The Key Croc by Hak5 is a keylogger armed with pentest tools, remote access and payloads that trigger multi-vector attacks when chosen keywords are typed. It's the ultimate key-logging pentest implant.
More than just recording and streaming keystrokes online, it exploits the target with payloads that trigger when keywords of interest are typed.
By emulating trusted devices like serial, storage, HID and Ethernet, it opens multiple attack vectors – from keystroke injection to network hijacking.
Imagine capturing credentials and systematically using them to exfiltrate data. Or pentest from anywhere, live in a web browser with Cloud C2.
It's simple too. A hidden button turns it into a flash drive, where changing settings is just editing a text file. And with a root shell your favorite pentest tools like nmap, responder, impacket and metasploit are at the ready.
Orders are fulfilled from our California warehouse in 1-3 days. Typical shipping times:
Orders under $2500 are automatically protected against loss & damage via MonkProtect™ shipping insurance with a fast and easy resolution center.
Manufacturer: Hak5 LLC. 5473 Blair Rd, Ste 100 PMB 39371, Dallas, TX 75231. Shop@Hak5.org. https://shop.hak5.org
Responsible Person: Easy Access System Europe - Mustamäe tee 50, 10621 Tallinn, Estonia, gpsr.requests@easproject.com
Safety Information: Warning: Not suitable for children under 14 years. This is not a toy. Contains small parts that may present a choking hazard. Keep out of reach of children. Do not expose the device to water, excessive moisture, direct sunlight or extreme conditions (moisture, heat, cold, dust), as the device may malfunction or cease to work when exposed to such elements. Do not attempt to disassemble or repair the device yourself. Doing so voids the limited warranty and could harm you or the device. This device is not designed, manufactured or intended for use in hazardous environments requiring fail-safe performance in which the failure of the device could lead directly to death, personal injury, or severe physical or environmental damage. Wireless equipped devices are restricted to indoor use only when operating in the 2400 MHz – 2483.5 MHz frequency range within the EU and EFTA countries, as required by Article 10(10) of Directive 2014/53/EU. Battery equipped devices: do not dispose of batteries in household waste. Battery replacement must be carried out by a qualified technician. This USB-powered device complies with the EMC Directive (2014/30/EU) and meets the requirements of EN 55032 and EN 55035 for electromagnetic compatibility. This device is designed in accordance with USB-IF specifications for voltage limits, data integrity, and power safety to ensure reliable and compliant operation. This product has been designed and manufactured in accordance with the RoHS requirements and complies with the European Union’s Restriction of Hazardous Substances (RoHS) Directive 2011/65/EU and Directive (EU) 2015/863. This device is designed to operate reliably within an operating temperature range of 35ºC to 45ºC and a storage temperature range of -20ºC to 50ºC. It is rated for use in environments with 0% to 90% relative humidity (non-condensing). Proper environmental conditions must be maintained to ensure optimal performance and longevity. Made in China. This device is for authorized auditing and security analysis purposes only where permitted subject to local and international laws where applicable. Users are solely responsible for compliance with all laws of their locality. Hak5 LLC and affiliates claim no responsibility for unauthorized or unlawful use. This device is packaged with a limited warranty, the acceptance of which is a condition of sale. See Hak5.org for additional warranty details and limitations. Availability and performance of certain features, services and applications are device and network dependent and may not be available in all areas; additional terms, conditions and/or charges may apply. All features, functionality and other product specifications are subject to change without notice or obligation. Hak5 LLC reserves the right to make changes to the products description without notice. Hak5 LLC does not assume any liability that may occur due to the use or application of the product(s) described herein.
From the pioneers of Keystroke Injection comes the next generation of keylogging – with active attack payloads.
Trigger payloads when the target's typing matches a pattern – from a simple keyword to an advanced regular expression – even if the target makes a typo and hits backspace.
Save a number of keystrokes typed before or after a payload gets matched. Then use those keystrokes in a Cloud C2 notification, or actively against the target in an advanced payload.
Imagine capturing the keys pressed after a lock shortcut like [CTRL-ALT-DELETE] or [CTRL-CMD-Q], then using captured credentials to automatically trigger a silent network exfiltration payload.
Simultaneously emulate numerous trusted USB devices. Pass through and inject keystrokes with the HID attack mode. Gain network access to the target with the Ethernet attack mode. Present the Key Croc as a flash drive with the Storage attack mode. Even emulate a serial device for some crafty attacks using the Serial attack mode.
The full-featured Linux box has a root shell at the ready. And with its quad-core 1.2 GHz ARM CPU and desktop-class SSD, your favorite tools – from Nmap and Responder to Impacket and Metasploit are just a few commands away.
Pentest from anywhere online with the free self-hosted Cloud C2 and watch keystrokes in real-time. Or inject your own keystrokes live, exfiltrate loot, manage payloads, and even get a root shell for advanced attacks right from your web browser.
The Key Croc is already setup to record keystrokes out of the box. Just plug it in and away you go. It even clones the keyboard hardware IDs automatically.
Then to get the loot, simply press a hidden arming button. It'll become a flash drive, letting you copy logs by drag and drop.
Activating payloads and configuring settings like WiFi and SSH is as easy as editing a text file.
OK, the Key Croc from @Hak5 is pretty epic. I've been messing with it the past couple of days and the practical uses for this are endless.
— Dave Kennedy (@HackingDave) May 14, 2020
I'm a huge fan.
1.2ghz quad-core ARM7 with an 8GB SSD. The ability for c2 but also interact with keyboard sequences is awesome. pic.twitter.com/EiTAvUwWHu
I had the Key Croc waiting for a locking screen sequence after capturing the username and password and then logging in and delivering a TrevorC2 payload, closing the window, then locking the screen.
— Dave Kennedy (@HackingDave) May 14, 2020
The ability to interact with keystrokes and have a plant on a network is great. pic.twitter.com/uK2pRNlcdg