The Hak5 USB Rubber Ducky revolutionized physical penetration testing by pioneering Keystroke Injection attacks. Learn how DuckyScript 3.0, hardware-level HID emulation, and logic-driven payloads operate—and how security teams can defend endpoints against unauthorized keystroke automation.
The Evolution of Keystroke Injection
While computers treat human keyboard input with inherent trust, malicious USB devices can abuse this trust by identifying as standard Human Interface Devices (HID). The Hak5 USB Rubber Ducky appears to the operating system as a generic keyboard, typing at over 1,000 words per minute to execute complex reconnaissance scripts, system configurations, or administrative commands in milliseconds.
🦆 What's New in DuckyScript 3.0
- Control Flow & Logic: Variables, IF/ELSE conditional branching, WHILE loops, and user-defined functions.
- OS & Lock State Detection: Dynamic payload steering based on CapsLock/NumLock LED feedback.
- Payload Storage & Storage Hiding: USB mass storage emulation with partition hiding and USB armory switching.
- USB Exfiltration: Direct data capture back onto MicroSD storage through binary serial emulation.
Sample DuckyScript 3.0 Structure
DuckyScript 3.0 allows penetration testers to write cross-platform payloads that adapt in real time to the host machine's environment:
REM Target System Information Gathering
DELAY 1000
GUI r
DELAY 200
STRING powershell -NoP -NonI -W Hidden -Exec Bypass
ENTER
DELAY 500
STRING Get-ComputerInfo | Out-File -FilePath $env:TEMP\sysinfo.txt
ENTERDefending Against HID Keystroke Injection
Organizations must treat untrusted physical USB ports as unauthenticated network ingress points. Implement the following physical security safeguards:
- Physical Port Blockers & Restrictions: Physically lock unused external USB ports in high-security facilities.
- Host-Level USB Filtering (USBArmor / DuckHunter): Implement software that monitors keystroke speed thresholds, immediately disconnecting devices that type faster than humanly possible.
- Enforce AppLocker / Software Restriction Policies: Prevent PowerShell, command prompts, and script interpreters from launching from unprivileged user profiles.
- Zero-Trust Session Lockout: Enforce 60-second screen lock timeouts and smartcard/YubiKey physical presence requirements.
Frequently Asked Questions (FAQ)
Can traditional antivirus stop a USB Rubber Ducky?
Traditional antivirus scanners monitor files on disk, whereas a Rubber Ducky executes keystrokes as if typed by a logged-in user. Modern EDR systems with behavioral analytics are required to intercept automated command executions.
What payload storage does the USB Rubber Ducky use?
The USB Rubber Ducky utilizes standard MicroSD storage, allowing operators to store multiple payload configurations, loot, and forensic scripts.