Rubber Ducky

$ open usb.png

Building My Own USB Rubber Ducky: Automating File Backups to the Cloud

Introduction

I have always been drawn to devices that appear harmless on the outside yet possess remarkable capabilities beneath the surface. The USB Rubber Ducky epitomizes this idea: it looks like a plain flash drive, but once plugged into a computer, it can send a rapid stream of keystrokes and execute entire scripts in seconds. While this power can certainly be misused, I wanted to channel it toward something constructive. My goal was to create a small, inexpensive device that would automatically search for specific file types, organize them, compress them, generate logs, and upload everything to my Amazon S3 bucket for easy backups or future reference.

The Concept of a Homemade Rubber Ducky

Commercial USB Rubber Ducky devices already exist, but they can be expensive, and some are locked into certain ecosystems or software. By building my own from a budget microcontroller, I felt I could gain a deeper understanding of how these devices work at every level. I also wanted to ensure I could customize it for a very particular task: backing up files as soon as I plug it in. Traditionally, a rubber ducky script might open Notepad and type “Hello World,” just to prove how fast it can inject keystrokes. I wanted something more ambitious. I envisioned a script that would scan user directories for images, documents, or PDFs, compress those files, categorize them by original folder, and then upload them—together with log files—to an S3 bucket.

Choosing the Hardware

My search for an affordable, Arduino-compatible microcontroller led me to an RP2040-based board often referred to as the “Arduino W.” It cost around $9.90 and had a straightforward setup process that involves placing it into bootloader mode and flashing new firmware simply by dragging a file onto a removable drive. The board’s native USB support was critical, allowing it to pretend to be a keyboard once the right firmware was installed. Other microcontrollers lack this feature out of the box, so I was fortunate to find this one at such a low price.

Flashing the Firmware

Turning the blank board into a rubber ducky device required specialized firmware that enables keyboard emulation. After holding down the bootloader button while connecting it to my computer, the board appeared as a removable drive. I copied the firmware file onto this drive, and within seconds, it restarted and identified itself as a USB keyboard. I did encounter a small frustration when my initial firmware download turned out to be corrupted, causing the board to refuse booting. Re-downloading the file from GitHub solved the issue immediately. This brief snag taught me the importance of verifying firmware files before flashing them, especially when working with less common boards.

Designing the Automation

Getting the board to appear as a keyboard was the easy part. The real challenge lay in creating a script robust enough to handle all the file operations and cloud uploads I envisioned. Rather than relying on Windows Command Prompt, I decided to use PowerShell, which offers powerful commands for file manipulation and archiving. The script I wrote would launch PowerShell, search user directories for files matching certain extensions like .jpg, .png, .pdf, and .docx, create a staging area, place each file into a subfolder corresponding to its origin, and compress them into a single ZIP. The neatness of the final ZIP file was important to me. I wanted each directory—Desktop, Documents, Pictures—to be preserved, ensuring I could see exactly where each file came from.

Why PowerShell and AWS S3

PowerShell’s Compress-Archive command simplified the process of bundling files into one package, while its flexibility for creating and managing directories proved invaluable when sorting files by their original location. Integrating with Amazon S3 was my ultimate ambition, as I wanted the entire backup process to be fully automated. Once the ZIP was created, the script used either the AWS CLI or a PowerShell module to push the files to an S3 bucket I had set up in advance. Admittedly, this step can fail if the AWS CLI isn’t installed on the target machine or if valid credentials aren’t available. However, for personal use on machines where I had control over the environment, it worked flawlessly and exemplified how straightforward it can be to store backups in the cloud.

Logging and Error Handling

Generating detailed logs seemed like a logical way to keep track of everything that occurred during the backup. Instead of producing one massive report, I configured the script to generate separate logs for each folder. For instance, if the device found six JPG images in the Pictures folder, that data—including file paths, timestamps, and file counts—would appear in a dedicated Pictures log file. Desktop, Documents, and any other directories were similarly handled. Each log file then accompanied the main ZIP archive during the upload. A separate error log was also crucial. If the script encountered permission problems or timing issues, it would record them, ensuring that even if the process didn’t complete perfectly, I had a paper trail to investigate later.

Timing and Testing

I quickly discovered that the rubber ducky typed commands much faster than some computers could process them. Without occasional pauses, the operating system might miss parts of certain commands, leading to half-finished lines or garbled input. Adding brief delays of about 100–150 milliseconds between lines stabilized everything. After tweaking these intervals, the script ran reliably. To be certain it worked across multiple setups, I tested it on different Windows machines where I had explicit permission. Every time, it opened PowerShell, searched for the designated file types, organized them neatly, zipped them, wrote log files, and uploaded them to my S3 bucket. With a small tweak to the script, it could also clean up local traces by deleting the temporary folders once the upload was confirmed.

Ethical Implications

A device that can gather files quietly and upload them to a remote server has obvious ethical and legal implications if misused. I was constantly aware that while I used it solely for backups on my own systems or systems where I had explicit permission, someone could theoretically employ the same technology maliciously. That risk underscores why it’s important for individuals, companies, and institutions to maintain strong security practices, monitor their USB ports, and understand the potential of unauthorized keystroke injection. It’s also a reminder that using such a gadget without proper consent could violate laws. I believe any enthusiastic builder should view this technology through the lens of responsible experimentation, staying well within the boundaries of legal and ethical conduct.

Future Directions

Although my initial objective was purely functional—create a USB device to backup photos and documents to S3 in a single motion—I can envision several extensions. One might be incorporating a small OLED display or LED lights to indicate script progress. Another could involve encrypting the ZIP file before uploading so that even if the data is intercepted, it remains secure. A physical switch on the device could toggle between multiple scripts—for instance, one script dedicated to backing up only images, another to extracting Word documents for a writing project, and a third for performing quick penetration tests in a lab environment. These ideas are part of what makes building a homemade rubber ducky such a thrilling challenge: there is no shortage of creative ways to enhance the design.

Conclusion

This project exceeded my expectations in terms of both technical lessons learned and practical outcomes achieved. I now have a portable device that, once plugged in, searches for specified file types, organizes them by folder, logs every detail, compresses everything, and uploads the final archive and logs to an S3 bucket. The entire process runs from a single script executed at lightning speed by a microcontroller that cost less than ten dollars. For my personal portfolio, this accomplishment reflects not only my curiosity about embedded devices and scripting, but also my dedication to ensuring that each step—from firmware flashing to cloud integration—was handled with precision. It stands as a reminder of the wonderful things that can happen when hardware and software are brought together in a spirit of exploration and responsible innovation.