---
description: USB keystroke in Wireshark
---

# KB

## Description

Hmm, haven't seen this type of wireshark file in a while now.

Attachment: `challenge.pcapng`



## Solution

We were given a pcap file for this challenge. However, it has different protocols compared to what we normally see.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FhCiRYWohLNbdP6guiYAR%2Fimage.png?alt=media&#x26;token=7ae72746-3599-4edf-b12e-148bf7d60914" alt=""><figcaption></figcaption></figure>

Note that the captured packets are using USB protocol. Since we are not familiar with this kind of packet capture, let's try to find for similar CTF writeups (if there's any).

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FUjwLfvwubk85ZLCaFVms%2Fimage.png?alt=media&#x26;token=acc4fc56-9e09-481f-beb4-b7b5eaa87ec5" alt=""><figcaption></figcaption></figure>

We found some useful websites and videos for similar challenges. It says that we have to record all the keystrokes captured.&#x20;

```
tshark -r challenge.pcapng -Y 'usb.capdata && usb.data_len == 8' -T fields -e usb.capdata | sed
's/../:&/g2' > keystrokes.txt
```

We can use `tshark` to get the keystrokes we want.

<figure><img src="https://3139068166-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F5otAmBnHXiDB0QXOOAMF%2Fuploads%2FihMTbAHXDoBfIYHmJB9O%2Fimage.png?alt=media&#x26;token=380a2baa-4992-49e9-8ea8-7d3092a83262" alt=""><figcaption></figcaption></figure>

Then we use a [keystroke parser](https://github.com/carlospolop-forks/ctf-usb-keyboard-parser) to parse all the keystroke and display it.



## Flag

`GCTF2023{1nt3rc3pt1ng_keystr0k3}`



## Resources

* [https://abawazeeer.medium.com/kaizen-ctf-2018-reverse-engineer-usb-keystrok-from-pcap-file-2412351679f4](https://abawazeeer.medium.com/kaizen-ctf-2018-reverse-engineer-usb-keystrok-from-pcap-file-2412351679f4)
* [https://www.youtube.com/watch?v=EnOgRyio\_9Q](https://www.youtube.com/watch?v=EnOgRyio_9Q)
