and as we know the main file is called ZLogger here and just to refresh your memory I'm gonna do 'python' 00:01:00.500 --> 00:01:05.840 because this is a Python program followed by ZLogger which is the name of the program, 00:01:06.080 --> 00:01:07.960 followed by '--help'. 00:01:09.180 --> 00:01:14.140 I'm doing '--help' to see all the options that we can use with this program. 00:01:15.400 --> 00:01:20.420 Now, I spoke about all of these in details when I was generating the backdoor for Windows. 00:01:20.920 --> 00:01:25.640 So please go back and revise any of these options if you don't remember how they work. 00:01:25.740 --> 00:01:29.560 I don't wanna go over them again because that will be really boring. 00:01:30.420 --> 00:01:34.360 So what I'm actually gonna do, I'm just gonna go back to the command that I used 00:01:34.360 --> 00:01:40.680 when I generated the Windows keylogger and I'm gonna keep everything the exact same. 00:01:41.160 --> 00:01:46.120 The only thing that I'm gonna change is the '-w' argument right here 00:01:46.120 --> 00:01:52.620 because as I said in that lecture, we use '-w' to generate a keylogger for Windows, 00:01:52.840 --> 00:01:57.400 we're gonna use '-l' to generate the keylogger for Linux. 00:01:58.380 --> 00:02:03.660 So I'm gonna delete the 'w' and put an 'l' instead of it and that's it. 00:02:03.660 --> 00:02:06.400 That's literally everything that you need to do. 00:02:07.420 --> 00:02:13.340 And I'm also going to change the name of the keylogger to 'Linux-keylogger'. 00:02:14.820 --> 00:02:20.660 So let's go over the command just really, really quickly, so we're doing 'python' program name 00:02:20.660 --> 00:02:24.980 which is 'zlogger.py', we're setting the interval to '60' so that means 00:02:24.980 --> 00:02:31.260 I'm going to receive a report of all the key strikes entered by the user every 60 seconds. 00:02:31.760 --> 00:02:37.960 We're using '-l' to generate the key logger for Linux, we're setting the email 00:02:37.960 --> 00:02:42.320 that I want to receive the reports on using the '-e' argument. 00:02:42.860 --> 00:02:46.880 I'm using the '-p' argument to set the password of this email 00:02:47.300 --> 00:02:52.580 and finally, I'm using '-o' to set the name of the generated file. 00:02:53.400 --> 00:02:54.540 I'm gonna hit 'Enter'. 00:02:57.500 --> 00:03:02.160 And this will generate the keylogger for me and again at the end it's telling us 00:03:02.160 --> 00:03:06.700 to make sure that less secure applications are enabled on the account 00:03:06.700 --> 00:03:10.520 and I showed how to do that previously, so I'm not gonna go over it again. 00:03:11.680 --> 00:03:18.300 And just like before if we list the files, we'll see we have a 'dist' directory 00:03:18.300 --> 00:03:25.180 and if we list what's inside the 'dist', you'll see all the keyloggers that you generated using ZLogger. 00:03:25.580 --> 00:03:32.180 You can see I have the Windows keylogger here '.exe' and you can see we have our Linux keylogger in here. 00:03:33.200 --> 00:03:39.440 So again, similar to what I did before, I'm gonna copy this to my evil-files so I'm gonna use the 'cp' command. 00:03:39.780 --> 00:03:44.940 I'm gonna specify the file that I want to copy which is in dist 'Linux-keylogger' 00:03:45.320 --> 00:03:52.380 and I wanna copy it to 'var/www/html/evil-files/'. 00:03:53.540 --> 00:03:54.720 I'm gonna hit 'Enter' 00:03:55.220 --> 00:03:59.780 and that's it, copied and I've already started my web server so I can go 00:04:00.000 --> 00:04:10.060 and download it straight away from my Linux machine by going to '10.20.14.213/evil-files/Linux-keylogger'. 00:04:12.300 --> 00:04:18.640 It's asking me to save it, I'm gonna save it and it's gonna go into my downloads right here. 00:04:20.120 --> 00:04:24.380 Now when it comes to Linux you can't just double-click a binary to run it. 00:04:24.740 --> 00:04:28.700 You're gonna have to run it from terminal and I know this is very suspicious 00:04:29.060 --> 00:04:31.700 but we're gonna talk about delivery methods later on. 00:04:32.020 --> 00:04:38.160 So don't worry about this let's just focus on trying to get this keylogger to work properly. 00:04:39.220 --> 00:04:40.940 So I'm gonna open my terminal 00:04:42.400 --> 00:04:46.880 and I'm gonna navigate to where the keylogger is downloaded which is in my Downloads. 00:04:47.580 --> 00:04:50.980 So if I list now, we'll see it here Linux-keylogger 00:04:51.820 --> 00:04:55.400 and before we run it we're gonna have to change it to an executable. 00:04:55.680 --> 00:05:00.900 So we're gonna use this 'chmod' command to change the permissions for this file 00:05:01.180 --> 00:05:04.620 and we're gonna do '+x' to make it executable 00:05:04.960 --> 00:05:09.540 and we're gonna follow this by the file name which is 'linux-keylogger. 00:05:10.720 --> 00:05:16.400 I'm gonna hit 'Enter' and if I list again now, you'll see the file showing up in green 00:05:16.620 --> 00:05:20.500 which means that I can run it now as an executable. 