The LED

Overview

The USB Rubber Ducky includes an LED which may be helpful when deploying certain payloads where feedback is important.

Keep in mind that without modification, the LED is not visible when the USB Rubber Ducky is enclosed in its Flash Drive case.

The default behavior of the LED, which may be overridden, is as follows:

Default Behaviors

LED Color	LED State	Indication
Green	Solid	Idle
Green	Blinking	Processing Payload
Red	Solid	No inject.bin found on root of SD card, or no SD card present.

The LED command allows you to control the red and green LEDs on the USB Rubber Ducky. Using the LED command will override the default behavior.

Calling LED_G, LED_R, or LED_OFF will automatically disable all default LED behaviors

LED_OFF

The LED_OFF command will disable all LED modes.

Example

ATTACKMODE HID STORAGE
LED_OFF

Result

• The LED will turn off.

LED_R

The LED_R command will enable the red LED.

Example

ATTACKMODE HID STORAGE
WHILE TRUE
  IF ($_CAPSLOCK_ON == TRUE) THEN
    LED_R
  ELSE IF ($_CAPSLOCK_ON == FALSE) THEN
    LED_OFF
  END_IF
END_WHILE

Result

• The LED will turn solid red while caps lock is on.

LED_G

The LED_G command will enable the green LED.

Example

ATTACKMODE HID STORAGE

BUTTON_DEF
  LED_OFF
  STOP_PAYLOAD
END_BUTTON

WHILE TRUE
  LED_G
  DELAY 1000
  LED_R
  DELAY 1000
END_WHILE

• The LED will alternate between solid red and solid green at one second intervals.

• Pressing the button will turn the LED off and stop the payload.

Example

ATTACKMODE HID STORAGE

WHILE TRUE
  LED_R
  WAIT_FOR_BUTTON_PRESS
  LED_G
  WAIT_FOR_BUTTON_PRESS
END_WHILE

Result

• The LED will alternate between red and green after each button press.

Internal Variables

The following internal variables relate to the LED and may be used in your payload for advanced functions.

$_SYSTEM_LEDS_ENABLED

Default set TRUE. May be retrieved or set.

LED behaviors for boot, ATTACKMODE change, and idle (payload complete).

$_STORAGE_LEDS_ENABLED

Default set TRUE. May be retrieved or set.

When TRUE blinks the LED red/green on storage read/write in ATTACKMODE STORAGE.

$_LED_CONTINUOUS_SHOW_STORAGE_ACTIVITY

Default set FALSE. May be retrieved or set.

When set TRUE and in ATTACKMODE that includes STORAGE the LED will light solid green when the storage has been inactive for longer than $_STORAGE_ACTIVITY_TIMEOUT (default 1000 ms). Otherwise, the LED will light red when active.

$_INJECTING_LEDS_ENABLED

Default set TRUE. May be retrieved or set.

When TRUE the LED will blink green on payload execution.

$_EXFIL_LEDS_ENABLED

Default set TRUE. May be retrieved or set.

When TRUE the LED will blink green during Keystroke Reflection.

$_LED_SHOW_CAPS

Default set FALSE. May be retrieved or set.

When set TRUE will bind the GREEN LED state to the CAPSLOCK state.

$_LED_SHOW_NUM

Default set FALSE. May be retrieved or set.

When set TRUE will bind the RED LED state to the NUMLOCK state.

$_LED_SHOW_SCROLL

Default set FALSE. May be retrieved or set.

When set TRUE will bind the GREEN LED state to the SCROLLLOCK state.