> ## Documentation Index
> Fetch the complete documentation index at: https://stem-docs.intellectualpoint.com/llms.txt
> Use this file to discover all available pages before exploring further.

# The RickRoll payload

> Write, compile, and deploy your first DuckyScript payload  -  the legendary RickRoll.

## The mission

Your first real Rubber Ducky payload is a classic: **open the target computer's web browser and play "Never Gonna Give You Up" by Rick Astley.**

This is a harmless prank payload, but it teaches you the exact same workflow used in professional penetration testing:

1. Write a script that automates keyboard actions
2. Compile it into a binary the hardware can execute
3. Deploy it to a target system

The only difference between this RickRoll and a real-world attack payload is what commands you type. The process is identical.

<Info>
  RickRolling has been an internet tradition since 2007. The original "Never Gonna Give You Up" music video has over 1.5 billion views on YouTube  -  many of them from people who clicked a link expecting something else entirely.
</Info>

***

## The payload

Here is the complete RickRoll payload. Read through it before typing it into PayloadStudio.

```duckyscript theme={null}
REM Opens default browser and plays Rickroll video

DELAY 1000
REM Open Run dialog (Windows+R)
GUI r
DELAY 500

REM Type the URL and press Enter
STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ
ENTER
```

That's it  -  six lines of actual commands (plus comments). Let's break down exactly what each line does and why it's there.

***

## Line-by-line walkthrough

<AccordionGroup>
  <Accordion title="Line 1: REM Opens default browser and plays Rickroll video" icon="hash">
    ```duckyscript theme={null}
    REM Opens default browser and plays Rickroll video
    ```

    `REM` stands for "remark." This is a **comment**  -  the Rubber Ducky ignores it completely. Comments exist for you, the developer. They explain what the payload does so you (or someone else) can understand the code later.

    Every payload you write should start with a `REM` line describing its purpose.
  </Accordion>

  <Accordion title="Line 2: DELAY 1000" icon="clock">
    ```duckyscript theme={null}
    DELAY 1000
    ```

    Wait **1000 milliseconds** (1 second) before doing anything. This pause is critical.

    When you plug the Rubber Ducky into a USB port, the computer needs time to:

    * Detect the new USB device
    * Load the HID keyboard driver
    * Register the device as an input source

    If the payload starts typing before the computer is ready, keystrokes are lost. One second is usually enough for modern computers, but you may need to increase this to `DELAY 2000` on slower machines.
  </Accordion>

  <Accordion title="Line 3: GUI r" icon="monitor">
    ```duckyscript theme={null}
    GUI r
    ```

    Press **Windows + R**. This keyboard shortcut opens the **Run dialog** on Windows  -  a small text box where you can type commands or URLs.

    The Run dialog is one of the most useful tools in a Rubber Ducky payload because:

    * It's available on every Windows computer
    * It accepts URLs (which open in the default browser)
    * It accepts system commands (like `cmd`, `powershell`, `notepad`)
    * It requires no mouse interaction  -  everything is keyboard-driven
  </Accordion>

  <Accordion title="Line 4: DELAY 500" icon="clock">
    ```duckyscript theme={null}
    DELAY 500
    ```

    Wait **500 milliseconds** (half a second) for the Run dialog to appear on screen. Without this delay, the next `STRING` command would start typing before the dialog is ready, and the keystrokes would go nowhere  -  or worse, into whatever application was in focus.

    Delays between actions are the most common source of payload failures. When in doubt, add more time.
  </Accordion>

  <Accordion title="Line 5: STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ" icon="keyboard">
    ```duckyscript theme={null}
    STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ
    ```

    Type the YouTube URL for "Never Gonna Give You Up" into the Run dialog. The `STRING` command types every character exactly as written  -  including the `://`, the `.`, and the `?v=` parameters.

    When Windows sees a URL typed into the Run dialog and you press Enter, it opens the URL in your default web browser. This is how the payload gets from "typing text" to "playing a video."
  </Accordion>

  <Accordion title="Line 6: ENTER" icon="play">
    ```duckyscript theme={null}
    ENTER
    ```

    Press the **Enter key**. This executes whatever is typed in the Run dialog  -  in this case, the YouTube URL. The default browser opens and navigates to the video. Rick Astley starts singing.

    Mission accomplished.
  </Accordion>
</AccordionGroup>

***

## Step-by-step deployment

Now that you understand every line, it's time to build and deploy the payload.

