> For the complete documentation index, see [llms.txt](https://documentation.hak5.org/bash-bunny/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://documentation.hak5.org/bash-bunny/writing-payloads/attackmode.md).

# ATTACKMODE

`ATTACKMODE` is a DuckyScript command which specifies which devices to emulate. The ATTACKMODE command may be issued multiple times within a given payload. For example, a payload may begin by emulating Ethernet, then switch to emulating a keyboard and serial later based on a number of conditions.

| ATTACKMODE       | Description                                                                                                                                                                                                                                                                                                                                                                         |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `SERIAL`         | <p>ACM – Abstract Control Model<br>Serial Console</p>                                                                                                                                                                                                                                                                                                                               |
| `ECM_ETHERNET`   | <p>ECM – Ethernet Control Model<br>Linux/Mac/Android Ethernet Adapter</p>                                                                                                                                                                                                                                                                                                           |
| `RNDIS_ETHERNET` | <p>RNDIS – Remote Network Driver Interface Specification<br>Windows (and some Linux) Ethernet Adapter</p>                                                                                                                                                                                                                                                                           |
| `AUTO_ETHERNET`  | <p>Automatic Ethernet. This attack mode will first attempt to bring up ECM\_ETHERNET. If after the default timeout of 20 seconds no connection is established, RNDIS\_ETHERNET will be attempted. The timeout may be changed by adding ETHERNET\_TIMEOUT\_XX where XX is the number of seconds, e.g. ETHERNET\_TIMEOUT\_60 for one minute.</p><p>Requires firmware version 1.5+</p> |
| `STORAGE`        | <p>UMS – USB Mass Storage<br>Flash Drive</p>                                                                                                                                                                                                                                                                                                                                        |
| `HID`            | <p>HID – Human Interface Device<br>Keyboard – Keystroke Injection via Ducky Script </p>                                                                                                                                                                                                                                                                                             |

Many combinations of attack modes are possible, however some are not. For example, `ATTACKMODE HID STORAGE ECM_ETHERNET` is valid while `ATTACKMODE RNDIS_ETHERNET ECM_ETHERNET STORAGE SERIAL` is not. Each attack mode combination registers using a different USB VID/PID (Vendor ID/Product ID) by default. VID and PID can be spoofed using the VID and PID commands.

| ATTACKMODE COMBINATION      | VID / PID     |
| --------------------------- | ------------- |
| SERIAL STORAGE              | 0xF000/0xFFF0 |
| HID                         | 0xF000/0xFF01 |
| STORAGE                     | 0xF000/0xFF10 |
| SERIAL                      | 0xF000/0xFF11 |
| RNDIS\_ETHERNET             | 0xF000/0xFF12 |
| ECM\_ETHERNET               | 0xF000/0xFF13 |
| HID SERIAL                  | 0xF000/0xFF14 |
| HID STORAGE                 | 0xF000/0xFF02 |
| HID RNDIS\_ETHERNET         | 0xF000/0xFF03 |
| HID ECM\_ETHERNET           | 0xF000/0xFF04 |
| HID STORAGE RNDIS\_ETHERNET | 0xF000/0xFF05 |
| HID STORAGE ECM\_ETHERNET   | 0xF000/0xFF06 |
| SERIAL RNDIS\_ETHERNET      | 0xF000/0xFF07 |
| SERIAL ECM\_ETHERNET        | 0xF000/0xFF08 |
| STORAGE RNDIS\_ETHERNET     | 0xF000/0xFF20 |
| STORAGE ECM\_ETHERNET       | 0xF000/0xFF21 |