top of page
Search

Key Croc (Keylogger & Implant Hacking Hardware)

Key Croc (Keylogger & Implant Hacking Hardware) | Black Hat HQ

Key Croc (Smart Pattern-Matching Keylogger & Cyberattack Implant)


The Key Croc is far more than a keylogger. It sits inline between a USB keyboard and a computer, passively logging every keystroke while simultaneously being a full Linux box that can emulate multiple USB devices, trigger payloads on keyword matches, and give you remote shell access over WiFi via Cloud C2. Think of it as the Bash Bunny and a keylogger fused into one — with a brain.


Hardware Specifications


Component

Detail

CPU

ARM Quad-Core @ 1.2 GHz

RAM

512 MB

Storage

8 GB desktop-class SSD

OS

Debian Linux (full root shell)

WiFi

802.11 b/g/n, 2.4 GHz, internal antenna

Interface

USB 2.0 (USB-A host port for keyboard, USB-A plug for target)

Standards

USB 2.0

Dimensions

74 × 27 × 14 mm

Power

5V @ 1A (5W), bus-powered from target

Operating Temp

35°C – 45°C

LED

Multi-color status indicator

Button

Hidden arming button (bottom, paperclip-operated)

Boot Time

~8 seconds


How It Works - Three Modes


1. Attack Mode (default — LED off)


You plug the Key Croc between the keyboard and the target computer. It automatically clones the keyboard's USB hardware IDs (VID/PID, serial, manufacturer string) and presents itself to the target as that exact keyboard. The user types normally — keystrokes pass through transparently — but every key is also logged to a file on the internal SSD. The user notices nothing: no lag, no visual indicator, the LED is off.

Meanwhile, the Key Croc runs a pattern-matching engine in the background. It continuously scans the incoming keystroke stream for defined keywords or regex patterns. When a match fires, the corresponding payload executes automatically.


2. Arming Mode (LED blinking blue)


Press the hidden button on the bottom with a paperclip. Keystroke passthrough stops. The Key Croc presents itself as a USB flash drive (plus Ethernet adapter over USB, if configured). You can now:


  • Browse the LOOT folder and copy keylog files.

  • Edit config.txt to change settings (WiFi, SSH, keyboard layout, Cloud C2).

  • Deploy new payloads to the payloads folder.

  • Update firmware by dropping a file.


Eject the drive, press the button again, and it returns to Attack Mode seamlessly.


3. WiFi / Cloud C2 Mode


Configure WiFi credentials in config.txt and the Key Croc connects to a network and phones home to your Cloud C2 server. From the C2 dashboard you can:


  • Watch keystrokes in real-time — a live stream of everything the user is typing.

  • Inject keystrokes live — type commands directly into the target machine remotely.

  • Download loot — pull keylog files without physical retrieval.

  • Get a root shell — full SSH-like terminal access to the Key Croc's Debian OS.

  • Manage payloads — upload, modify, and trigger payloads remotely.

  • Change configuration — switch keyboard layouts, match patterns, capture settings.


Pattern Matching - The Defining Feature


This is what makes the Key Croc "smart." A traditional keylogger just records everything and you sift through it later. The Key Croc reacts in real time to what the user types.


The MATCH Command


Payloads use MATCH to define a trigger:


MATCH password:
    LED R 100
    ATTACKMODE HID STORAGE
    Q STRING notepad.exe
    Q DELAY 500
    Q STRING Keylogger activated.

This says: "when the user types the literal string password: followed by anything, do the following." The match can be:


  • Literal string — "password", "sudo", "admin", "confidential", "bitcoin", a specific username

  • Regular expression — complex patterns like credit card numbers, SSNs, API keys, SSH private key headers

  • Key combination — CTRL-ALT-DELETE, WIN-R, CTRL-SHIFT-ESC

  • Language-aware — DuckyScript 2.0 includes a language file with 2,000+ keys and commands per language, so patterns work across keyboard layouts


What Happens When a Match Fires


The payload can do anything the Key Croc's Linux environment and USB emulation allow:


  • Change the LED color as covert feedback (blink green when a password was captured)

  • Switch ATTACKMODE to present as Ethernet, serial, or storage

  • Inject keystrokes into the target (open a reverse shell, exfiltrate files, run commands)

  • Log the matched text plus context to a separate file

  • Connect to WiFi and exfiltrate the captured data

  • Run arbitrary Bash scripts on the Debian host


Multi-Vector USB Emulation (ATTACKMODE)


The Key Croc isn't limited to being a keyboard. It can simultaneously emulate multiple USB devices:


Mode

What the Target Sees

Use Case

HID

USB keyboard

Pass through + inject keystrokes

STORAGE

USB flash drive

Exfiltrate files, drop tools, retrieve logs

ECM (Ethernet)

USB Ethernet adapter

Network access to target, MITM, pivot point

SERIAL

USB serial device

Direct terminal access, crafty device attacks

RNDIS

USB Ethernet (Windows)

Network access on Windows targets


These can be stacked simultaneously — present as a keyboard AND Ethernet AND flash drive all at once. For example:


ATTACKMODE HID ECM STORAGE

The target sees a keyboard (pass-through working fine), a new Ethernet adapter (giving you network access), and a flash drive. A payload can copy files to the emulated flash drive, open a reverse shell over the emulated Ethernet, and inject keystrokes — all at once.


