[Payload BUG] Unexpected Symbol

[3DPixel]

Payload Title

Add Local Admin

Payload URL

payloads/library/execution/Add_Local_Admin/payload.txt

Payload Setup

Copied the script from the above repo
Pasted it into the Payload Studio Community Edition
Clicked 'Generate Payload'

Error message:
Error on Line 72: Error: Unexpected Symbol: [ADSI]"WinNT:
Error on Line 73: Error: Result inject.bin is empty
[!] Payload Failed to Compile

Problem Description

I copied the script and expected it to work.

Troubleshooting steps

Deleted the entire script from Payload Studio and re-copied / pasted it and tried again.
Same problem

Suspected Cause

No response

Screenshots or additional information

No response

Checklist ✅ - READ CAREFULLY

• I checked and didn't find a similar issue already reported
• I am using PayloadStudio to encode this payload
• I made sure to redact any private information in the details shared above
• I have read and followed the documentation provided by the original payload author and configured the payload (if required)
• I have confirmed I am deploying this payload with the correct device intended by the original author (Original USB Rubber Ducky vs New USB Rubber Ducky)
• I have confirmed I am deploying this payload on the correct target host intended by the original author (Windows, Mac, Linux, etc)
• I have confirmed the payload is compiled in the correct keyboard language for the target host I'm trying to deploy it on (US, DE, etc)
• I have actually read the above checkboxes before checking them, including this one, which I have intentionally left unchecked as confirmation of this statement

Agreement

• I believe this is an issue with the actual payload itself. I acknowledge this form is not a request for help following instructions.
• I have carefully read and filled out every section of this issue form to the best of my ability. I acknowledge by providing insufficient information I cannot receieve adequate assistance.

[hak5peaks]

It seems there is a additional duplicate line, remove the last line $adsi = [ADSI]"WinNT://$env:COMPUTERNAME"

@LulzAnarchyAnon Seems there is a extra line left in your payload.

[3DPixel]

Thanks.
It compiled but it didn't work anyway.

I get this on the PS window

PS C:\WINDOWS\system32> $Username = @admin2@
At line:1 char:20

• $Username = @admin2@

•                ~
  

Unrecognized token in source text.
At line:1 char:20

• $Username = @admin2@

•                ~
  

Unexpected token '@' in expression or statement.
At line:1 char:13

• $Username = @admin2@

•         ~~~~~~~
  

The splatting operator '@' cannot be used to reference variables in an expression. '@admin2' can be used only as an
argument to a command. To reference variables in an expression use '$Admin2'.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : UnrecognizedToken

PS C:\WINDOWS\system32> $Password = @password
At line:1 char:13

• $Password = @password

•         ~~~~~~~~~
  

The splatting operator '@' cannot be used to reference variables in an expression. '@password' can be used only as an
argument to a command. To reference variables in an expression use '$password'.
+ CategoryInfo : ParserError: (:) [], ParentContainsErrorRecordException
+ FullyQualifiedErrorId : SplattingNotPermitted

PS C:\WINDOWS\system32> $group = @Administrators@

Thank You for letting me know I suspect it would be a copy paste issue that caused it to happen....

[3DPixel]

Exactly the same happens if I download the script and import it. No copy/paste

My apologies, what I meant by copy/paste was. When I copied, and pasted it myself from my other repository.

[hak5peaks]

@LulzAnarchyAnon there was a typo on the first line for REM on your pull, I went and fixed it since it was just missing a single letter.

Thank You! I noticed.

…

On Mon, Jun 10, 2024, 8:59 AM Peaks ***@***.***> wrote: @LulzAnarchyAnon <https://github.com/LulzAnarchyAnon> there was a typo on the first line for REM on your pull, I went and fixed it since it was just missing a single letter. — Reply to this email directly, view it on GitHub <#455 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AY7QUUGMTY4GBGGOCNGHBMDZGXEMTAVCNFSM6AAAAABJCQBCBWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNJYG42DQNRVGM> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[hak5peaks]

I believe this issue is resolved now? just want to confirm.

I myself found the issue resolved, and with current delays it deployed and completed in 36.9 seconds

…

On Mon, Jun 10, 2024, 9:03 AM Peaks ***@***.***> wrote: I believe this issue is resolved now? just want to confirm. — Reply to this email directly, view it on GitHub <#455 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AY7QUUEGTFBRZBSJIGTJC43ZGXE4LAVCNFSM6AAAAABJCQBCBWVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNJYG43DANBYGY> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[bad-antics]

The [ADSI] syntax in DuckyScript is causing a compilation error because PayloadStudio is interpreting the square brackets as DuckyScript syntax rather than as part of a PowerShell string.

The fix:

The issue is on line 72 where the payload uses STRING followed by PowerShell code containing [ADSI]. PayloadStudio's parser trips on the brackets.

Solution 1 — Escape with a variable:

DEFINE #ADSI_PREFIX [ADSI]
STRING $user = #ADSI_PREFIX"WinNT://$env:COMPUTERNAME/$username"

Solution 2 — Use PowerShell's alternative syntax:
Instead of [ADSI]"WinNT://...", use:

STRING $user = New-Object -TypeName System.DirectoryServices.DirectoryEntry -ArgumentList "WinNT://$env:COMPUTERNAME/$username"

Solution 3 — Inline the whole thing:
Wrap the entire PowerShell command in a single STRING powershell -ep bypass -nop -c "..." line so PayloadStudio treats it all as a literal string rather than trying to parse individual lines.

Solution 4 — Use the raw DuckyScript encoder:
If you have the Java-based duckencoder.jar, compile it offline instead of using PayloadStudio Community Edition. The CLI encoder handles these edge cases better:

java -jar duckencoder.jar -i payload.txt -o inject.bin -l us

This is a known PayloadStudio parser limitation with complex PowerShell expressions that contain brackets.