例题-USB键鼠流量
← 返回 6.2USB 键鼠流量
[CISCN 2022 初赛]ez_usb
下载附件获得ez_usb.pcapng
Protocol列看到大量的USB和USBHID协议
随便看一条 看到HID Data:0400000000000000八字节
使用过滤器：usbhid.data
发现存在三种设备地址：2.8.1``2.4.1``2.10.1
每个地址对应不同的USB地址，分别分析它们的数据
分别用过滤器：usb.addr=="2.8.1" usb.addr=="2.4.1"``usb.addr=="2.10.1"分别导出对应分组 获得三个流量包
在D盘开一个叫luxluusb的文件夹 把三个流量包放进去
在cmd逐行粘贴并回车执行
1
| "D:\Wireshark\tshark.exe" -r D:\luxluusb\2.4.1.pcapng -Y "usb.capdata" -T fields -e usb.capdata > D:\luxluusb\2.4.1.txt
|
1
| "D:\Wireshark\tshark.exe" -r D:\luxluusb\2.8.1.pcapng -Y "usb.capdata" -T fields -e usb.capdata > D:\luxluusb\2.8.1.txt
|
1
| "D:\Wireshark\tshark.exe" -r D:\luxluusb\2.10.1.pcapng -Y "usb.capdata" -T fields -e usb.capdata > D:\luxluusb\2.10.1.txt
|
2.4.1.txt中的数据只有7个字节 不是键盘的数据包 放弃
剩下2.8.1.txt``2.10.1.txt观察后发现 这两个文件包含有效的HID数据包 我们需要每行的第三个字节
第三个字节是实际按键码 例如0x04对应'A'
用脚本提取这些键码 并映射为字符
1
2
3
4
5
6
7
8
9
10
| # [NISACTF 2022]破损的flag
**flag真的是flag吗？****Tips：flag格式为NSSCTF{}****ps:记得补全单词哦，单词和单词之间记得加_哦**
确认文件类型是流量包 在后缀加`.pcapng`
tshark抓取原始数据
|
“D:\Wireshark\tshark.exe” -r “D:\usb\usbdata.pcapng” -T fields -e usb.capdata > “D:\usb\usbdata.txt”
1
2
3
4
5
|
运行脚本还原字符串
|
UJKONJK,TFVBHYHJIPOKRDCVGRDCVGPOKQWSZTFVBHUJKOWAZXDQASEWSDRPOKXDFVIKLPNJKWSDRRFGYRDCVGUHNMKBHJMYHJI
1
2
3
4
5
6
7
8
9
10
11
12
13
|
以3-5个字母为单位，键盘上被围起来的字符有
i m g u l f f l a g i s w e l c o m e t f j n u
im gulf flag is welcome t fjnu
`NSSCTF{welcome_to_fjnu}`
# [MoeCTF 2022]usb
使用过滤器`usbhid.data`
|
“D:\Wireshark\tshark.exe” -r “D:\usb\usbhid.pcapng” -T fields -e usb.capdata > “D:\usb\usb.txt”
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
|
`MOECTF{Learned-a6ou7-USB-tr2ffic}`
但是不是flag 我回头才发现那个脚本忽略了modifier
脚本我又改了改 会自动完成del 增加了modifier key 还有shift按住等操作
`NSSCTF{Learned_a6ou7_USB_tr@ffic}`
在一个wp看到了一把梭软件 `CTF-NetA-V0.3.0`
# [GFCTF 2021]双击开始冒险
据说是生日 还是四位数字 爆破
应该是出题人的QQ号捏 搜了一下 啥也没有 看了一眼wp 出题人之前有一个个性签名`WW91IGxvdmUgbWUsIEkgbG92ZSB5b3U=`现在换掉了嗯嗯
`From Base64`之后获得`You love me, I love you`是第二层的密码
打开流量包 可以看到只有地址为`1.2.1`的`Info`是`URB_INTERUPT in`其他都比较杂乱 不符合标准
过滤器：`usb.data_len == 8 and usb.src =="1.2.1"`
导出特定分组
|
“D:\Wireshark\tshark.exe” -r “D:\usb\usbnew.pcapng” -T fields -e usb.capdata > “D:\usb\usbnew.txt”
[SWPU 2020]来猜谜了
图片经过LSB 压缩包形式 save bin
过滤器usb.data_len == 8 and usb.src =="1.1.1"
导出
1
| "D:\Wireshark\tshark.exe" -r "D:\usb\usben.pcap" -T fields -e usb.capdata > "D:\usb\usben.txt"
|
跑脚本
搜了一下
adfgx密码
二战时期德国使用的密码体系 是棋盘密码和换位加密的组合
先把明文变成坐标 再把坐标打乱顺序 最终得到看似无规律的密文
1
2
3
4
5
6
7
| A D F G X
-------------
A | p h q g m
D | e a y n o
F | f d x k r
G | c v s z w
X | b u t i/j l
|
比如说我们要加密luxlu
看表对照我们就可以得到XX XD FF XX XD(先读行再读列)
也就是X X X D F F X X X D
假设密钥是misc
长度是4 四列 密钥长度是4 总字符数是10 于是行数是10/4=3行 最后一行不完整
创建了一个3行 四列的表格
确定列的读取顺序 根据密钥字母顺序 密钥是misc
按照字母表顺序misc 1234的顺序是c i m s 4213
读取DXXFDXFXXX是最后密文
这个题不要那么复杂 只需要读表就行了 go go go
题名来猜迷了还有jpg隐写联想到outguess
kali运行outguess
outguess -k gogogo -r /home/kali/Desktop/mi.jpg /home/kali/Desktop/mi.txt
NSSCTF{Out9uEsS_1s_V4rY_e4sy}
[MoeCTF 2021]诺亚的日记
很常规的操作
moectf{D@m3daNe_D4me_yoooooo}
[LitCTF 2025]消失的文字
鼠标流量 同样方法绘制出轨迹
水平翻折获得868F-83BD-FF是文本的密码
搜一下名字hidden-word
https://hidden-word.top/
LitCTF{39553317-df30-4951-8aad-fcaf3028ca9d}
[NewStarCTF2025w2]Misc 城邦：NewKeyboard
过滤器：usb.addr=="1.1.2"
分别导出字母表和flag的特定分组
1
| "D:\Wireshark\tshark.exe" -r D:\usb\1.pcapng -Y "usb.capdata" -T fields -e usb.capdata > D:\usb\1.txt
