Common DuckyScript Payloads and What They're Testing For
The value of a DuckyScript payload in a security test isn't just "can we type keystrokes" - it's "what does this demonstrate about the target system's defenses?" A payload that opens CMD as administrator tests different controls than one that reads and exfiltrates clipboard contents. Understanding what each payload tests is what makes HID injection a useful security assessment tool rather than just a parlor trick.
All payloads in this article are designed to be demonstrable and safe. None of them install software, make network connections to external servers, exfiltrate real data, or modify system files. They demonstrate the attack surface and test specific security controls without causing lasting effects.
All payloads here are for use on systems you own or have explicit written authorization to test. Unauthorized use of HID injection payloads is illegal. Test in controlled environments.
Table of Contents
graph TD
subgraph "Privilege Escalation Tests"
P1[Payload 1: Open CMD as Admin] --> T1[Tests UAC prompt behavior]
T1 --> R1[Can scripts gain admin without user?]
end
subgraph "Data Exposure Tests"
P2[Payload 2: Read Clipboard] --> T2[Tests clipboard data access]
P6[Payload 6: Network Info] --> T6[Tests network config exposure]
T2 --> R2[Is sensitive data in clipboard?]
T6 --> R3[Are internal IPs/configs visible?]
end
subgraph "Physical Security Tests"
P3[Payload 3: Lock Workstation] --> T3[Tests screen lock enforcement]
T3 --> R4[Does policy auto-lock work?]
end
subgraph "Policy Compliance Tests"
P4[Payload 4: Open Browser URL] --> T4[Tests web filtering]
P7[Payload 7: PowerShell Policy] --> T7[Tests execution restrictions]
T4 --> R5[Can arbitrary URLs be opened?]
T7 --> R6[Is PowerShell properly restricted?]
end
Security assessment mapping - what each payload category tests and the questions they answer
- Payload 1: Open CMD as Administrator
- Payload 2: Read and Display Clipboard Contents
- Payload 3: Lock the Workstation
- Payload 4: Open Browser to a Specific URL
- Payload 5: Write a Security Alert in Notepad
- Payload 6: Display Network Information
- Payload 7: Check PowerShell Execution Policy
- Platform Notes and Adapting Payloads
Payload 1: Open CMD as Administrator
What it tests: UAC (User Account Control) effectiveness. If this payload succeeds and CMD opens with admin privileges, the account running on the machine has admin rights that can be elevated without a password prompt - which is a meaningful security finding in most enterprise environments where standard users shouldn't have admin.
REM Payload 1: Open CMD as Administrator REM Target: Windows 10/11 REM Tests: UAC, admin privileges, local admin policy DELAY 1000 GUI r DELAY 700 STRING cmd DELAY 300 CTRL SHIFT ENTER DELAY 1500
What you're looking for: If a UAC elevation prompt appears on screen, it indicates the machine requires user confirmation for admin elevation - UAC is functioning. If CMD opens directly with administrator privileges (check the title bar: "Administrator: Command Prompt") without a UAC prompt, the logged-in user has admin rights with UAC disabled or configured to auto-approve, which is a finding worth documenting.
A follow-up payload could type whoami /priv in the opened CMD window to show privilege level in the output.
Payload 2: Read and Display Clipboard Contents
What it tests: data exfiltration via keyboard automation. In a real attack, clipboard contents could be captured and sent to an attacker-controlled system. This safe version opens Notepad and pastes the clipboard contents there instead - demonstrating that clipboard data is accessible without any special permissions.
REM Payload 2: Display Clipboard Contents REM Target: Windows 10/11 DELAY 1000 GUI r DELAY 700 STRING notepad ENTER DELAY 1500 STRING === Clipboard contents captured via HID injection === ENTER ENTER CTRL v ENTER ENTER STRING === End of clipboard capture demonstration ===
What you're looking for: Whatever was in the clipboard (copied text, passwords, recently copied data) appears in the Notepad window. This demonstrates that a connected HID device can access clipboard data in ~3 seconds without any user action other than approving the initial Bluetooth pairing (for wireless) or physical access to a USB port.
In a real assessment: a password manager that stores copied credentials in the clipboard for 30 seconds, or a user who recently copied a password, would have that data exposed. The recommendation from this finding is to use clipboard managers with auto-clear timers or to avoid leaving sensitive data in the clipboard.
Payload 3: Lock the Workstation
What it tests: whether the machine can be locked programmatically, and as a meta-test, whether the machine was left unlocked in a scenario where it shouldn't be. This payload is also useful as a "cleanup" step at the end of a physical security assessment - lock all the machines you tested to remove the unlocked-machine finding.
REM Payload 3: Lock Workstation REM Target: Windows 10/11 DELAY 500 GUI l
What you're looking for: Does the machine lock? If yes - the lock screen mechanism works. If the machine was unlocked and unattended when this payload ran, that's a physical security finding regardless of whether locking works.
macOS equivalent: replace GUI l with CTRL SHIFT EJECT (older Macs) or CTRL COMMAND q (newer macOS).
Payload 4: Open Browser to a Specific URL
What it tests: browser execution from keyboard automation, ability to redirect user's browser to arbitrary content. In a real attack, this URL would be an attacker-controlled phishing page or a page that attempts browser exploits. The safe version opens a known, benign URL.
