当前位置: 首页 > news >正文

20250725_QQ_ezusb

Tags:流量分析,USB,pyshark,Base64,kamasutra,DASCTF

0x00. 题目

附件路径:https://pan.baidu.com/s/1GyH7kitkMYywGC9YJeQLJA?pwd=Zmxh#list/path=/CTF附件

附件名称:20250725_QQ_ezusb.zip

0x01. WP

1. 分析USB流量

有两个USB设备流量,

1.1.1usb.capdata

1.2.1usb.hiddata

image

2. 使用脚本分别抽取两个流量

# -*- coding: utf-8 -*-
import os
# os.system("tshark -r flag.pcapng -T fields -e usbhid.data > usbhdata.txt")
# os.system("tshark -r flag.pcapng -T fields -e usb.capdata > usbdata.txt")
normalKeys = {"04":"a", "05":"b", "06":"c", "07":"d", "08":"e", "09":"f", "0a":"g", "0b":"h", "0c":"i", "0d":"j", "0e":"k", "0f":"l", "10":"m", "11":"n","12":"o", "13":"p", "14":"q", "15":"r", "16":"s", "17":"t", "18":"u", "19":"v", "1a":"w", "1b":"x", "1c":"y", "1d":"z","1e":"1", "1f":"2", "20":"3","21":"4", "22":"5", "23":"6","24":"7","25":"8","26":"9","27":"0","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"-","2e":"=","2f":"[","30":"]","31":"\\","32":"<NON>","33":";","34":"'","35":"<GA>","36":",","37":".","38":"/","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
shiftKeys = {"04":"A", "05":"B", "06":"C", "07":"D", "08":"E", "09":"F", "0a":"G", "0b":"H", "0c":"I", "0d":"J", "0e":"K", "0f":"L", "10":"M", "11":"N","12":"O", "13":"P", "14":"Q", "15":"R", "16":"S", "17":"T", "18":"U", "19":"V", "1a":"W", "1b":"X", "1c":"Y", "1d":"Z","1e":"!", "1f":"@", "20":"#","21":"$", "22":"%","23":"^","24":"&","25":"*","26":"(","27":")","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"<NON>","33":"\"","34":":","35":"<GA>","36":"<","37":">","38":"?","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}# 常规键盘流量解析脚本
nums = []
keys = open('usbhdata.txt')
for line in keys:# print(len(line))if len(line) != 17:continuenums.append(line[0:2]+line[4:6]) 
# print(nums)
keys.close()output = ""
for n in nums:if n[2:4] == "00" :continueif n[2:4] in normalKeys:if n[0:2] == "02":output += shiftKeys [n[2:4]]else :output += normalKeys [n[2:4]]else:output += '[unknown]'
print('Part1 :' + output)
print('\n')# usb.capdata流量解析脚本
nums = []
keys = open('usbdata.txt')
for line in keys:# print(len(line))if len(line) != 15:continueif line[2:4] == "00":continuenums.append(line[2:4])
keys.close()print('Part2 :',''.join(nums).replace("02","0").replace("01","1"))# Part1 :congratulations,you<SPACE>finlly<SPACE>find<SPACE>me,but<SPACE>what<SPACE>i<SPACE>want<SPACE>to<SPACE>tell<SPACE>you<SPACE>is<SPACE>that<SPACE>roman<SPACE>roland<SPACE>once<SPACE>said<SPACE>thar<SPACE>there<SPACE>is<SPACE>only<SPACE>one<SPACE>kind<SPACE>of<SPACE>heroism<SPACE>in<SPACE>the<SPACE>worlld,that<SPACE>is<SPACE>to<SPACE>know<SPACE>the<SPACE>cruelty<SPACE>of<SPACE>the<SPACE>life<SPACE>but<SPACE>still<SPACE>love<SPACE>it.<CAP><CAP>ok,<CAP><CAP>get<SPACE>to<SPACE>the<SPACE>point;the<SPACE>[]-<SPACE>three<SPACE>symbols<SPACE>were<SPACE>added<SPACE>to<SPACE>the<SPACE>front<SPACE>of<SPACE>the<SPACE>base64<SPACE>table<SPACE>and<SPACE>handed<SPACE>to<SPACE>caesar.if<SPACE>you<SPACE>can<SPACE>decrypto<SPACE>the<SPACE>sercet<SPACE>you<SPACE>can<SPACE>get<SPACE>the<SPACE>half<SPACE>of<SPACE>flag.
#
# Part2 : 010010110110010101111001011000100011000001110010011000010110010001011111010000000110111001100100010111110101010101010011010000100010000101111101
# BIN2CHR=>Keyb0rad_@nd_USB!}

3. 解码secret.txt

E_RBUG}KtruA4ZrxABZ4rZsAZOeAlztrdA{}_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/

[]-替换为{}_形成基于Base64的字典,使用随波逐流工具的kamasutra爱经解密得到明文为DASCTF{JUST_3aSY_Ca3SaR_aND_MaUSE_

image

http://www.hskmm.com/?act=detail&tid=17958

相关文章:

  • .netcore 程序启动时的核心类 - 指南
  • DailyPaper-2025-9-26
  • qq
  • 人文领域的创新乏力:当价值内卷遇上元人文AI的破局之光
  • SimCC: a Simple Coordinate Classification Perspective for Human Pose Estimation
  • 10.1.1 启用python达成第一个遗传算法
  • [iOS] OC高级编程 - 引用计数 (1) - 详解
  • 实验1 C语言输入输出和简单程序编写
  • PySide6 之鼠标事件写字板
  • 深入解析:golang基础语法(三)常量、指针、别名、关键字、运算符、字符串类型转换
  • 单B细胞技术如何实现兔单抗高通量高特异制备
  • HP激光墨盒换墨粉
  • unordered_map性能被吊打!我用基数树让内存池性能暴涨几十倍的秘密
  • 详细介绍:《 Linux 点滴漫谈: 一 》开源之路:Linux 的历史、演进与未来趋势
  • 深入解析:TENGJUN“二合一(2.5MM+3.5MM)”耳机插座:JA10-BPD051-A;参数与材质说明
  • JAVA第一天
  • JUC:CompletableFuture详解
  • 平替Jenkins,推荐一款国产开源免费的CICD程序 - Arbess
  • Polar靶场-Web中等题目记录(9-16)
  • C# Avalonia 15- Animation- CustomEasingFunction
  • C#进阶
  • 包机制
  • Tensorboard的使用
  • 【Spring Boot】自定义starter
  • PrintNightmare漏洞仍未终结:深入解析PnP配置绕过与防护方案
  • Go 1.26 内置函数 new 新特性
  • 基于BP神经网络的激光焊接数据预测
  • 重要公式 - Emi
  • apt 还是 uv
  • 软件构造中的数据处理(sql) 6章