ATTACKMODE-example1.txt

REM The ATTACKMODE command may be used multiple times throughout a payload.
REM Changing the attack mode will cause the target to re-enumerate the device.

ATTACKMODE HID
DELAY 2000
STRINGLN The USB Rubber Ducky is functioning as a keyboard.
STRINGLN It will function as a flash drive for the next 30 seconds.
ATTACKMODE STORAGE
DELAY 30000
ATTACKMODE HID
DELAY 2000
STRINGLN Now the USB Rubber Ducky is back to functioning as only a keyboard.
STRINGLN For the next 30 seconds it will function as both keyboard and storage.
ATTACKMODE HID STORAGE
DELAY 30000
STRINGLN Now the USB Rubber Ducky will disable itself.
ATTACKMODE OFF

REM This payload will begin by enumerating as a HID keyboard.
REM The USB Rubber Ducky will then enumerate as a mass storage "flash drive" for 30 seconds.
REM Once more it will be enumerated as only a HID keyboard.
REM Next it will enumerate as both a HID keyboard and a mass storage "flash drive".
REM Finally, the device will seem to be disconnected.