00:05:21.320 --> 00:05:28.180 Now to run executables in Linux, you have to type './' followed by the executable name 00:05:28.460 --> 00:05:31.160 which is the linux-keylogger in my case. 00:05:32.320 --> 00:05:37.340 I'm gonna hit 'Enter' and that's it now the key logger is running in the background. 00:05:38.200 --> 00:05:43.420 Again don't worry if this looks suspicious, we'll talk about delivery methods later on. 00:05:44.500 --> 00:05:50.340 Now let's go to the Kali machine and go to my email and see if I got my initial report 00:05:50.340 --> 00:05:58.940 and perfect as you can see, I got my initial report and if I open that you'll see it's coming from a Linux computer, 00:05:58.940 --> 00:06:05.900 it's running Ubuntu, it's tell me the exact version of Ubuntu, the computer name is 'zaid-VirtualBox' 00:06:06.320 --> 00:06:08.020 and the Username is 'zaid'. 00:06:09.160 --> 00:06:14.120 Again, there is no 'logs' because at the moment the user did not type anything on their keyboard. 00:06:14.600 --> 00:06:19.380 So let's go and type something, let's just go to 'facebook.com' 00:06:20.880 --> 00:06:30.380 and put a username, let's put the username as 'Zaid' and put a password as '123456' 00:06:31.020 --> 00:06:38.520 Let's go back and see if we're gonna get a report of this, so I'm gonna click on the first report and perfect. 00:06:38.520 --> 00:06:42.360 You can see the user went to Facebook, they put the username, 00:06:42.365 --> 00:06:48.740 they made some mistakes so they press backspace, we can see the password was '123456' 00:06:48.740 --> 00:06:51.880 and everything is being logged properly. 00:06:53.220 --> 00:06:59.520 Now this is one part of the program, the other part is we want it to run with the system startup. 00:07:00.320 --> 00:07:05.700 So just like we did with Windows, let's close everything and restart the computer 00:07:07.340 --> 00:07:11.560 and let's see if the keylogger starts with the system startup. 00:07:15.100 --> 00:07:20.380 So I'm gonna log in and let's go ahead and open Firefox 00:07:22.260 --> 00:07:28.980 and let's go to 'twitter.com', log in 00:07:30.460 --> 00:07:38.960 and just put a username we'll say 'twitterusername' and put a password as '123456' 00:07:40.200 --> 00:07:44.941 and let's go to the Kali machine and see if we're gonna receive any reports. 00:07:44.941 --> 00:07:49.260 So I'm gonna go back to my Inbox, I'm gonna open the latest message, 00:07:49.560 --> 00:07:53.280 it's empty so that's probably sent before I entered anything. 00:07:53.960 --> 00:07:56.380 So let's go back and wait for the next one 00:07:58.720 --> 00:08:05.540 and here we go we got a report, let's open it and as you can see the user went to 'twitter.com', 00:08:05.800 --> 00:08:12.440 they put a 'twitterusername' as the username and they put the password as '123456'. 00:08:13.620 --> 00:08:18.560 So perfect, as you can see ZLogger is working perfectly for Windows and for Linux 00:08:18.560 --> 00:08:25.320 and it's allowing us to generate persistent remote keyloggers for both of these operating systems. 00:08:26.520 --> 00:08:31.600 Now like I said, if you're interested in learning how to write programs like ZLogger 00:08:31.600 --> 00:08:34.840 then check out my Python programming course, 00:08:34.840 --> 00:08:39.240 where I teach Python programming by writing hacking programs 00:08:39.240 --> 00:08:46.320 and one of the example programs that I show you how to program in that course is actually ZLogger. 00:08:47.740 --> 00:08:50.520 Now that everything is fine and everything is working perfectly, 00:08:50.940 --> 00:08:55.820 I just wanna show you how to remove the keylogger from the Linux machine 00:08:56.080 --> 00:09:00.780 because I know it will be annoying, if you keep receiving reports all the time from it 00:09:01.120 --> 00:09:04.080 especially, if these reports are not useful to you. 00:09:05.080 --> 00:09:07.700 So to remove this I'm going to open my terminal 00:09:08.560 --> 00:09:12.160 and I'm gonna go into a directory called '.config' 00:09:13.840 --> 00:09:19.600 and if we list the directories in here, you'll see we have a directory called 'autostart' 00:09:20.380 --> 00:09:21.860 so we're going to go into that 00:09:23.580 --> 00:09:29.480 and if we list here, you'll see there is a desktop entry called 'xinput'. 00:09:30.040 --> 00:09:33.960 Now this is what's making the program start with the startup. 00:09:34.800 --> 00:09:38.660 So I'm gonna do is, I'm going to remove this file using the 'rm' command 00:09:38.940 --> 00:09:42.020 so this command can be used to remove files in Linux 00:09:42.320 --> 00:09:46.420 and the file that I wanna remove is called 'xinput.desktop'. 00:09:47.060 --> 00:09:51.440 I'm gonna hit 'Enter' and if we list now the file is gone. 00:09:51.440 --> 00:09:57.700 So now if you restart the computer, ZLogger will not start with the system startup.