REM Payload 4: Open Browser to URL REM Target: Windows 10/11 DELAY 1000 GUI r DELAY 700 STRING https://infishark.com ENTER DELAY 3000
What you're looking for: Does the browser open to the URL? Is there any web filtering (DNS-based, proxy-based, or endpoint-based) that blocks the URL? If web filtering is in place, the browser will show a blocked page instead of the destination. If no filtering, the page loads directly.
A variant: use a URL to a web server you control that logs incoming requests. You can verify the payload executed and measure the time from payload trigger to browser request landing in your server logs - giving you the exact execution timeline.
Payload 5: Write a Security Alert in Notepad
What it tests: basic HID injection functionality and user awareness. This is the simplest useful payload - open a text editor and leave a visible message. It's the standard "proof of concept" payload that demonstrates the attack worked to non-technical stakeholders.
REM Payload 5: Security Awareness Message REM Target: Windows 10/11 DELAY 1000 GUI r DELAY 700 STRING notepad ENTER DELAY 1500 STRING ================================================ ENTER STRING SECURITY TEST - HID INJECTION DEMONSTRATION ENTER STRING ================================================ ENTER ENTER STRING This text was typed by an unauthorized Bluetooth keyboard. ENTER STRING A real attacker with similar access could have: ENTER STRING - Opened any application ENTER STRING - Run commands as the current user ENTER STRING - Accessed clipboard and browser history ENTER STRING - Downloaded and executed malicious software ENTER ENTER STRING If you see this message, report it to your IT security team.
What you're looking for: The Notepad window opens and the entire message is typed out correctly. Verify all characters are correct for the keyboard layout - the dashes, brackets, and symbols in the message may produce incorrect characters on non-US keyboard layouts.
This payload is excellent for security awareness demonstrations because it's completely non-destructive, immediately visible, and self-explanatory to someone who sees their screen. The message content can be customized for your specific assessment context.
Payload 6: Display Network Information
What it tests: access to network configuration from a standard user account. In a real attack, network information helps an attacker understand the environment (IP range, gateway, DNS server, other interfaces). This safe version writes network info to Notepad.
REM Payload 6: Capture Network Information REM Target: Windows 10/11 DELAY 1000 GUI r DELAY 700 STRING cmd ENTER DELAY 1000 STRING ipconfig /all > %TEMP%\netinfo.txt && notepad %TEMP%\netinfo.txt ENTER DELAY 2000
What you're looking for: The ipconfig output shows all network adapters, IP addresses, MAC addresses, DHCP server, and DNS server configuration. This information is accessible to any standard user account with no privilege escalation. In an enterprise assessment context, collecting this information across multiple machines gives a picture of the network topology.
Note: this payload writes a temporary file to disk (%TEMP%\netinfo.txt). Clean up by adding a payload step to delete the file, or manually delete after the test.
Payload 7: Check PowerShell Execution Policy
What it tests: PowerShell script execution restrictions. PowerShell execution policy controls whether PowerShell scripts can run. If the policy is "Unrestricted" or "Bypass", an attacker can run arbitrary PowerShell scripts. If it's "Restricted" or "AllSigned", script execution is constrained.
REM Payload 7: Check PowerShell Execution Policy REM Target: Windows 10/11 DELAY 1000 GUI r DELAY 700 STRING powershell ENTER DELAY 1500 STRING Get-ExecutionPolicy ENTER DELAY 1000 STRING powershell -ExecutionPolicy Bypass -Command "echo 'Bypass works'" ENTER DELAY 1000
What you're looking for: The Get-ExecutionPolicy output shows the current policy ("Restricted", "AllSigned", "RemoteSigned", "Unrestricted", "Bypass"). The second command tests whether the -ExecutionPolicy Bypass flag (commonly used to circumvent restrictions) works. If "Bypass works" appears in the output, PowerShell execution policy is not a meaningful control - an attacker can override it from the command line. This is a known Windows limitation and is documented by Microsoft, but many organizations still rely on execution policy as a control when it shouldn't be their only one.
Platform Notes and Adapting Payloads
All payloads above target Windows 10/11. Key differences for other platforms:
macOS: Replace GUI with COMMAND. The Run dialog equivalent is Spotlight (COMMAND+SPACE). Terminal opens with COMMAND+SPACE, then type "Terminal". The lock shortcut is CTRL+COMMAND+Q on macOS 10.13+. PowerShell is available on macOS but most payloads would use Terminal/zsh instead.
Linux (GNOME): GUI key opens the Activities overview. CTRL+ALT+T typically opens a terminal if configured. The lock shortcut is SUPER+L or META+L depending on desktop environment.
Keyboard layout: All STRING commands assume US QWERTY. On non-US keyboards, symbols like / : \ > will produce different characters. Either test on US layout machines or replace STRING commands that contain these characters with KEY commands for the specific key positions.
Default_delay: Add DEFAULT_DELAY 100 at the top of any payload running on a slow machine or remote desktop session. The 100ms between characters prevents dropped keystrokes on high-latency connections. It adds a few seconds to payload execution but prevents frustrating failures.
The BLEShark's file portal lets you maintain a library of these payloads, organized by purpose and target platform. Label them clearly, document what each one tests, and keep notes on which payloads worked reliably in which environments - that documentation is what turns a demonstration into a proper security finding report.