dark_pyrro

Doing that operation shouldn't break the Croc

You have to create a new device.config file and transfer it to the Croc

I noted though that you connected to the Croc using C2, this will probably not work after formatting the udisk since no device.config file can be found

no idea, shouldn't take long

You can't be positioned on a mounted udisk if you at the same time want to format it. All files on the >udisk< (i.e. /dev/nandf), not all files in the Croc file system. However... if you don't want to do that and it seems too risky for you, then you have to revert to what I previously suggested and examine all of what's stored on the udisk and decide what should be there or not in order to free the storage space needed.

Factory reset doesn't touch the udisk, it's left as it is (more or less). To get a fresh start, the easiest way is to access the Croc using serial or ssh and run "udisk reformat"

For some reason, you have managed to fill the udisk storage to 100% This is the basic structure of the Croc udisk https://docs.hak5.org/key-croc/getting-started/files-and-directory-structure You have to try to remember what you have actively stored on the udisk, either by using a payload (that most likely stores things in the "loot" directory) or tools that you for might have copied to the "tools" directory that hasn't been deleted for some reason, or anything else in the root or directories on the udisk

OK, that shows there should be no real issue when it comes to lack of storage in the Croc internal file system. Run "udisk mount" (preferable unmount the Croc storage from the computer to which is attached, and when saying that meaning just to unmount it, not pull the Croc out of the USB port), and then run "df -h" once again.

You need to focus in your attempts to troubleshoot. That shows the internal file system of the Croc, not the udisk. So, you have to decide where you are short of storage. Is it on the internal file system or on the udisk (to where you are probably trying to copy the update file)? What's the output of "df -h" when you're connected to the Croc using ssh or serial?

well... ok, so you don't have enough storage on the Croc udisk, or?! I.e. you can't copy the file from the computer where you downloaded it to the Croc storage device that shows up on the computer when it's attached in arming mode, does that correctly describe your situation? If so, what have you stored on the Croc udisk that occupies storage space? Tools? Loot? anything else? You have to examine every part of the udisk to find what you need to remove in that case. I have almost 2 GB free on my pretty recently reset/updated Croc, so you must have something stored there that isn't originally on the Croc.

Don't understand what you mean; why do you need space for the update file if there's nothing to update? Where do you need to remove stuff to store things? On the udisk? Verifying the checksum is just a Google search away and depends on what OS you are using to verify it.

What you can do? Download the tar.gz update file and make sure it's correct after downloading it, i.e. verify the checksum.

What changes did you do? In what way did the factory reset fail?

Post Mark V questions in the Mark V section of the forums

when did it say that it didn't have enough storage before that (since you say "again")?

Do you have the local Pineapple web interface open at the same time as it's enrolled to the C2 server, like described in this post?

You will probably have to struggle with MAC Address Randomization used by mobile devices when/if they aren't connected to a WiFi network.

What "other page" are you referring to?

Post a screenshot of how the Croc storage looks like when you've put the tar.gz update file there

You shouldn't extract it, but do as the documentations says; "Do not extract the .tar.gz archive" If you are already on fw version 1.4, what are you trying to update to (since 1.4 is the latest available firmware version)?

I would consider this normal. There's no "click in to pop out", you have to pull it out without any aiding mechanism. The thing is that the USB-C connector is a bit in the way of the "path" that the Micro SD card needs to be fully released/pulled out. When in need, I usually just lift it gently with my fingernail and pull it out, or use a spudger to lift it. However, you shouldn't be needing to remove the Micro SD card in a normal situation, just use the button to put the Ducky in "arming mode" and access the content of the card.

It has the management AP, the open AP, the Evil WPA, etc. On top of that it can impersonate APs/ESSIDs as well. https://docs.hak5.org/wifi-pineapple/ui-overview/pineap https://docs.hak5.org/wifi-pineapple/ui-overview/settings#wifi Not all sure what you mean by that, but the Mark VII doesn't have cellular capabilities. You can see wireless devices, but identifying them as mobile phones specifically might not be successful all the time.

Is this a part of the payload?

You mean that you have access to the Croc using Cloud C2 and controlling it that way (or using ssh from the same network to which the Croc is connected)? When saying "example payload", are you referring to the example_payload.txt that came out of the box with the Croc (i.e. the MATCH on hello)? In what way are you going to remove the payload?

The device.config file should be located in /etc