[Payload BUG] write a short description here

[sny7er]

Payload Title

payload.txt

Payload URL

payloads/library/exfiltration/ExfiltrateWindowsCredentials/KeystrokeReflection

Payload Setup

Just followed the normal directions; I just got a new Rubber Ducky this week. I copied the payload to Payload Studio, compiled it, downloaded to the USB Rubber Ducky from Hak5 .. Inserted and ran. I've run a couple other scripts successfully. This one runs but doesn't finish

Problem Description

I ran this and get error.. the credentials.txt file didn't exist and then the exfiltration.txt file didn't exist. I created empty files of each just to get past the error. However it doesn't get past the Task Manager to export from lsass process. I'm testing this on my Windows 11 PC.

Troubleshooting steps

I created the credentials.txt and exfiltration.txt files to try and get past the error.

Suspected Cause

not sure

Screenshots or additional information

No response

Checklist ✅ - READ CAREFULLY

• I checked and didn't find a similar issue already reported
• I am using PayloadStudio to encode this payload
• I made sure to redact any private information in the details shared above
• I have read and followed the documentation provided by the original payload author and configured the payload (if required)
• I have confirmed I am deploying this payload with the correct device intended by the original author (Original USB Rubber Ducky vs New USB Rubber Ducky)
• I have confirmed I am deploying this payload on the correct target host intended by the original author (Windows, Mac, Linux, etc)
• I have confirmed the payload is compiled in the correct keyboard language for the target host I'm trying to deploy it on (US, DE, etc)
• I have actually read the above checkboxes before checking them, including this one, which I have intentionally left unchecked as confirmation of this statement

Agreement

• I believe this is an issue with the actual payload itself. I acknowledge this form is not a request for help following instructions.
• I have carefully read and filled out every section of this issue form to the best of my ability. I acknowledge by providing insufficient information I cannot receieve adequate assistance.

[bad-antics]

Hey there! This is a common issue with credential exfiltration payloads on newer Windows 11 builds.

Root cause: The payload tries to dump the lsass process which requires SYSTEM-level privileges, and Windows 11 has Credential Guard enabled by default which protects lsass.

Solutions:

1. Check if Credential Guard is active:

   Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root/Microsoft/Windows/DeviceGuard | Select-Object SecurityServicesRunning

   If it returns {1, 2}, Credential Guard is blocking the dump.

2. Alternative approach — Instead of targeting lsass, use cmdkey /list for cached credentials or extract browser credentials via SQLite databases (Chrome/Edge store creds in %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data).

3. The missing files issue — The payload expects credentials.txt and exfiltration.txt to be auto-created by the script itself. If they are not being created, the PowerShell execution policy might be blocking the script. Add this at the top of the PowerShell section:

   STRING Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
   

4. Task Manager UAC bypass — On Win11, even with UAC bypass, Task Manager no longer allows direct process dumping. Consider using comsvcs.dll method:

   rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump (Get-Process lsass).Id C:\temp\out.dmp full

Hope this helps! The DuckyScript is solid — it is just the Windows 11 security changes that need workarounds.