Common issues
Frequently asked questions
- Unresponsive to button presses
- Payload does not run
- Does not appear as a
HID
orSTORAGE
device to the host - No LED
- Appears as DFU device in device manager (or equivalent)
The USB Rubber Ducky is likely stuck in DFU mode.
This happens by entering DFU mode (accidentally) by holding the button while inserting the Ducky to a host - some hosts will set a bit keeping the device in DFU mode resulting in the above symptoms.
- 1.Ensure the button is not being permanently held down by the Sticker Mod.
- 2.Do not hold the button while inserting the USB Rubber Ducky into a target system.
- 3.
- USB Rubber Ducky always mounts as a storage device automatically upon insert
- LED is RED
- Payload will not run
- No payload on root of SD card named
inject.bin
inject.bin
is misnamed (likely as a duplicateinject (2).bin
or similar)inject.bin
is an empty file as a result of incomplete download or file transfer- SD Card file system is corrupt due to unsafe ejection during write (while transferring an
inject.bin
for example)
- Ensure your payload is correctly compiled, fully copied to the root of the SD card when in arming mode (
ATTACKMODE STORAGE
), and namedinject.bin
exactly. - Safely eject the Ducky after copying the
inject.bin
- Pressing the button does not put the USB Rubber Ducky in Arming mode (
ATTACKMODE STORAGE
)
- The currently installed payload provides a
BUTTON_DEF
that overrides the default but does not put the device intoATTACKMODE STORAGE
Check your currently installed payload's source code (the DuckyScript that you used to generate the
inject.bin
). If the payload overrides the default BUTTON_DEF
:- 1.Open the USB Rubber Ducky case
- 2.Remove the SD Card
- 3.Re-insert the USB Rubber Ducky into the host, confirm the LED is red
- 4.While the USB Rubber Ducky is plugged into the host, re-insert the SD Card
- 5.If the USB Rubber Ducky does not automatically mount the SD Card after a few seconds, press the button
- 6.Replace the
inject.bin
with a payload that:- 1.Has a sufficient
DELAY
at the beginning of the payload giving you a window of opportunity to enter arming mode (ATTACKMODE STORAGE
) by pressing the button to trigger the default button behavior - 2.Alter your
BUTTON_DEF
to includeATTACKMODE STORAGE
- 3.Uses
ATTACKMODE HID STORAGE
instead of justATTACKMODE HID
- 4.Enters
ATTACKMODE STORAGE
at the end of your payload - 5.Provide an alternate behavior to your
BUTTON_DEF
based on logic (number of presses or host lock key state, etc)
- STRING or key commands do not inject the correct key(s) on a target host
The target host uses a different keyboard layout than the payload was compiled for.
If the correct language was used at the time the payload was generated it is possible that language has incorrect values or missing keys.
- Can't change payload / How do I enter arming mode?
- How do I press the button with the case still on?
First, make sure you've read up on the basics -- you will likely find the answer to your problem or question here:
From time to time you might find a payload doesn't behave how you expect - most often these issues are caused by the payload itself. This could be anything from a logical flaw to a fundamental issue in what or how it is trying to do something.
Unfortunately this category of problem is as broad of a topic and as open ended as any other programming language; Here are a couple general tips to help get you pointed in the right direction:
- Try accomplishing the task manually before trying to fully automate it with a DuckyScript payload
- The slower and less hidden a payload is, the easier it will be to debug and identify possible issues. Save the stealth and speed for after you get it working in the most basic case. "walk before you run"
Still having trouble? Head over to discord and ask for help.
The Hak5 Discord server is not an official support channel. Remember that any help offered is by people spending their own time to do so. Be polite and treat others with respect.
You can seek official support for Hak5 products at https://shop.hak5.org/pages/support.
Last modified 1mo ago