Screen Crab (Screen Grabbing Hacking Hardware)

Screen Crab (HDMI Man-In-The-Middle Implant)

The Screen Crab by Hak5 is a passive, inline HDMI screen grabber. You plug it between a computer and its monitor (or a console and TV, or any HDMI source and display), and it silently captures screenshots or video of everything on that screen. It's physically inconspicuous — it looks like a small inline adapter or dongle — and it can store captures locally to MicroSD or exfiltrate them over WiFi via Cloud C2.

Hardware Specifications

Component	Detail
Input	HDMI Type A (Female, full-size)
Output	HDMI Type A (Female, full-size)
HDMI Standard	HDMI 1.4 / DVI 1.0
Max Passthrough Resolution	4K (3840×2160) @ 30 Hz
Max Capture Resolution	Up to 1080p (1920×1080)
Storage	MicroSD (SDXC), supports up to 128 GB
WiFi	802.11 b/g/n, 2.4 GHz only
Frequency Range	2.412 – 2.4835 GHz
Antenna	Built-in dipole (internal)
Power	USB-C, 5V @ 1A (5W)
Dimensions	105 × 51 × 21 mm
Operating Temp	35°C – 45°C
Storage Temp	-20°C – 50°C
Humidity	0% – 90% (non-condensing)
LED	Multi-color status indicator (can be disabled for stealth)
Button	Physical button (can be disabled)

How It Works

The Screen Crab is 100% passive from the target's perspective. It sits inline on the HDMI cable — the video signal passes through transparently to the monitor at the source's native resolution (up to 4K@30Hz). The target user sees zero difference — no lag, no visual artifacts, no indication anything is in the chain.

Meanwhile, the Screen Crab's internal hardware taps that signal and captures frames at up to 1080p. It downscales if the input resolution is higher.

The HDMI passthrough is electrically passive — even if the Screen Crab loses power, the video signal still passes through. This is critical for stealth: if someone unplugs the USB power, the monitor doesn't go dark and raise suspicion.

Capture Modes

Configured via a simple config.txt file on the MicroSD card:

Mode	Description
Image (JPEG)	Captures still screenshots at a configured interval (default: 5 seconds)
Video	Captures full-motion video (lower resolution, frame-limited)
Triggered Capture	Capture on specific events

Storage Modes

• Fill-and-stop — captures until the MicroSD card is full, then stops.

• Continuous / Loop — when the card is full, deletes the oldest file to make room for the newest. With a 128 GB card, this can store nearly a year's worth of 5-second-interval JPEGs.

Configuration - Just A Text File

Out of the box, you insert a MicroSD card, power it on, and it auto-generates a config.txt with all default settings. You edit that file to customize. Options include:

capture_mode=image          # image or video
capture_interval=5          # seconds between captures
storage_mode=continuous     # continuous or stop_when_full
led_enabled=true            # disable for stealth
button_enabled=true         # disable to prevent tampering
wifi_ssid=YourWiFi          # client mode WiFi
wifi_password=YourPass
c2_server=your.c2.server    # Cloud C2 endpoint

The simplicity is the point — no web UI required for basic operation, no driver installs, no software. Configure, plug in, and walk away.

Exfiltration - Two Paths

1. Local (MicroSD)

The default and simplest. Plug it in, let it capture for days/weeks/months, retrieve the card, and review the captures offline. Zero network footprint. Zero detection risk.

2. Remote (WiFi + Cloud C2)

Connect the Screen Crab to a WiFi network and point it at a Cloud C2 server (self-hosted or Hak5-hosted). From the Cloud C2 web dashboard you can:

• Watch live — stream the captured screen in near-real-time.

• Download captures — pull JPEGs or video files remotely.

• Change settings — modify capture interval, modes, and WiFi config remotely.

• Manage multiple Crabs — all from a single Cloud C2 console.

With Cloud C2, you can physically plant the device and monitor it from anywhere in the world.

Physical Deployment Scenarios

The Classic: Desktop PC Monitor

Unplug the HDMI cable from the back of the monitor. Plug the Screen Crab into the monitor. Plug the HDMI cable into the Screen Crab. Connect USB power (to a spare USB port on the PC itself, or a USB power adapter). The user's monitor works exactly as before. Every 5 seconds, a JPEG of their screen lands on the MicroSD card.

