Advanced QUACK Commands

QUACK KEYCODE
KEYCODE will inject an arbitrary keystroke from a three byte scan code. This may be useful when used in conjunction with HOLD, for language agnostics payloads, or when testing multimedia and other extended key functions not explicitly defined in the language file.
EXAMPLE
1
QUACK KEYCODE 00,00,56
2
# This will type the '-' character from the numpad row
Copied!
QUACK ALTCODE
ALTCODE allows the printing of alt-codes on Windows systems only.
EXAMPLES
1
QUACK ALTCODE 168
2
# This will print an upside down questionmark
Copied!
1
QUACK ALTCODE 236
2
# This will print an infinity symbol
Copied!
QUACK HOLD AND RELEASE
HOLD will hold the specified key until QUACK RELEASE is issued. HOLD accepts either a KEYCODE or a STRING.
EXAMPLE
1
QUACK STRING G
2
QUACK HOLD STRING o
3
QUACK DELAY 1000
4
QUACK RELEASE
5
QUACK STRING d morning!
6
# This holds the o key for about 1 second, resulting in "Gooooooooooooooood morning!" (with the number of o's depending on the target's key-repeat setup.
Copied!
1
QUACK HOLD KEYCODE 00,00,52
2
QUACK DELAY 1000
3
QUACK RELEASE
4
# Holds the up arrow key for about 1 second
Copied!

TECHNICAL DETAIL
Each target interprets held keys differently. When holding the spacebar on your keyboard, the keyboard is not sending a multitude of spacebar scan codes – rather a single hold and release. As you watch your cursor cross the screen, the rate is determined by the operating system. 
QUACK LOCK AND UNLOCK
LOCK will prevent the attached keyboard from passing through keystrokes to the target. This may be useful in payloads which need to temporarily lock out the user while a sensitive keystroke injection attack is occuring. Keys pressed on the attached keyboard are not buffered while using LOCK and will not be typed once unlocked.
UNLOCK will allow the attached keyboard to pass through keystrokes to the target once more after the QUACK LOCK command is issued. 
BASH CONSIDERATIONS FOR QUACK STRING
The QUACK STRING command accepts strings interpreted by bash. Consider these key elements when using QUACK STRING.
QUACK STRING WITH QUOTES
When using special characters, such as the apostrophe in the example below, wrap the string with quotes – otherwise bash will be expecting a second apostrophe to complete the quote, and the interpretation will not be what you expect.
1
QUACK STRING "Isn't this a cool string"
Copied!
QUACK STRING AND ESCAPING SPECIAL CHARACTERS
Alternatively, special characters may be escaped rather than wrapping the string in quotes.
1
QUACK STRING Isn\'t this a cool string
Copied!
QUACK STRING WITH COMMAND SUBSTITUTION
Since QUACK STRING is interpreted by bash, command substitution may be used. In this example, the Key Croc will inject the keystrokes containing the output of the ifconfig command.
1
QUACK STRING "$(ifconfig usb0 | grep 'inet addr')"
Copied!
Compare this to the following, without the $() command substitution directive, which actually injects the keystrokes of the command in question.
1
QUACK STRING "ifconfig usb0 | grep 'inet addr'"
Copied!
​

Writing Payloads - Previous

The QUACK Command

Next - Writing Payloads

The LED Command

Last modified 8mo ago

Copy link

Contents

QUACK HOLD AND RELEASE

EXAMPLE

TECHNICAL DETAIL

QUACK LOCK AND UNLOCK

BASH CONSIDERATIONS FOR QUACK STRING

QUACK STRING WITH QUOTES

QUACK STRING AND ESCAPING SPECIAL CHARACTERS

QUACK STRING WITH COMMAND SUBSTITUTION