Key Croc Cygwin ssh root@192.168.1.36 Default Settings username: root password: hak5croc hostname: croc LED Status Indications Green – Booting up Red – Error Cyan – Configuring WiFi per config.txt Magenta – Configuring Keylogger Blue – Arming Mode Yellow – Disk Full White – No Keyboard Detected The Key Croc features a dedicated serial console from its arming mode. From serial, its Linux shell may be accessed. Serial console settings 115200/8N1 Baud: 115200 Data Bits: 8 Parity Bit: No Stop Bit: 1 Key Croc Commands MATCH – specifies a pattern (by string or regular expression) that must be typed in order to trigger payload execution SAVEKEYS – saves NEXT or LAST N keys to a specified file when the MATCH defined above this command is detected QUACK – injects keystrokes using Ducky Script 2.0 ATTACKMODE – specifies which device type (e.g. HID Keyboard, USB Storage, Serial or USB Ethernet) to emulate LED – controls the multi-color LED RELOAD_PAYLOADS – instructs the payload framework to reingest payloads from disk CHECK_PAYLOADS – checks the MATCH and SAVEKEYS syntax of the loaded payloads INSTALL_EXTRAS – installs optional third party tools KEYBOARD – reports if a keyboard is present or missing C2NOTIFY – sends a notification to the configured Cloud C2 server C2EXFIL – sends a file to the configured Cloud C2 server