Yesterday I received my Flipper Zero and after a long wait I was ready to tinker away with it.
After capturing some infrared signals and replicating them, it was time to test the legendary Bad USB functionality.
The content of this post is based on the GitHub page.
The BadUsb app on the Flipper Zero uses extended Ducky script syntax which is compatible with the classic USB Rubber Ducky 1.0 language but with extra components such as custom USB ID (how the keyboard is identified), ALT-codes (pressing ALT and numbers on the numpad) and the old SYSRQ command. Both \n and \r\n line endings are supported, empty lines are allowed and you can use spaces or tabs for line indentation.
The script is written in simple .txt files and can be copied over to the Flipper Zero using the Windows app for example, and it must be located in the correct Bad USB folder.
To use the Bad USB function, make sure to have a USB-C to USB-A cable that you connect between the Flipper and the computer that you want to run your script on.
Navigate to "Bad USB" in the main menu, select the script that you want to execute and then press run.
Almost instantly it will execute the keypresses that you preprogrammed.
Here is a simple example that helps you start a PowerShell window with administrative privileges.
GUI r
DELAY 500
STRING powershell
CTRL-SHIFT ENTER
DELAY 500
ALT Y
DELAY 500
STRING write-host "This script is running as admin"
ENTER
Spoof keyboard ID
You can set the custom ID of the Flipper USB HID device. ID command should be in the **first line** of script, it is executed before script run. VID and PID are hex codes and are mandatory. Manufacturer and Product are text strings and are optional.
ID, VID:PID Manufacturer:Product
Example: "ID 1234:abcd Flipper Devices:Flipper Zero".
Delay, comments, holding down
DELAY, one delay value in ms
DEFAULT_DELAY, delay value in ms before every next command
DEFAULTDELAY, alternative to DEFAULT_DELAY
REM, commenting is done by writing REM followed by a single line of text
HOLD, press and hold key until RELEASE command. Up to 5 keys can be held at the same time.
RELEASE, release key
Arrow keys
DOWNARROW / DOWN
LEFTARROW / LEFT
RIGHTARROW / RIGHT
UPARROW / UP
Various buttons
APP, same as MENU, context menu key (right-clicking)
BACKSPACE
BREAK
CAPSLOCK
DELETE
END
ENTER
ESCAPE / ESC
Fx, F1-F12 keys
HOME
INSERT
MENU, same as APP, context menu key (right-clicking)
NUMLOCK
PAGEDOWN
PAGEUP
PAUSE
PRINTSCREEN
SCROLLLOCK
SPACE
TAB
You can combine the following with a special key command or a single character.
CONTROL / CTRL
SHIFT
ALT
WINDOWS / GUI, the Windows key
CTRL-ALT, ctrl plus alt
CTRL-SHIFT, ctrl plus shift
ALT-SHIFT, alt plus shift
ALT-GUI, alt plus the Windows key
GUI-SHIFT, the Windows key plus shift
GUI-CTRL, the Windows key plus ctrl
Strings and delay between keypresses
STRING, print text string, such as writing something in a terminal
STRINGLN, print text string and press enter after it
STRINGDELAY, an alternative to STRING_DELAY
DEFAULT_STRING_DELAY, delay value in ms, applied to every appearing STRING command
DEFAULTSTRINGDELAY, alternative to DEFAULT_STRING_DELAY
REPEAT Number of additional repeats Repeat previous command
WAIT_FOR_BUTTON_PRESS, will wait for the user to press a button to continue script execution. Will wait indefinitely for a button to be pressed.
On Windows and some Linux systems, you can print characters by holding ALT key and entering its code on Numpad.
ALTCHAR, print single character
ALTSTRING, print text string using ALT+Numpad method
ALTCODE, same as ALTSTRING, presents in some Duckyscript implementations
Send SysRq command, which is a way to interact with the computer even in a frozen state.
SYSRQ, single character
Media keys
Some Media/Consumer Control keys can be pressed with "MEDIA" command
MEDIA, used with commands in the list below:
POWER
REBOOT
SLEEP
LOGOFF
EXIT
BRIGHT_UP, brightness up
BRIGHT_DOWN, brightness down
HOME
BACK
FORWARD
REFRESH
SNAPSHOT, take photo in a camera app
PLAY
PAUSE
PLAY_PAUSE
NEXT_TRACK
PREV_TRACK
STOP
EJECT
MUTE
VOLUME_UP
VOLUME_DOWN
FN, Fn/Globe key on Mac keyboard
GLOBE, special key or single character (Fn/Globe key commands for Mac/iPad)