Is there a way to store multiple payloads?

[Sabri]

As the title said: is there a way to store multiple payloads on the Ducky? So I can choose once the Ducky is plugged which payload executes.

Thanks in advance.

[no42]

Firmware: Detour/Multi-Duck

m_duck.hex (Detour Duck(formerly Naked Duck))

Based off a request in the forum (Sorry cant remember who asked first?)

I spent many a month trying to work out if payloads could be delivered based on keyboard LEDs, or on push of a Keyboard button that triggers an LED (eg. CAPS_Lock).

This firmware supports multiple-payloads:

• inject.bin - default payload (will always run first)
• inject2.bin - NUM_LOCK
• inject3.bin - CAPS_LOCK
• inject4.bin - SCROLL_LOCK

Basically, inject.bin will always be triggered on Ducky insertion.

inject2/3/4.bin is triggered by ensuring only Num_Lock/Caps_Lock/Scroll_Lock Keyboard LED is lit, followed by pushing the button on the Ducky.

This projects Firmware was originally nicknamed The Naked Duck / Naked Ducky Edition as the Ducky has to be naked for you to push the button and trigger the 2nd/3rd payload. Version 2 developments, mean the Ducky can now trigger on solely lit LEDs (if multiple LEDs are lit the last LED will take priority)

Intended Purpose

One Ducky; Supporting 2x Operating Systems, Or staged Payloads:

• inject.bin - default file (simple 1-liner "DELAY 5000")
• inject2.bin - Windows XP Script/ Payload 2
• inject3.bin - OSX Script / Payload 3
• inject4.bin - Windows 7 Script / Payload 4

Multi OS Support

So on Windows Host, ensure Num_Lock is Lit, push the Ducky's button to deliver a Windows-based Payload.

On OSX, ensure Caps_Lock is Lit, push the Ducky's button to deliver an OSX-based Payload.

Multi Payload Support

By default inject.bin triggers on insertion of the Ducky.

You may depending on installed software (e.g. powershell) want to trigger one of two different payloads.

• Windows 7+ - Use Num_Lock for inject2.bin to utilise powershell
• Windows XP - Use Caps_Lock for inject3.bin to utilise other windows binaries (eg tftp to download payloads)

Reference: https://code.google.com/p/ducky-decode/wiki/Which_Firmware

Edited February 9, 2014 by midnitesnake