The LED

Overview

The USB Rubber Ducky includes an LED which may be helpful when deploying certain payloads where feedback is important.
Keep in mind that without modification, the LED is not visible when the USB Rubber Ducky is enclosed in its Flash Drive case.
The default behavior of the LED, which may be overridden, is as follows:

Default Behaviors

LED Color
LED State
Indication
Green
Solid
Idle
Green
Blinking
Processing Payload
Red
Solid
No inject.bin found on root of SD card, or no SD card present.
The LED command allows you to control the red and green LEDs on the USB Rubber Ducky. Using the LED command will override the default behavior.

LED_OFF

The LED_OFF command will disable all LED modes.

Example

ATTACKMODE HID STORAGE
LED_OFF

Result

  • The LED will turn off.

LED_R

The LED_R command will enable the red LED.
To show only a red LED disable any default LED behavior (such as storage or payload processing) by executing LED_OFF before LED_R.

Example

ATTACKMODE HID STORAGE
WHILE TRUE
IF ($_CAPSLOCK_ON == TRUE) THEN
LED_OFF
LED_R
ELSE IF ($_CAPSLOCK_ON == FALSE) THEN
LED_OFF
END_IF
END_WHILE

Result

  • The LED will turn solid red while caps lock is on.

LED_G

The LED_G command will enable the green LED.

Example

ATTACKMODE HID STORAGE
BUTTON_DEF
LED_OFF
STOP_PAYLOAD
END_BUTTON
WHILE TRUE
LED_OFF
LED_G
DELAY 1000
LED_OFF
LED_R
DELAY 1000
END_WHILE
  • The LED will alternate between solid red and solid green at one second intervals.
  • Pressing the button will turn the LED off and stop the payload.

Example

ATTACKMODE HID STORAGE
WHILE TRUE
LED_R
WAIT_FOR_BUTTON_PRESS
LED_G
WAIT_FOR_BUTTON_PRESS
END_WHILE

Result

  • The LED will alternate between red and green on each button press.

Internal Variables

The following internal variables relate to the LED and may be used in your payload for advanced functions.

$_SYSTEM_LEDS_ENABLED

Default set TRUE. May be retrieved or set.
Boot and ATTACKMODE change LED.

$_STORAGE_LEDS_ENABLED

Default set TRUE. May be retrieved or set.
Blinks the LED red/green on storage read/write in ATTACKMODE STORAGE.

$_LED_CONTINUOUS_SHOW_STORAGE_ACTIVITY

Default set TRUE. May be retrieved or set.
The LED will light solid green when the storage has been inactive for longer than $_STORAGE_ACTIVITY_TIMEOUT (default 1000 ms). Otherwise, the LED will light red when active.

$_INJECTING_LEDS_ENABLED

Default set TRUE. May be retrieved or set.
The LED will blink green on payload execution.

$_EXFIL_LEDS_ENABLED

Default set TRUE. May be retrieved or set.
The LED will blink green during Keystroke Reflection.

$_LED_SHOW_CAPS

Toggles TRUE or FALSE based on whether the caps lock LED is set on or off by the host.
May only be retrieved. Cannot be set.

$_LED_SHOW_NUM

Toggles TRUE or FALSE based on whether the num lock LED is set on or off by the host.
May only be retrieved. Cannot be set.

$_LED_SHOW_SCROLL

Toggles TRUE or FALSE based on whether the scroll lock LED is set on or off by the host.
May only be retrieved. Cannot be set.
Copy link
On this page
Overview
Default Behaviors
LED_OFF
Example
LED_R
Example
LED_G
Example
Example
Internal Variables
$_SYSTEM_LEDS_ENABLED
$_STORAGE_LEDS_ENABLED
$_LED_CONTINUOUS_SHOW_STORAGE_ACTIVITY
$_INJECTING_LEDS_ENABLED
$_EXFIL_LEDS_ENABLED
$_LED_SHOW_CAPS
$_LED_SHOW_NUM
$_LED_SHOW_SCROLL