2nd Key croc in C2 issues - uptime not counting and "view loot" not showing any files.

[Ughcomeon]

Hello

I am running two key croc's in Cloud C2.  My original Key croc #1 is working just fine.  Later today I added a 2nd Key croc to my C2 cloud and the "up time" will increment a few seconds then stop,  I also can not see any files under "view loot" on Key croc #2 from the C2 interface.  They are there when I go into USB mode, and navigate to the loot folder.

When I set up #2 I created (added) a new device to C2, gave it a different Device name and device description clicked save.  Then clicked on setup, downloaded the device config file and copied that to the new Key croc.

They have different IP addresses and different MAC addresses.  The 2nd key croc does capture keyboard input.

[Ughcomeon]

2021-04-09 12:22:16 Internal error: bucket not found
2021-04-09 12:22:06 Internal error: bucket not found
2021-04-09 12:21:55 Internal error: bucket not found
2021-04-09 12:21:45 Internal error: bucket not found
2021-04-09 12:21:37 Device 'KC2' has started up

These errors are from the Server log,

[Ughcomeon]

Both Key Croc's were plugged in at the same time

 

 

Under KC2 (Key Croc 2) the loot never shows up, it is there when I switch to arming mode and/or when I SSH in.  Loot is collected correctly. KC2 does seem to run slower in general.    KC1 and KC2 do have different device.config files downloaded from each created device.  I'm at the point now where I'm looking to return my 2nd key croc.  I have about 3 email into Hak5 but no responses yet.

[chrizree]

If you have them on the same local network; what happens if you connect one of the Crocs to a different network (that of course has access to the C2 instance)?

[HybridHen]

Having the same issue. - Single key croc on LAN and all the same symtomns. After a while (>1hr) croc shows as offline but I can still ssh into it

[Ughcomeon]

Well I finally got my replacement Key Croc and its doing the same thing.

2021-05-15 16:42:11 Internal error: bucket not found
2021-05-15 16:41:59 Internal error: bucket not found
2021-05-15 16:41:48 Internal error: bucket not found
2021-05-15 16:41:37 Internal error: bucket not found
2021-05-15 16:41:26 Internal error: bucket not found
2021-05-15 16:41:16 Internal error: bucket not found
2021-05-15 16:41:05 Internal error: bucket not found
2021-05-15 16:40:54 Internal error: bucket not found
2021-05-15 16:40:44 Internal error: bucket not found
2021-05-15 16:40:33 Internal error: bucket not found
2021-05-15 16:40:25 Device 'Key Croc 2' has started up
2021-05-15 16:38:33 Device 'Key Croc 2' had setup file downloaded by 192.168.0.100:43424
2021-05-15 16:38:18 Device 'Key Croc 2' created by cloud from 192.168.0.100:43306

ugh this stuff is junk, I give up I'm ready to send all my shit back.

[Ughcomeon]

I believe the issue with my 2nd croc and Cloud C2 has to do with the setup file coming from the Cloud C2.  I tested my "bad" croc (named KC2, later I deleted that and created "Key Croc 2") with the Device_config file from my good croc (named KC1) and it works as long as it's the only one on the network.  It shows up as KC1 (KC2 hardware) but functions correctly.  So I don't believe the key croc hardware is bad or has any corrupt files.

Does anyone know if you can edit a Device_config file?  I'd like to try and compare my KC1 and KC2 device_config files.

I'm running my setup on a Raspberry Pi4 using the c2-3.1.2_armv7_linux file. This is all on a stand alone network with a hotspot to the internet for license verification.

      

[chrizree]

I wouldn't edit the device.config files, but you can cat them and look at the contents. There's a lot of "binary garbage" but there are some clear text things in them that are vital. Server address or name and port that the Hak5 devices are speaking to the C2 instance on (2022) is visible.