|
名为abcdefghijklmnopqrstuvwxyz1234567890-_!{}.pcapng的文件的输出结果如下 研究了一段时间 我才发现 这是一个已知输入内容的USB键盘流量包 也就是字符对照表
有一个傻瓜方法就是把上面这个做成映射表然后运行python脚本 不去考虑编码逻辑
观察字母表的txt文件 解释一下字符映射规律
比如说“**_**”
1
| [Modifier][保留][Key1][Key2][Key3]...（共 21 字节，42 个 hex 字符）
|
Modifier四字节 **0100**是没有按**shift** **0102**是按住了**shift**
从第五字节开始 如果全是**00**表示没有按键按下
1
| 01020000000000200000000000000000000000000000 → shift+"-"对应"_"
|
1
| 01020000000000000000000000000000000000000000 → shift仍然按着
|
1
| 01000000000000000000000000000000000000000000 → shift也松开了
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
| 01001000000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01002000000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01004000000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01008000000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000001000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000002000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000004000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000008000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000010000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000020000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000040000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000080000000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000010000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000020000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000040000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000080000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000100000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000200000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000400000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000800000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000100000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000200000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000400000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000800000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000001000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000002000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000004000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000008000000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000001000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000002000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000004000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000008000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000010000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000020000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000040000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000080000000000000000000000000000000
01000000000000000000000000000000000000000000
01000000000000200000000000000000000000000000 → "-"
01000000000000000000000000000000000000000000 → 没按shift
01020000000000000000000000000000000000000000 → shift按上去
01020000000000200000000000000000000000000000 → shift+"-"="_"
01020000000000000000000000000000000000000000 → shift还按着
01000000000000000000000000000000000000000000 → shift松开
01020000000000000000000000000000000000000000 → shift按上去
01020000004000000000000000000000000000000000 → shift+"1"="!"
