How to Make a USB Rubber Ducky: A Step-by-Step Working Guide

The USB Rubber Ducky is a powerful keystroke injection tool that appears to a computer as a regular keyboard. This allows it to automatically type pre-programmed payloads at incredible speeds, automating anything you can do with a keyboard. While the official tool from Hak5 is a popular choice, you can create a functional version yourself using affordable and widely available components. This guide provides a complete, step-by-step process to build and program your own USB Rubber Ducky.

What is a USB Rubber Ducky and How Does It Work?

Before diving into the build, it's crucial to understand the tool. To a human, the USB Rubber Ducky looks like an ordinary USB flash drive. However, to a computer, it identifies itself as a Human Interface Device (HID)—specifically, a keyboard . Computers are inherently trusting of keyboards, as they are the primary tool for human input.

This trust is the core of the keystroke injection attack. When plugged in, the device "types" a pre-written script at superhuman speeds, executing commands without the user's knowledge or consent . This can be used for a wide range of purposes, from benign IT automation and penetration testing to more malicious activities like credential theft or installing backdoors . The language used to control these actions is called DuckyScript, which is simple to learn but incredibly powerful .

Comparing Your Build Options

Feature	Official Hak5 USB Rubber Ducky	DIY Pico-Ducky (This Guide)
Cost	~$60 USD	~$10-$15 USD (cost of a Raspberry Pi Pico)
Stealth	High; designed to look like a generic flash drive	Moderate; looks like a microcontroller board
Ease of Use	Integrated ecosystem with Payload Studio IDE	Requires initial setup; edits via text files on a drive
Community & Support	Large official community and payload repository	Active open-source community on GitHub
Flexibility	Powerful DuckyScript 3.0 language	Runs most DuckyScript 1.0 payloads

Step 1: Gathering the Required Components

For this DIY build, you will need the following hardware and software. The total cost is a fraction of the official device.

Hardware Components:

1. A Raspberry Pi Pico, Pico W, Pico 2, or Pico 2W: This microcontroller board is the brain of the operation. The standard Raspberry Pi Pico is recommended for its simplicity and lower cost, as it does not have wireless capabilities that are unnecessary for this project .

2. A Micro-USB or USB-C cable: This depends on your model of Pico and is used for both power and programming.

3. A computer: You'll need a Windows, macOS, or Linux machine to set up the Pico.

Software Components:

1. CircuitPython Firmware: This allows the Pico to run Python code easily. You will need the specific .uf2 file for your Pico model .

2. The Pico-Ducky Software: This is the code that enables the Pico to understand and execute DuckyScript payloads. You can download it from the pico-ducky GitHub repository .

3. A text editor: Any basic text editor (like Notepad++, VS Code, or even Notepad) will work for writing your payloads.

Step 2: Flashing CircuitPython onto the Raspberry Pi Pico

This process prepares the Pico to run the necessary code.

1. Download the CircuitPython UF2 File: Go to the CircuitPython website and download the correct .uf2 file for your specific Pico model (e.g., adafruit-circuitpython-raspberry_pi_pico-en_US-9.2.1.uf2 for a standard Pico) .

2. Enter Bootloader Mode: With the Pico unplugged from USB, press and hold the white BOOTSEL button on the board. While holding the button, plug the Pico into your computer. Release the BOOTSEL button. Your computer should recognize a new removable storage device named RPI-RP2.

3. Install CircuitPython: Simply drag and drop the downloaded .uf2 file onto the RPI-RP2 drive. The Pico will automatically reboot. After a moment, it will reconnect as a new drive named CIRCUITPY. This confirms that CircuitPython has been successfully installed .

Step 3: Installing the Pico-Ducky Payload Interpreter

Now, we'll install the software that makes the Pico act like a Rubber Ducky.

1. Download the Pico-Ducky Files: Go to the pico-ducky GitHub repository and download the latest release of the software.

2. Copy Files to the Pico:

   • Open the CIRCUITPY drive.

   • From the downloaded pico-ducky folder, copy the lib folder to the root of the CIRCUITPY drive. If prompted, merge or replace any existing files.

   • Next, copy the following .py files from the pico-ducky folder to the root of the CIRCUITPY drive: boot.py, duckyinpython.py, and code.py .

Your Pico is now functionally a USB Rubber Ducky. The final step is to provide it with a payload to execute.

Step 4: Creating and Loading Your First Payload

DuckyScript is a simple language where each line represents a command. Let's start with a classic "Hello, World!" script and then a more practical example.

A Basic DuckyScript Example

Create a new text file and name it payload.dd. Open it and write the following script :

duckyscript

REM My First Payload
DELAY 3000
STRING Hello, World! Your USB Rubber Ducky is working!
ENTER

Explanation of the commands:

• REM: A remark or comment; used for notes and is not executed.

• DELAY: Pauses the script for a specified time in milliseconds (3000 ms = 3 seconds). This gives the target computer time to recognize the "keyboard" and for you to select the correct text field.

• STRING: Types out everything that follows it, as if it were typed on a keyboard.

• ENTER: Presses the Enter key.

A Practical Windows Example

This payload opens the Windows Command Prompt. Save it as a new payload.dd file.

duckyscript

REM Open Windows Command Prompt
DELAY 2000
GUI r
DELAY 500
STRING cmd
ENTER

Explanation:

• DELAY 2000: Waits 2 seconds.

• GUI r: Presses the Windows key + R to open the Run dialog box.

• STRING cmd: Types "cmd" into the Run dialog.

• ENTER: Executes the command, opening the Command Prompt.

Loading the Payload

1. With your Pico unplugged, connect a jumper wire between Pin 1 (GP0) and Pin 3 (GND). This is the "setup mode" safety feature that prevents the payload from running on your own computer .

2. Plug the Pico into your computer. The CIRCUITPY drive should appear.

3. Drag and drop your payload.dd file into the root of the CIRCUITPY drive.

4. Safely eject the Pico and remove the jumper wire. The device is now armed and ready.

Step 5: Deployment and Testing

Warning: Only test your device on computers that you own or have explicit permission to test on. Unauthorized use is illegal and unethical.

1. Open a text editor (like Notepad) on your target test computer. Make sure the cursor is blinking in the text area.

2. Plug in your DIY USB Rubber Ducky. You should see the LED on the Pico light up.

3. After the initial DELAY, you will see the script execute automatically, typing your message or opening the Command Prompt.

If it works, congratulations! You have successfully built a functioning keystroke injection device.

Important Security and Stealth Considerations

• Disabling Mass Storage: For a real-world engagement, you may not want the CIRCUITPY drive to appear on the target computer. To disable this, you can connect a jumper between Pin 18 (GND) and Pin 20 (GPIO15) before plugging it into the target. This makes the device stealthier, as it only acts as a keyboard and not a flash drive .

• Multiple Payloads: The pico-ducky software supports multiple payloads. You can create several .dd files (e.g., payload1.dd, payload2.dd) and select them by grounding specific pins on the Pico as detailed in the project's README .

Conclusion: The Power of Keystroke Injection

You have now built a versatile and powerful tool. The true potential of the USB Rubber Ducky lies in the creativity and complexity of your DuckyScript payloads. The official Hak5 payload repository is an excellent place to find inspiration and learn advanced techniques .

As you explore this capability, it's equally important to understand the defense. This knowledge helps you protect your own systems and conduct more responsible security testing. The world of hardware-based attack tools is accessible to anyone with curiosity and a few dollars to spend on components. Use this power responsibly, ethically, and legally.

Would you like to explore more advanced payloads, such as those for credential harvesting or data exfiltration?