derrod/liquidsky_keylogger

PoC for a keylogger using scapy to capture the LiquidSky client's network traffic. Also a missed opportunity to call it "LiquidSpy".

LiquidSky keylogger PoC

Little proof of concept keylogger for LiquidSky.

LiquidSky is using Protobuf for all communication between the server and client (Video is streamed over RTP). This communication is entirely unencrypted and contains data such as keystrokes, mouse movement and clipboard.

This tool decodes the protobuf messages and prints them in a human-readable form. It also has a keylogger mode that will print keypresses as readable text in near real-time.

It currently can sniff on local network interfaces or use a pcap file as input.

Usage

usage: liquidsky_keylogger.py [-h] [-p PCAP] [-k] [-u]

optional arguments:
  -h, --help            show this help message and exit
  -p PCAP, --pcap PCAP  Read pcap file as input
  -k, --keylogger       Keylogger mode (print keypresses)
  -u, --unfiltered      Print all packets (can be spammy!)

Keylogger mode will output characters in near real-time, special keys (e.g. Return) will be printed as (keyname) instead.

The default mode will print packets in a format similar to this:

[CLIENT->SERVER] KEYBOARD_ACTION_V2             | JSON: {"keyActionV2": {"scancode": 33, "vkey": 70}, "type": "KEYBOARD_ACTION_V2"}

The unfiltered switch will also cause ping/pongs and mouse movement to be printed, it can be very spammy.

Some more stuff

In proto/ you will find the .proto files extracted from the client. The protobuf messages are sent over TCP with what seems to be a proprietary protocol. Some notes on how those packets are built (not necessarily correct) can be found in the liquidsky_keylogger.py file.

In order to extract the .proto files I used Protod. In order to get the complete files and not just part of it I had to adjust the delta in line 274 from 1024 to 4096.

liquidsky_keylogger's Issues

Protobuf files are outdated and Protod no longer works

I'm not sure what changed, I guess it's a different compile option where the .proto files are not included within the executable. protobin_to_proto.py also does not appear to work unfortunately.

It's not really worth it for me to put in the time and effort requried to figure out how to get the new protocol as well. So I guess I'm going to leave this here. It is functional enough anyway.