Loot
In classic Hak5 fashion, the recorded keystrokes and other log files saved on the Key Croc can be found in the loot directory on the udisk. Payloads may save additional logs and other data to this loot directory. The Key Croc keylogging system saves two files by default:
croc_raw.log– these are the recorded keystrokes in scan code formatcroc_char.log– these are the recorded keystrokes in a human readable format derived from keymap language file specified byDUCKY_LANGinconfig.txt
Additionally, the payload framework will save a log entry to a matches.log file every time a payload is executed by a pattern match.
Technical note: While in Attack Mode, logs and optionally other data from additional payloads are written to /root/loot. When entering Arming Mode, the contents of
/root/loot are synchronized with the loot directory on the USB Flash Disk at /root/udisk/loot. See the guide on Understanding the Key Croc file system for more technical details on this special consideration.