Configuration

Among the files and folders present on the USB flash disk is config.txt. Editing this file with a standard text editor (like Notepad on Windows, TextEdit on Mac, vim/nano on Linux) will let you configure settings such as keymap, WiFi, SSH and DNS.

MANDATORY CONFIGURATIONS

The only mandatory configuration is the language/keymap, which by default is set to US.

# Mandatory configurations:
# -------------------------

DUCKY_LANG us
# Specifies the keymap with the corresponding two letter json file name from the languages/ directory on the udisk. The default is US for a US English keyboard. Change this depending on the language/keymap of your target.

OPTIONAL CONFIGURATIONS

NETWORKING

WIFI_SSID [network name]
# Specifies the SSID of the WiFi network in which to connect.

WIFI_PASS [network password]
# Specifies the WPA-PSK passphrase for the WiFi network. 
# Omit this value for open networks.

# Omit BOTH WIFI_SSID & WIFI_PASS to reset configuration

SSH [ENABLE, DISABLE]
# If enabled, the Key Croc will be accessible by SSH in both attack and arming modes.

DNS [address 1] [address 2]
# Overrides the DNS setting provided by the WiFi network's DHCP server.

DEVICE IDENTIFIERS

VID [VID_0X<vid hex>]
# Overrides the cloned Vendor ID from the attached keyboard

PID [PID_0X<pid hex>]
# Overrides the cloned Product ID from the attached keyboard

MAN [MAN_label]
# Specifies the Manufacturer USB descriptor

PROD [PROD_label]
# Specifies the iProduct USB descriptor

SERIAL [serial]
# Specifies the iSerial USB descriptor

PROTECTED ARMING MODE

WARNING: MISCONFIGURATIONS BELOW WILL LOCK YOU OUT OF YOUR DEVICE.

ARMING_PASS [password]
# Requires [password] to be typed on the keyboard attached to the Key Croc to enter arming mode.

ARMING_TIMEOUT [seconds]
# (OPTIONAL WITH ARMING_PASS) Defining this adds a timeout to the protected arming mode listener

# EXAMPLE:
# ARMING_PASS hak5croc
# ARMING_TIMEOUT 5
#
# This allows 5 seconds to press the button after typing hak5croc on the attached keyboard