> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/key-croc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/key-croc/writing-payloads/the-quack-command.md).

# The QUACK Command

The Key Croc introduces enhancements to the Ducky Script keystroke injection command set – known as Ducky Script 2.0. This version builds on the ubiquitous language for keystroke injection that debuted with the [USB Rubber Ducky](https://hak5.org/products/usb-rubber-ducky-deluxe) and was further enhanced with the [Bash Bunny](https://hak5.org/products/bash-bunny).

The following are the basic "`QUACK`" commands – named in honor of the Rubber Ducky that invented the keystroke injection attack.

In order to use Ducky Script 2.0, or `QUACK`, in a payload the attack mode must contain the `HID` option. This is the default attack mode on boot. See the [ATTACKMODE](/key-croc/writing-payloads/the-attackmode-command.md) section for information on additional attack mode options.

## DUCKY\_LANG

Specified in the config.txt file on the root of the udisk partition (`/root/udisk`) – the `DUCKY_LANG` option configures the keyboard layout to be used in keystroke injection attacks. This is important to note as different computers and keyboards use different layouts around the world. 

By default `DUCKY_LANG` is set to the US. Additional keyboard layouts are available from the languages directory on the Key Croc's USB Flash Disk (udisk). Language key maps are specified using the two letter country code.

### **EXAMPLE**

```
DUCKY_LANG DE
# For deployments in Germany. Sehr gut!
```

## Q

`Q` is an alias for `QUACK` that may be used as shorthand substitution anywhere that QUACK may be used. `Q` does not have any further meaning and is otherwise not very impressive.

## QUACK \<KEY NAME>

There are nearly 2000 compatible keys which may be used directly with the QUACK command. For example, "`QUACK y`" will type "`y`", and "`QUACK ENTER`" will press enter. Likewise, "`QUACK CTRL-c`" will hold the `Control` key and press `c`. Additionally, "`QUACK N`" will hold `Shift` and press `n` – since there is no capital N key on a keyboard.

For a complete list, edit the json file from the languages directory specified by your particular `DUCKY_LANG`. Any single key or key combination may be specified. Here are a few choice examples:

### **EXAMPLE**

```
GUI r
# Holds the "Windows Key" and presses r, opening the Run dialog on Windows systems.

CMD-SPACE
# Holds the Command key and presses the spacebar, opening the Spotlight Search on a Mac.

ALT-F2
# Holds the ALT key and presses F2, opening the "Enter a Command" dialog on many Linux distributions.

CTRL-ALT-DELETE
# Holds these beloved keys for a three finger salute.
```

### **TECHNICAL DETAIL**

By default, `QUACK` will use the modifiers on the left side of the keyboard when injecting keystrokes. This behavior may be changed, either by modifying the language file or by using the keycode option with a specific modifier scan code. Both left and right side modifiers are specified in the language file for any given key combination/ The first instance is given priority.&#x20;

{% hint style="info" %}
For example, `CTRL-c` can be pressed with the Control key on the left, or on the right side of the keyboard. This will result in either "`01,00,06`" or "`10,00,06`" scan code.
{% endhint %}

## QUACK STRING

`STRING` processes the text following taking special care to auto-shift. `STRING` can accept a single or multiple characters. There will be no `ENTER` or Carriage return key at the end of a `STRING` – so if one is desired it must be specified with its own `QUACK` command. `STRING` will automatically use `SHIFT` to capitalize a character.

### **EXAMPLE**

```
QUACK STRING The Quick Brown Fox Jumped Over The Lazy Dog
QUACK STRING "This string has special characters! Isn't it great?"
```

See the notes at the end of this section on handling requirements for `QUACK` `STRING` as it relates to quotes and escaping special bash characters.

## QUACK DELAY

`DELAY` creates a momentary pause in the ducky script. It is quite handy for creating a moment of pause between sequential commands that may take the target computer some time to process. `DELAY` time is specified in milliseconds from 1 to 10000. Multiple `DELAY` commands can be used to create longer delays.

### **EXAMPLE**

```
QUACK GUI r
QUACK DELAY 500
QUACK STRING cmd /k tree c:\
QUACK ENTER
# Open command prompt and list all files and folders on the C drive
```

{% hint style="info" %}
Note the 500 millisecond delay between the keyboard shortcut "`GUI r`" and the cmd command? That's because it takes a few milliseconds for the run dialog to appear before we can inject keystrokes. We don't typically think about these nuances as a human, but when you consider the Key Croc is one computer speaking to another, every millisecond counts.
{% endhint %}