Comment on page
DuckyScript™ Quick Reference
DuckyScript™ is the programming language of the USB Rubber Ducky™, Hak5® hotplug attack gear and officially licensed devices (Trademark Hak5 LLC. Copyright © 2010 Hak5 LLC. All rights reserved.)
DuckyScript™ officially licensed and supported devices are backwards compatible with previous versions, excluding any device specific functionality.
E.g. DuckyScript™ 1.0 payloads written for the USB Rubber Ducky are valid DuckyScript™ 3.0 and will function on the New USB Rubber Ducky without modification
DuckyScript™ includes commands/syntax which only work on some devices. For example,
SAVEKEYSare DuckyScript™ commands which are only for Key Croc payloads and will not work on other devices.
REMcommand does not perform any keystroke injection functions.
REMgets its name from the word remark. While
REMmay be used to add vertical spacing within a payload, blank lines are also acceptable and will not be processed by the compiler.
REM This is a comment
Defining a comment block is simple! Start the comment with
REM_BLOCKand end the comment with
END_REM; everything in between will be considered a comment without the need to prepend every new line with
REM. Comment blocks can be especially useful when you have multiple lines to be included in a single comment or want to retain formatting.
Place at beginning of payload (besides ATTACKMODE) to act as dynamic
Any system that reflects CAPSLOCK will detect minimum required delay
Any system that does not reflect CAPSLOCK will hit the max delay of 3000ms
STRINGcommand keystroke injects (types) a series of keystrokes.
STRINGwill automatically interpret uppercase letters by holding the
SHIFTmodifier key where necessary. The
STRINGcommand will also automatically press the SPACE cursor key, however trailing spaces will be omitted.
STRING The quick brown fox jumps over the lazy dog
STRING, will inject a series of keystrokes then terminate with a carriage return (
STRINGLN _ _ _ USB _ _ _
STRINGLN __(.)< __(.)> __(.)= Rubber >(.)__ <(.)__ =(.)__
STRINGLN \___) \___) \___) Ducky! (___/ (___/ (___/
STRINGblocks can be used effectively to convert multiple lines into one without needing to prepend each line with
STRINGblocks strip leading white space and ignore new lines!
is the equivalent of
Or in this case:
STRINGLNblocks strip the first tab but will preserve all other formatting
is the equivalent of
Deploying this payload will produce the following keystroke injection on the target machine:
The cursor keys are used to navigate the cursor to a different position on the screen.
System keys are primarily used by the operating system for special functions and may be used to interact with both text areas and navigating the user interface.
Modifier keys held in combination with another key to perform a special function. Common keyboard combinations for the PC include the familiar
CTRL cfor copy,
CTRL xfor cut, and
CTRL vfor paste.
REM Windows Modifier Key Example
REM Open the RUN Dialog
REM Close the window
In addition to the basic modifier key combinations, such as
CTRL c, modifiers and keys may be combined arbitrarily.
COMMAND CTRL SHIFT
COMMAND OPTION SHIFT
CONTROL ALT DELETE
CTRL ALT DELETE
Injecting a modifier key alone without another key — such as pressing the
WINDOWSkey — may be achieved by prepending the modifier key with the
REM Example pressing Windows key alone
Lock keys toggle the lock state (on or off) and typically change the interpretation of subsequent keypresses. For example, caps lock generally makes all subsequent letter keys appear in uppercase.
DELAYcommand instructs the USB Rubber Ducky to momentarily pause execution of the payload. This is useful when deploying a payload which must "wait" for an element — such as a window — to load. The
DELAYcommand accepts the time parameter in milliseconds.
DELAY for 100 milliseconds (one tenth of a second)
The minimum delay value is 20.
DELAYcommand may also accept an integer variable.
VAR $WAIT = 500
DELAYtimings might differ slightly depending on the
ATTACKMODEthe USB Rubber Ducky is in when executing the
DELAYand depending on the target host.
By default, if no other button command is currently in use, pressing the button during payload execution will make the USB Rubber Ducky stop any further keystroke injection. It will then become an ordinary USB flash drive, commonly referred to as "arming mode".
Halts payload execution until a button press is detected. When this command is reached in the payload, no further execution will occur.
STRING Press the button...
STRING The button was pressed!
BUTTON_DEFcommand defines a function which will execute when the button is pressed anytime within the payload so long as the button control is not already in use by the
WAIT_FOR_BUTTON_PRESScommand or other such function.
STRINGLN The button was pressed.
STRINGLN Press the button with the next 10 seconds
DISABLE_BUTTONcommand prevents the button from calling the
ENABLE_BUTTONcommand allows pressing the button to call the
The USB Rubber Ducky includes an LED which may be helpful when deploying certain payloads where feedback is important.
LED_OFFcommand will disable all LED modes.
LED_Rcommand will enable the red LED.
LED_Gcommand will enable the green LED.