|
| 1 | +import ctypes |
| 2 | +import random |
| 3 | +import time |
| 4 | +import sys |
| 5 | + |
| 6 | +user32 = ctypes.windll.user32 |
| 7 | +kernel32 = ctypes.windll.kernel32 |
| 8 | + |
| 9 | +keystrokes = 0 |
| 10 | +mouse_clicks = 0 |
| 11 | +double_clicks = 0 |
| 12 | + |
| 13 | + |
| 14 | +def get_last_input(): |
| 15 | + struct_lastinputinfo = ctypes.Structure() |
| 16 | + struct_lastinputinfo.cbSize = ctypes.sizeof(struct_lastinputinfo) |
| 17 | + |
| 18 | + # Get the last input registered |
| 19 | + user32.GetLastInputInfo(ctypes.byref(struct_lastinputinfo)) |
| 20 | + |
| 21 | + # Now determine how long the machine has been running |
| 22 | + run_time = kernel32.GetTickCount() |
| 23 | + elapsed = run_time - struct_lastinputinfo.dwTime |
| 24 | + print(f"[*] It's been {elapsed} milliseconds since the last input event.") |
| 25 | + return elapsed |
| 26 | + |
| 27 | + |
| 28 | +def get_key_press(): |
| 29 | + global mouse_clicks |
| 30 | + global keystrokes |
| 31 | + |
| 32 | + for i in range(0, 0xff): |
| 33 | + if user32.GetAsyncKeyState(i) == -32767: |
| 34 | + # 0x1 is the code for a left mouse click |
| 35 | + if i == 1: |
| 36 | + mouse_clicks += 1 |
| 37 | + return time.time() |
| 38 | + else: |
| 39 | + keystrokes += 1 |
| 40 | + return None |
| 41 | + |
| 42 | + |
| 43 | +def detect_sandbox(): |
| 44 | + global mouse_clicks |
| 45 | + global keystrokes |
| 46 | + |
| 47 | + max_keystrokes = random.randint(10, 25) |
| 48 | + max_mouse_clicks = random.randint(5, 25) |
| 49 | + |
| 50 | + double_clicks = 0 |
| 51 | + max_double_clicks = 10 |
| 52 | + double_click_threshold = 0.250 |
| 53 | + first_double_click = None |
| 54 | + |
| 55 | + average_mousetime = 0 |
| 56 | + max_input_threshold = 30000 |
| 57 | + |
| 58 | + previous_timestamp = None |
| 59 | + detection_complete = False |
| 60 | + |
| 61 | + last_input = get_last_input() |
| 62 | + |
| 63 | + # If we hit our threshold, let's bail out |
| 64 | + if last_input >= max_input_threshold: |
| 65 | + sys.exit(0) |
| 66 | + |
| 67 | + while not detection_complete: |
| 68 | + keypress_time = get_key_press() |
| 69 | + if keypress_time is not None and previous_timestamp is not None: |
| 70 | + |
| 71 | + # Calculate the time between double clicks |
| 72 | + elapsed = keypress_time - previous_timestamp |
| 73 | + |
| 74 | + # The user double clicked |
| 75 | + if elapsed <= double_click_threshold: |
| 76 | + double_clicks += 1 |
| 77 | + |
| 78 | + if first_double_click is None: |
| 79 | + # Grab the timestamp of the first double click |
| 80 | + first_double_click = time.time() |
| 81 | + |
| 82 | + else: |
| 83 | + # Did they try to emulate a rapid succession of clicks? |
| 84 | + if double_clicks == max_double_clicks: |
| 85 | + if keypress_time - first_double_click <= (max_double_clicks * double_click_threshold): |
| 86 | + sys.exit(0) |
| 87 | + |
| 88 | + # We are happy there's enough user input |
| 89 | + if keystrokes >= max_keystrokes and double_clicks >= max_double_clicks and mouse_clicks >= max_mouse_clicks: |
| 90 | + return |
| 91 | + previous_timestamp = keypress_time |
| 92 | + |
| 93 | + elif keypress_time is not None: |
| 94 | + previous_timestamp = keypress_time |
| 95 | + |
| 96 | + |
| 97 | +detect_sandbox() |
| 98 | +print("We are ok!") |
0 commit comments