Hardware That Runs Real Tools


The Key Croc's ARM quad-core 1.2 GHz CPU, 512 MB RAM, 8 GB SSD, and full Debian Linux mean it's not just a script runner — it's a real computer. You can SSH in and:


bash

apt update && apt install nmap responder impacket-scripts metasploit-framework

Run Responder to poison LLMNR/NBT-NS on the emulated Ethernet interface. Run Impacket's secretsdump against the target over SMB. Run a reverse shell listener. Run nmap scans from inside the target's own USB bus. The possibilities expand dramatically beyond simple keystroke injection.


Deployment Scenarios


1. Password Harvesting — The Classic


Plant behind a target's keyboard. MATCH on common password prompts like "Password:" or "sudo". When the user types their password after the match, log it separately and blink the LED green for your own feedback. Retrieve the Croc days or weeks later.


2. Credential-Triggered Payload


MATCH on a specific username or employee ID. When that high-value target logs in, the payload fires: switches to ATTACKMODE ECM, gets a reverse shell, and gives you remote access to their machine exactly when they're authenticated. You now have their session.


3. Automated Exfiltration


Set up MATCH on keywords like "confidential", "passwords", "credentials", "SSN", or regex for credit card patterns. When the user opens a file or email containing those, inject keystrokes to CTRL-A CTRL-C, then save clipboard content or paste it somewhere accessible.


4. Network Pivot via ECM


A payload switches ATTACKMODE to include ECM. The Key Croc now presents an Ethernet adapter to the target. Run DHCP on the Croc, route traffic, and you have a covert network implant. Run Responder on the Croc to capture NetNTLMv2 hashes from the target and adjacent machines.


5. Screen Crab Combo


Darren Kitchen demonstrated this: Key Croc for keystroke capture + Screen Crab for HDMI screen capture = complete I/O compromise. The Key Croc captures what they type; the Screen Crab captures what they see. Both can exfiltrate over WiFi to the same Cloud C2 server.


6. Long-Term Physical APT


Deploy the Key Croc and leave it for months. With loop-mode storage (overwrite oldest logs when full), a MATCH-based keyword alerting system via Cloud C2, and the ability to inject new payloads remotely, you have a persistent hardware implant that requires no software on the target, survives reboots and OS reinstalls, and evades all EDR/AV.


Comparison: Key Croc vs. Other Hak5 USB Implants


Feature

Rubber Ducky

Bash Bunny

Key Croc

Form factor

USB flash drive

USB flash drive

Inline USB adapter

Keystroke injection

✅

✅

✅

Keystroke logging

❌

❌

✅

Pattern matching triggers

❌

❌

✅ (MATCH)

Multi-device emulation

HID only

HID, ECM, Storage, Serial

HID, ECM, Storage, Serial

WiFi / remote access

❌

❌

✅

Inline passthrough

❌

❌

✅ (keyboard still works)

Keyboard HWID cloning

N/A

N/A

✅ Automatic

Full Linux OS

❌

✅ (limited)

✅ Debian, root shell

CPU / Storage

ATtiny85 / tiny

ARM / limited

ARM Quad 1.2 GHz / 8 GB SSD

Cloud C2

❌

❌

✅

Real-time keystroke streaming

❌

❌

✅

Best for

Quick hit-and-run

Multi-stage attacks

Long-term persistence + intel


LED Status Reference


Color

Meaning

Green

Booting up

Red

Error state

Cyan

Configuring WiFi

Magenta

Configuring keylogger

Blue (blinking)

Arming mode — accessible as flash drive

Yellow

Disk full

White

No keyboard detected

Off

Attack mode — actively logging


Default Credentials


Username: root
Password: hak5croc
Hostname: croc

Key Limitations


  • USB keyboard only — won't work with Bluetooth keyboards or PS/2 keyboards (without adapters). Requires a USB keyboard that speaks standard HID.

  • Not all keyboards are compatible — some gaming keyboards, macro keyboards, or keyboards with non-standard HID descriptors (extra endpoints, custom drivers) may not pass through correctly or may cause detection issues.

  • WiFi is 2.4 GHz only — no 5 GHz support. If the target environment only has 5 GHz WiFi or the 2.4 GHz band is disabled/down, WiFi exfil won't work.

  • Gets warm — the quad-core CPU and SSD generate heat. The spec says 35–45°C operating temp. In tight spaces (behind a desk, in cable management), this could be a concern.

  • Physical size — at 74 × 27 × 14 mm, it's noticeable if someone looks at the back of their PC. In a mess of cables, it blends. On a clean desk or visible docking station, it stands out. Consider the target's cable management before deployment.


Quickstart


  1. Plug the Key Croc between the keyboard and target computer.

  2. Keyboard passthrough begins immediately. Keystrokes are logged automatically.

  3. Press the hidden arming button to stop logging and present as a flash drive.

  4. Edit config.txt — set keyboard layout (language), WiFi credentials, Cloud C2 server, SSH settings.

  5. Drop payload files into the payloads/ directory.

  6. Eject, press button again to resume Attack Mode.

  7. Monitor remotely via Cloud C2 or retrieve the device physically later.


Payload Example: Capture Passwords After "sudo"


# File: payload.txt in the payloads folder
# Trigger: when user types "sudo" followed by a space

MATCH sudo
    LED G 50
    # Wait a moment for user to type password
    DELAY 3000
    # Log the next 50 characters (the password) to a special file
    LOG_START /root/loot/sudo_passwords.txt
    LOG_KEYSTROKES 50
    LOG_STOP
    LED R 200
    LED OFF

This waits for sudo, blinks green, captures the next 50 characters typed (the password + newline + next command), appends them to a dedicated file, blinks red as confirmation, and goes dark again.


Enroll In Online Cybersecurity & Hacking Classes/Courses | Black Hat HQ

Comments

bottom of page