> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/key-croc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/key-croc/writing-payloads/advanced-quack-commands.md).

# Advanced QUACK Commands

## QUACK KEYCODE

`KEYCODE` will inject an arbitrary keystroke from a three byte scan code. This may be useful when used in conjunction with `HOLD`, for language agnostics payloads, or when testing multimedia and other extended key functions not explicitly defined in the language file.

### **EXAMPLE**

```
QUACK KEYCODE 00,00,56
# This will type the '-' character from the numpad row
```

## QUACK ALTCODE

`ALTCODE` allows the printing of alt-codes on Windows systems only.

### **EXAMPLES**

```
QUACK ALTCODE 168
# This will print an upside down questionmark
```

```
QUACK ALTCODE 236
# This will print an infinity symbol
```

## QUACK HOLD AND RELEASE

`HOLD` will hold the specified key until `QUACK RELEASE` is issued. `HOLD` accepts either a `KEYCODE` or a `STRING`.

### **EXAMPLE**

```
QUACK STRING G
QUACK HOLD STRING o
QUACK DELAY 1000
QUACK RELEASE
QUACK STRING d morning!
# This holds the o key for about 1 second, resulting in "Gooooooooooooooood morning!" (with the number of o's depending on the target's key-repeat setup.
```

```
QUACK HOLD KEYCODE 00,00,52
QUACK DELAY 1000
QUACK RELEASE
# Holds the up arrow key for about 1 second
```

###  **TECHNICAL DETAIL**

Each target interprets held keys differently. When holding the spacebar on your keyboard, the keyboard is not sending a multitude of spacebar scan codes – rather a single hold and release. As you watch your cursor cross the screen, the rate is determined by the operating system. 

## QUACK LOCK AND UNLOCK

`LOCK` will prevent the attached keyboard from passing through keystrokes to the target. This may be useful in payloads which need to temporarily lock out the user while a sensitive keystroke injection attack is occuring. Keys pressed on the attached keyboard are not buffered while using `LOCK` and will not be typed once unlocked.

`UNLOCK` will allow the attached keyboard to pass through keystrokes to the target once more after the `QUACK LOCK` command is issued. 

## BASH CONSIDERATIONS FOR QUACK STRING

The `QUACK STRING` command accepts strings interpreted by bash. Consider these key elements when using `QUACK STRING`.

### **QUACK STRING WITH QUOTES**

When using special characters, such as the apostrophe in the example below, wrap the string with quotes – otherwise bash will be expecting a second apostrophe to complete the quote, and the interpretation will not be what you expect.

```
QUACK STRING "Isn't this a cool string"
```

### **QUACK STRING AND ESCAPING SPECIAL CHARACTERS**

Alternatively, special characters may be escaped rather than wrapping the string in quotes.

```
QUACK STRING Isn\'t this a cool string
```

### **QUACK STRING WITH COMMAND SUBSTITUTION**

Since `QUACK STRING` is interpreted by bash, command substitution may be used. In this example, the Key Croc will inject the keystrokes containing the output of the ifconfig command.

```
QUACK STRING "$(ifconfig usb0 | grep 'inet addr')"
```

Compare this to the following, without the `$()` command substitution directive, which actually injects the keystrokes of the command in question.

```
QUACK STRING "ifconfig usb0 | grep 'inet addr'"
```