Console / Kiosk / Digital Signage

Any device that outputs HDMI — game consoles, POS terminals, ATMs, digital signage players, medical displays, industrial control HMIs. The Screen Crab doesn't care about the source device type, only that it outputs HDMI.

The "IT Maintenance" Cover

Walk into a target office, claim you need to check the monitor connection, unplug and replug with the Screen Crab inserted, power it from a USB port on the PC. 30 seconds of physical access, plausible IT cover story.

Practical Red Team Use Cases

1. Credential harvesting via screen capture User logs into a web app, internal portal, or domain — their password is visible as dots on the login screen, but a screenshot catches the moment before submission, or captures the logged-in session with internal data exposed. Timed captures catch whatever is on screen when the interval fires.

2. Sensitive document / email capture User opens a sensitive document, email, or internal dashboard. Screenshots capture it. Over hours/days, you build an extensive visual record of what that user sees — emails, Slack/Teams messages, code, financial data, internal tools.

3. Remote worker compromise Plant the Screen Crab on a target's home office monitor during a physical access engagement. WiFi enabled, connecting to their home network. All screen content streams to Cloud C2. No malware, no persistence on the machine itself — purely physical implant.

4. C-level / executive monitoring High-value target. The Screen Crab on their monitor captures everything they see — board presentations, M&A documents, strategic plans, passwords in password managers. The passive nature means no EDR alerts, no network anomalies from a software implant, no process to hide.

5. IT admin / domain controller console Plant on the monitor of a domain admin or server console. Capture credential entry, privileged sessions, configuration changes, password resets. A goldmine for lateral movement intelligence.

Limitations & Operational Considerations

• Capture resolution capped at 1080p — if the source is outputting 4K, the Screen Crab downscales. Text will still be readable at 1080p in most cases, but very fine detail might be lost.

• WiFi is 2.4 GHz only — no 5 GHz support. In environments with heavy 2.4 GHz congestion or where 2.4 GHz is disabled, WiFi exfil won't work. Use local MicroSD storage as fallback.

• USB power required — you need a USB power source within cable distance of the HDMI ports. Most monitors have USB ports, and desktop PCs always do. But in tight installations, the USB cable may be the visually suspicious part.

• No HDCP stripping — if the source enforces HDCP (High-bandwidth Digital Content Protection), the Screen Crab cannot capture the signal. Most desktop PC outputs don't enforce HDCP for desktop content, but streaming services (Netflix, etc.) and some enterprise configurations will.

• Heat — the operating temperature spec is 35–45°C, and the unit does get warm during operation. In poorly ventilated spaces (behind a monitor, in a cable bundle), heat buildup is a real concern over long deployments.

• Physical size — at 105 × 51 × 21 mm, it's not tiny. It's noticeable if someone looks behind the monitor. On a cluttered desk with cable management, it blends in adequately. On a clean, minimalist setup, it stands out.

Comparison: Screen Crab vs. Software-Based Screen Capture

Aspect	Screen Crab (Hardware)	Software RAT / Keylogger
Detection by EDR/AV	Impossible — no software on target	High risk of detection
Network footprint	None (MicroSD mode) or minimal WiFi	C2 beaconing detectable
Physical access required	Yes — one-time plant	No — remote deployment
HDCP bypass	No	N/A (software captures framebuffer)
Persistence	Physical — survives reboots, reimages	Requires software persistence mechanisms
Retrieval risk	Physical retrieval or WiFi exfil	Network exfiltration detection
Cross-platform	Any HDMI source. OS-agnostic	OS-specific

They're complementary, not competing. The Screen Crab is the right choice when you have physical access, want zero detection risk on the target machine, and can tolerate the retrieval logistics.

Companion Tools That Pair Well

• Cloud C2 — remote management and live streaming. Essential for the WiFi exfil path.

• Key Croc — keystroke injection + screen capture combo gives you full I/O control.

• Packet Squirrel — network tap/manipulation. Combine with Screen Crab for simultaneous screen + network capture.

• O.MG Cable — if you can't get at the HDMI ports, the O.MG Cable gives you keystroke injection and payload delivery over USB. Different attack surface, same physical-access domain.

Please Donate Here