Common issues

Frequently asked questions

Device Fully Unresponsive

Symptoms

  • Unresponsive to button presses

  • Payload does not run

  • Does not appear as a HID or STORAGE device to the host

  • No LED

  • Appears as DFU device in device manager (or equivalent)

Cause

The USB Rubber Ducky is likely stuck in DFU mode. This happens by entering DFU mode (accidentally) by holding the button while inserting the Ducky to a host - some hosts will set a bit keeping the device in DFU mode resulting in the above symptoms.

Solution

  1. Ensure the button is not being permanently held down by the Sticker Mod.

  2. Do not hold the button while inserting the USB Rubber Ducky into a target system.

  3. To resume normal usage perform the following: https://shop.hak5.org/pages/dfu-reset

RED LED / Stuck in Arming mode

Symptoms

  • USB Rubber Ducky always mounts as a storage device automatically upon insert

  • LED is RED

  • Payload will not run

Cause(s)

  • No payload on root of SD card named inject.bin

  • inject.bin is misnamed (likely as a duplicate inject (2).bin or similar)

  • inject.bin is an empty file as a result of incomplete download or file transfer

  • SD Card file system is corrupt due to unsafe ejection during write (while transferring an inject.bin for example)

Solution(s)

  • Ensure your payload is correctly compiled, fully copied to the root of the SD card when in arming mode (ATTACKMODE STORAGE), and named inject.bin exactly.

  • Safely eject the Ducky after copying the inject.bin

Button unresponsive / Cannot enter Arming mode

Symptoms

  • Pressing the button does not put the USB Rubber Ducky in Arming mode (ATTACKMODE STORAGE)

Cause(s)

  • The currently installed payload provides a BUTTON_DEF that overrides the default but does not put the device into ATTACKMODE STORAGE

Solution(s)

Check your currently installed payload's source code (the DuckyScript that you used to generate the inject.bin). If the payload overrides the default BUTTON_DEF:

  1. Open the USB Rubber Ducky case

  2. Remove the SD Card

  3. Re-insert the USB Rubber Ducky into the host, confirm the LED is red

  4. While the USB Rubber Ducky is plugged into the host, re-insert the SD Card

  5. If the USB Rubber Ducky does not automatically mount the SD Card after a few seconds, press the button

  6. Replace the inject.bin with a payload that:

    1. Has a sufficient DELAY at the beginning of the payload giving you a window of opportunity to enter arming mode (ATTACKMODE STORAGE) by pressing the button to trigger the default button behavior

    2. Alter your BUTTON_DEF to include ATTACKMODE STORAGE

    3. Uses ATTACKMODE HID STORAGE instead of just ATTACKMODE HID

    4. Enters ATTACKMODE STORAGE at the end of your payload

    5. Provide an alternate behavior to your BUTTON_DEF based on logic (number of presses or host lock key state, etc)

Incorrect injection

Symptoms

  • STRING or key commands do not inject the correct key(s) on a target host

Causes

The target host uses a different keyboard layout than the payload was compiled for.

If the correct language was used at the time the payload was generated it is possible that language has incorrect values or missing keys.

Solutions

Use the correct keyboard language for the target host. See: PayloadStudio docs

Other

3rd party encoders

The USB Rubber Ducky has been around for over a decade! This leaves lots of room for now out of date information. Many old tutorials suggest using various "encoders" to compile your payload into a inject.bin. Hak5 originally provided a Java based command line encoder, replaced in 2018 in favor of a single file JSencoder that ran in your browser; both of which have been fully replaced by PayloadStudio. Any "encoder" besides PayloadStudio is fully unsupported and likely 3rd party; Expect inconsistent results.

PayloadStudio will work for original USB Rubber Duckies running DuckyScript 1.0 See: PayloadStudio docs

Windows 11 Notepad Input Lag

Recently Microsoft has updated Notepad on Windows 11; many sources (including those entirely unrelated to the USB Rubber Ducky) have reported numerous issues. Due to this we do not recommend using Notepad to test your payloads; instead use an alternative text editor, or even the Console within PayloadStudio. Symptoms: Input lag; jittery input while injecting keystrokes into Notepad. Solution: Use an alternative text editor, or even the Console within PayloadStudio.

Common questions

  • Can't change payload / How do I enter arming mode?

  • How do I press the button with the case still on?

First, make sure you've read up on the basics -- you will likely find the answer to your problem or question here:

Payload not working as intended

From time to time you might find a payload doesn't behave how you expect - most often these issues are caused by the payload itself. This could be anything from a logical flaw to a fundamental issue in what or how it is trying to do something. Unfortunately this category of problem is as broad of a topic and as open ended as any other programming language; Here are a couple general tips to help get you pointed in the right direction:

  • Try accomplishing the task manually before trying to fully automate it with a DuckyScript payload

  • The slower and less hidden a payload is, the easier it will be to debug and identify possible issues. Save the stealth and speed for after you get it working in the most basic case. "walk before you run"

Still having trouble? Head over to discord and ask for help. The Hak5 Discord server is not an official support channel. Remember that any help offered is by people spending their own time to do so. Be polite and treat others with respect. You can seek official support for Hak5 products at https://shop.hak5.org/pages/support.

Last updated