Jump to content

COMMAND SPACE not working with new Rubber Ducky on Mac


Recommended Posts


I have the newest version Rubber Ducky and am testing it out on Mac. I'm trying to use one of the demo payloads to open Spotlight, then launch TextEdit to type a message. I'm compiling the following code using Payload Studio:

REM Mac string typing test
DELAY 3000
DELAY 2000
REM Open Spotlight Search
REM Open the text editor
DELAY 2000
DELAY 2000
STRING Hello, World!

It seems like the COMMAND SPACE line doesn't work because Spotlight never opens. But if I plug in the Ducky with TextEdit already launched, it types the "TextEdit" string and then launches a new document with COMMAND n. So the keystrokes are being transmitted (including COMMAND) but it's the SPACE part which is not working.

Does anyone know what could be causing this?

Link to comment
Share on other sites

Thanks for replying – I'm using Payload Studio through the Hak5 site, not the JS encoder.

One bit of progress I've made is getting the F4 keystroke to work, which I also couldn't use before. That required setting a different keyboard PID (0220) but this doesn't fix the COMMAND SPACE issue. But perhaps another PID will get that working.

Link to comment
Share on other sites

I guess the Payload Studio may suffer from the same issue as the JS Encoder does. I generated a payload containing only


and encoded it with both Payload Studio and the JS Encoder. I then opened the two different inject.bin files in a hex editor and the contents were the same. But, after adjusting the JS Encoder in the way that eliminates the issues that multiple combinations of words/commands gets cut (linked in a post above), the JS Encoder produced a different output. Since the modified JS Encoder should produce a correct output that works, I assume that something is broken in Payload Studio.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...