<Steps>
  <Step title="Open PayloadStudio">
    Go to [payloadstudio.hak5.org](https://payloadstudio.hak5.org) in your web browser. Make sure you're logged in with your PRO license (see the [PayloadStudio setup](/cybersecurity/day-5/payload-studio-setup) page if you haven't activated it yet).
  </Step>

  <Step title="Create a new payload">
    Start with a clean editor. If there's existing code from a previous session, clear it out.
  </Step>

  <Step title="Type the RickRoll payload">
    Type (or paste) the following code into the editor:

    ```duckyscript theme={null}
    REM Opens default browser and plays Rickroll video

    DELAY 1000
    REM Open Run dialog (Windows+R)
    GUI r
    DELAY 500

    REM Type the URL and press Enter
    STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ
    ENTER
    ```

    Check for any red error highlights from PayloadStudio PRO. If you see errors, double-check your spelling and formatting.
  </Step>

  <Step title="Compile the payload">
    Click **"Generate Payload"** (or the compile button). PayloadStudio compiles your DuckyScript into a binary `inject.bin` file that the Rubber Ducky hardware can execute.
  </Step>

  <Step title="Download inject.bin">
    Download the compiled `inject.bin` file to your computer. Remember where you saved it  -  you'll need to find it in the next step.
  </Step>

  <Step title="Connect your Rubber Ducky in arming mode">
    Plug the USB Rubber Ducky into your computer. It should appear as a removable drive labeled **DUCKY**. If it starts executing a previous payload instead, press the **push button** on the device to enter arming mode.
  </Step>

  <Step title="Copy inject.bin to the DUCKY drive">
    Open the DUCKY drive in File Explorer. Copy your downloaded `inject.bin` file to the root of the drive, **replacing** any existing `inject.bin` file.
  </Step>

  <Step title="Safely eject the drive">
    Right-click the DUCKY drive and select **Eject**. Wait for the "safe to remove" confirmation before unplugging the device. This ensures the file is fully written.
  </Step>

  <Step title="Test on your own computer">
    Open your computer normally. Make sure no important unsaved work is open (the payload will open a browser window). Plug the Rubber Ducky in and watch the magic happen.

    You should see:

    1. A brief pause (the `DELAY 1000`)
    2. The Run dialog flashes open
    3. The YouTube URL appears in the Run dialog
    4. Your browser opens to Rick Astley's masterpiece
  </Step>
</Steps>

<Check>
  If "Never Gonna Give You Up" started playing in your browser, congratulations  -  you've successfully written, compiled, and deployed your first USB Rubber Ducky payload. You are now a DuckyScript developer.
</Check>

***

## Troubleshooting

If your payload didn't work as expected, check these common issues.

<AccordionGroup>
  <Accordion title="The Run dialog didn't open">
    The most likely cause is the initial `DELAY` was too short. Your computer may need more time to recognize the Rubber Ducky as a keyboard device.

    **Fix:** Increase `DELAY 1000` to `DELAY 2000` or even `DELAY 3000`. Recompile, reload, and try again.

    Also check that you typed `GUI r` (with a lowercase "r"), not `GUI R`. DuckyScript key modifiers are case-sensitive for letter keys.
  </Accordion>

  <Accordion title="The URL didn't type correctly">
    DuckyScript assumes a **US keyboard layout** by default. If your computer uses a different keyboard layout (UK, French, German, etc.), some characters  -  especially symbols like `:`, `/`, `?`, and `=`  -  may map to different keys.

    **Fix:** Make sure your computer's keyboard layout is set to **US English** before testing. On Windows, check **Settings → Time & Language → Language → Keyboard**.
  </Accordion>

  <Accordion title="Nothing happened at all">
    A few things to check:

    1. **Did you compile the payload?** You need to click "Generate Payload" in PayloadStudio. If you only saved the `.txt` source file to the Rubber Ducky, it won't execute.
    2. **Is the file named inject.bin?** The Rubber Ducky only looks for a file named exactly `inject.bin` in the root of the microSD card.
    3. **Did you eject safely?** If you unplugged without ejecting, the file may not have been fully written.
    4. **Is the Rubber Ducky in attack mode?** If you pressed the button, it may still be in arming mode. Unplug it, wait a moment, and plug it back in without pressing the button.
  </Accordion>

  <Accordion title="How do I get back to arming mode?">
    If the Rubber Ducky is executing a payload (or you need to load a new one), press the **push button** on the device while it's plugged in. This switches it from attack mode back to arming mode, where it appears as a flash drive.

