Bugku：杂项 USB 流量截取

这道题的flag其实是有点问题的，

花了1金币买wp才知道。

打开这道题，

下载后是一个USB的流量包，

他的特点是第五和第六位是构成了键盘的流量，有大佬推荐看这篇文章：

https://blog.csdn.net/ON_Zero/article/details/130528679

但其中比较关键的有第一和第二位构成的值，表示是当取0x00时，代表没有按键，为0x01时，代表按左按键，为0x02时，代表当前按键为右键，0x20表示shift键。

所以我们先用脚本提取出USB流量相关信息。这个命令windows和linux都有，可以自行查一下。

.\tshark.exe -r D:\Downloads\flag.pcap -T fields -e usb.capdata >D:\Downloads\usbdata.txt

生成usbdata.txt之后，就可以用脚本进行处理。

首先用：进行分隔，

f=open('usbdata.txt','r') fi=open('out.txt','w')while 1:  a=f.readline().strip()   if a:    if len(a)==16:#键盘流量的话len为16鼠标为8       out=''      for i in range(0,len(a),2):        if i+2 != len(a):          out+=a[i]+a[i+1]+":"         else:          out+=a[i]+a[i+1]       fi.write(out)       fi.write('\n')   else:     break ​

这里有两个脚本：

mappings = { 0x04:"A",  0x05:"B",  0x06:"C", 0x07:"D", 0x08:"E", 0x09:"F", 0x0A:"G",  0x0B:"H", 0x0C:"I",  0x0D:"J", 0x0E:"K", 0x0F:"L", 0x10:"M", 0x11:"N",0x12:"O",  0x13:"P", 0x14:"Q", 0x15:"R", 0x16:"S", 0x17:"T", 0x18:"U",0x19:"V", 0x1A:"W", 0x1B:"X", 0x1C:"Y", 0x1D:"Z", 0x1E:"1", 0x1F:"2", 0x20:"3", 0x21:"4", 0x22:"5",  0x23:"6", 0x24:"7", 0x25:"8", 0x26:"9", 0x27:"0", 0x28:"\n", 0x2a:"[DEL]",  0X2B:"    ", 0x2C:" ",  0x2D:"-", 0x2E:"=", 0x2F:"[",  0x30:"]",  0x31:"\\", 0x32:"~", 0x33:";",  0x34:"'", 0x36:",",  0x37:"." }nums = []keys = open('out.txt')for line in keys:    if line[0]!='0' or line[1]!='0' or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0':         continue    nums.append((line[6:8],16)) print numskeys.close()output = ""for n in nums:    if n == 0 :        continue    if n in mappings:        output += mappings[n]    else:        output += '[unknown]'print 'output :\n' + output​

这个脚本跑出来是

这个脚本得出的flag是没有下划线的，但是我们直接看usbdata.txt中是存在下划线这个字符的。

normalKeys = {"04":"a", "05":"b", "06":"c", "07":"d", "08":"e", "09":"f", "0a":"g", "0b":"h", "0c":"i", "0d":"j", "0e":"k", "0f":"l", "10":"m", "11":"n", "12":"o", "13":"p", "14":"q", "15":"r", "16":"s", "17":"t", "18":"u", "19":"v", "1a":"w", "1b":"x", "1c":"y", "1d":"z","1e":"1", "1f":"2", "20":"3", "21":"4", "22":"5", "23":"6","24":"7","25":"8","26":"9","27":"0","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"-","2e":"=","2f":"[","30":"]","31":"\\","32":"<NON>","33":";","34":"'","35":"<GA>","36":",","37":".","38":"/","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"} shiftKeys = {"04":"A", "05":"B", "06":"C", "07":"D", "08":"E", "09":"F", "0a":"G", "0b":"H", "0c":"I", "0d":"J", "0e":"K", "0f":"L", "10":"M", "11":"N", "12":"O", "13":"P", "14":"Q", "15":"R", "16":"S", "17":"T", "18":"U", "19":"V", "1a":"W", "1b":"X", "1c":"Y", "1d":"Z","1e":"!", "1f":"@", "20":"#", "21":"$", "22":"%", "23":"^","24":"&","25":"*","26":"(","27":")","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"<NON>","33":"\"","34":":","35":"<GA>","36":"<","37":">","38":"?","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}  nums = []keys = open(r"usbdata.txt")for line in keys:    if len(line)!=17: #首先过滤掉鼠标等其他设备的USB流量         continue    nums.append(line[0:2]+line[4:6]) #取一、三字节keys.close()output = ""for n in nums:    if n[2:4] == "00" :        continue     if n[2:4] in normalKeys:        if n[0:2]=="02": #表示按下了shift            output += shiftKeys [n[2:4]]        else :            output += normalKeys [n[2:4]]    else:        output += ''print('output :' + output)

这个脚本得出

这里可以看到[]和-其实是没有按shift键的，所以转换成{}和_就可以。

作者设定的flag是：

flag{pr3550nwardsa2fee6e0}

欢迎关注我的微信公众号！！~~

一起快落学习CTF吧！！~~ (*^▽^*)

大知闲闲，小知间间，大言炎炎，小炎詹詹。