01020000000000000000000000000000000000000000 → shift还按着
01000000000000000000000000000000000000000000 → shift松开
01020000000000000000000000000000000000000000 → shift按上去
01020000000000800000000000000000000000000000 → shift+"["="{"
01020000000000000000000000000000000000000000 → shift还按着
01000000000000000000000000000000000000000000 → shift松开
01020000000000000000000000000000000000000000 → shift按上去
01020000000000000100000000000000000000000000 → shift+"]"="}"
01020000000000000000000000000000000000000000 → shift还按着
01000000000000000000000000000000000000000000 → shift松开
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
| normalKeys = {
'01001000000000000000000000000000000000000000': 'a',
'01002000000000000000000000000000000000000000': 'b',
'01004000000000000000000000000000000000000000': 'c',
'01008000000000000000000000000000000000000000': 'd',
'01000001000000000000000000000000000000000000': 'e',
'01000002000000000000000000000000000000000000': 'f',
'01000004000000000000000000000000000000000000': 'g',
'01000008000000000000000000000000000000000000': 'h',
'01000010000000000000000000000000000000000000': 'i',
'01000020000000000000000000000000000000000000': 'j',
'01000040000000000000000000000000000000000000': 'k',
'01000080000000000000000000000000000000000000': 'l',
'01000000010000000000000000000000000000000000': 'm',
'01000000020000000000000000000000000000000000': 'n',
'01000000040000000000000000000000000000000000': 'o',
'01000000080000000000000000000000000000000000': 'p',
'01000000100000000000000000000000000000000000': 'q',
'01000000200000000000000000000000000000000000': 'r',
'01000000400000000000000000000000000000000000': 's',
'01000000800000000000000000000000000000000000': 't',
'01000000000100000000000000000000000000000000': 'u',
'01000000000200000000000000000000000000000000': 'v',
'01000000000400000000000000000000000000000000': 'w',
'01000000000800000000000000000000000000000000': 'x',
'01000000001000000000000000000000000000000000': 'y',
'01000000002000000000000000000000000000000000': 'z',
'01000000004000000000000000000000000000000000': '1',
'01000000008000000000000000000000000000000000': '2',
'01000000000001000000000000000000000000000000': '3',
'01000000000002000000000000000000000000000000': '4',
'01000000000004000000000000000000000000000000': '5',
'01000000000008000000000000000000000000000000': '6',
'01000000000010000000000000000000000000000000': '7',
'01000000000020000000000000000000000000000000': '8',
'01000000000040000000000000000000000000000000': '9',
'01000000000080000000000000000000000000000000': '0',
'01000000000000200000000000000000000000000000': '-',
'01020000000000200000000000000000000000000000': '_',
'01020000004000000000000000000000000000000000': '!',
'01020000000000800000000000000000000000000000': '{',
'01020000000000000100000000000000000000000000': '}'
}
nums = []
keys = open('2.txt', 'rt') # 打开文件
for line in keys:
line = line.strip() # 去掉换行符
# print(line)
nums.append(line)
keys.close()
output = ""
for n in nums:
if n in normalKeys:
output += normalKeys[n]
# 只有当某一行n出现在normalkeys的键中 才输出对应字符
# 如果不在，就跳过
# else:
# output += '[unknown]'
print('output :' + output)
|
事实证明 如果不把alphabet.txt看懂是无法写出脚本的
flag{th1s_is_newkeyboard_y0u_get_it!}
另存为jpg图片