    On some Rubber Ducky models, you may need to hold the button for a second or two.
  </Accordion>

  <Accordion title="The payload ran but the browser didn't open">
    The `STRING` command typed the URL, but the browser didn't launch. This can happen if:

    * The Run dialog wasn't fully ready when `STRING` started typing. **Fix:** Increase `DELAY 500` to `DELAY 1000`.
    * The URL was partially typed into the wrong window. **Fix:** Make sure no other application grabs focus during the payload. Close unnecessary windows before testing.
    * The computer doesn't have a default browser set. **Fix:** Set a default browser in Windows Settings → Apps → Default Apps.
  </Accordion>
</AccordionGroup>

***

## Bonus challenges

Finished the RickRoll? Try these modifications to deepen your DuckyScript skills.

<Tabs>
  <Tab title="Different video">
    **Difficulty:** Beginner

    Modify the payload to open a different YouTube video. Find a video you like, copy its URL, and replace the RickRoll URL in your payload.

    ```duckyscript theme={null}
    REM Opens a different video
    DELAY 1000
    GUI r
    DELAY 500
    STRING https://www.youtube.com/watch?v=YOUR_VIDEO_ID_HERE
    ENTER
    ```

    Replace `YOUR_VIDEO_ID_HERE` with the actual video ID from the YouTube URL.
  </Tab>

  <Tab title="LED status indicator">
    **Difficulty:** Beginner

    Add LED feedback so you can see when the payload is running and when it's done.

    ```duckyscript theme={null}
    REM RickRoll with LED status indicator
    LED_R
    DELAY 1000
    GUI r
    DELAY 500
    STRING https://www.youtube.com/watch?v=dQw4w9WgXcQ
    ENTER
    DELAY 500
    LED_G
    ```

    The red LED turns on when the payload starts. After the URL is submitted, it switches to green  -  signaling success.
  </Tab>

  <Tab title="Notepad message">
    **Difficulty:** Intermediate

    Write a payload that opens Notepad and types a custom message.

    ```duckyscript theme={null}
    REM Opens Notepad and types a message
    DELAY 1000
    GUI r
    DELAY 500
    STRING notepad
    ENTER
    DELAY 1000
    STRING You've been hacked!
    DELAY 500
    STRINGLN Just kidding. This is a USB Rubber Ducky demo.
    STRINGLN Your computer trusts keyboards unconditionally.
    STRINGLN That's why keystroke injection works.
    ```

    Notice the use of `STRINGLN`  -  it types the text and presses Enter, moving to the next line.
  </Tab>

  <Tab title="Desktop wallpaper change">
    **Difficulty:** Advanced

    This payload opens PowerShell and runs a command to download an image and set it as the desktop wallpaper.

    ```duckyscript theme={null}
    REM Change desktop wallpaper (Windows)
    DELAY 1000
    GUI r
    DELAY 500
    STRING powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://upload.wikimedia.org/wikipedia/en/1/13/Rick_Astley_-_Never_Gonna_Give_You_Up.png' -OutFile '$env:TEMP\wp.png'; Add-Type -TypeDefinition 'using System;using System.Runtime.InteropServices;public class W{[DllImport(\"user32.dll\",CharSet=CharSet.Auto)]public static extern int SystemParametersInfo(int a,int b,string c,int d);}'; [W]::SystemParametersInfo(20,0,\"$env:TEMP\wp.png\",3)"
    ENTER
    ```

    <Warning>
      This is a more advanced payload that uses PowerShell. Only test it on your own computer. The command downloads an image to a temp folder and uses a Windows API call to set it as the wallpaper.
    </Warning>
  </Tab>
</Tabs>

***

## Understanding the attack workflow

Step back and think about what you just did from a security perspective:

| Step | What you did                      | What an attacker does                                                                   |
| ---- | --------------------------------- | --------------------------------------------------------------------------------------- |
| 1    | Wrote a DuckyScript payload       | Writes a malicious payload (credential harvester, backdoor installer, data exfiltrator) |
| 2    | Compiled it in PayloadStudio      | Compiles it with the same tool  -  or a custom encoder                                  |
| 3    | Loaded it onto the Rubber Ducky   | Loads it onto any keystroke injection device                                            |
| 4    | Plugged it into your own computer | Plugs it into a target's computer  -  or leaves it for someone to find (USB baiting)    |
| 5    | Watched a YouTube video play      | Watches stolen credentials arrive at their command-and-control server                   |

The process is the same. The intent is what separates a penetration tester from an attacker. This is why **authorization** and **ethics** matter  -  the tool doesn't know the difference.

<Warning>
  **Responsible use reminder:** You must only use the USB Rubber Ducky on computers you own or have explicit written permission to test. Unauthorized use is a violation of the Computer Fraud and Abuse Act (CFAA) and can result in criminal charges  -  even if the payload is "harmless." A RickRoll on your own computer is a demo. A RickRoll on someone else's computer without permission is unauthorized access.
</Warning>