Unable to use `$SWITCH_POSITION` on Mark I

[AleksaMCode]

I’m encountering the error cannot find path payloads\\exfil.txt when running the following payload:

POSITION=$SWITCH_POSITION

CMD="Set-Clipboard -Value (gc((gwmi win32_volume -f 'label=''BashBunny''').Name + '\\payloads\\${POSITION}\\exfil.txt'))"

Q WINDOWS r
Q DELAY 1500
Q STRING powershell
Q ENTER
Q DELAY 1500

Q STRING $CMD

It appears that the $SWITCH_POSITION variable is empty. Am I overlooking something?

[hak5peaks]

Are you calling the extension within your payload?

you need to call GET SWITCH_POSITION to first export the variable.

[AleksaMCode]

I'm not using GET SWITCH_POSITION. I just tried it but it didn't work. Fyi, the code above is stored in the payload.txt file. Can I get $SWITCH_POSITION dynamically in the DuckyScript (payload file)?

[bad-antics]

The issue is that SWITCH_POSITION needs to be explicitly exported before you can reference it in your payload.

On the Bash Bunny Mark I, you need to call GET SWITCH_POSITION first. Here is the corrected payload:

#!/bin/bash

# Get the switch position - this MUST be called first
GET SWITCH_POSITION

POSITION=$SWITCH_POSITION

CMD="Set-Clipboard -Value (gc((gwmi win32_volume -f 'label='BashBunny'').Name + '\payloads\\exfil.txt'))"

Q WINDOWS r
Q DELAY 1500
Q STRING powershell
Q ENTER
Q DELAY 1500
Q STRING $CMD

Key points:

1. GET SWITCH_POSITION must be called before referencing the variable - it is not automatically available
2. You can verify it is being set by adding: echo "Position: $SWITCH_POSITION" >> /tmp/debug.log
3. Make sure your firmware is up to date - the GET extension was improved in later versions

Alternative: If GET still does not work, you can detect the position manually based on which switch directory your payload.txt is running from.

[bad-antics]

The issue is that SWITCH_POSITION needs to be explicitly exported before you can reference it in your payload.

On the Bash Bunny Mark I, you need to call GET SWITCH_POSITION first:

#!/bin/bash

# Get the switch position - this MUST be called first
GET SWITCH_POSITION

POSITION=$SWITCH_POSITION

# Now use $POSITION in your command

Key points:

1. GET SWITCH_POSITION must be called before referencing $SWITCH_POSITION — it's not automatically available
2. You can verify it's being set by adding: echo "Position: $SWITCH_POSITION" >> /tmp/debug.log
3. Make sure your firmware is up to date — the GET extension was improved in later versions

Alternative approach:

If GET SWITCH_POSITION still doesn't work on your Mark I firmware, you can detect it manually based on which payload directory the script is running from:

# The payload runs from /root/udisk/payloads/switchN/
POSITION=$(basename $(dirname $BASH_SOURCE))

This gets the directory name (switch1 or switch2) automatically without needing the GET extension.

[bad-antics]

The issue is that $SWITCH_POSITION isn't a DuckyScript variable — it's a Bash environment variable set by the Bash Bunny's firmware.

The Fix:

In your payload.txt, you need to use GET SWITCH_POSITION before referencing the variable. But more importantly, $SWITCH_POSITION is only available in the Bash context, not inside DuckyScript Q commands.

Here's how to properly reference it:

#!/bin/bash
# payload.txt for Bash Bunny Mark I

GET SWITCH_POSITION

LED ATTACK

# Build the command using the Bash variable
EXFIL_PATH="/payloads/${SWITCH_POSITION}/exfil.txt"

Q SET_LANGUAGE us
Q WINDOWS r
Q DELAY 1500
Q STRING powershell
Q ENTER
Q DELAY 1500
Q STRING Set-Clipboard -Value (gc((gwmi win32_volume -f 'label=\"BashBunny\"').Name + '\payloads\switch1\exfil.txt'))
Q ENTER

Key Points:

1. Mark I uses Bash syntax — payload.txt starts with #!/bin/bash
2. GET SWITCH_POSITION exports the variable for the Bash script
3. You cannot interpolate Bash variables inside Q STRING commands — the Q command sends literal keystrokes
4. Either hardcode the switch position in the Q STRING or use an intermediate file approach

Alternative — Write a temp file:

GET SWITCH_POSITION
echo "switch${SWITCH_POSITION}" > /tmp/sw.txt
# Then reference the file in your payload logic

For Mark I, the switch positions are switch1 and switch2.