2024-10-14 Keyboard Junkie (Forensics)

We see the keyboard input with HID standard values.

Get the hex values from Wireshark, and decode.

# Let's decode the provided hex values using the USB HID keycode mapping.
# We'll map the keycodes to their corresponding characters based on the HID standard.

# USB HID Keycode Mapping for basic characters
usb_hid_map = {
    0x04: 'a', 0x05: 'b', 0x06: 'c', 0x07: 'd', 0x08: 'e', 0x09: 'f', 0x0A: 'g', 0x0B: 'h',
    0x0C: 'i', 0x0D: 'j', 0x0E: 'k', 0x0F: 'l', 0x10: 'm', 0x11: 'n', 0x12: 'o', 0x13: 'p',
    0x14: 'q', 0x15: 'r', 0x16: 's', 0x17: 't', 0x18: 'u', 0x19: 'v', 0x1A: 'w', 0x1B: 'x',
    0x1C: 'y', 0x1D: 'z', 0x1E: '1', 0x1F: '2', 0x20: '3', 0x21: '4', 0x22: '5', 0x23: '6',
    0x24: '7', 0x25: '8', 0x26: '9', 0x27: '0', 0x28: 'ENTER', 0x29: 'ESC', 0x2C: ' ', 0x2D: '-',
    0x2E: '=', 0x2F: '[', 0x30: ']', 0x31: '\\', 0x33: ';', 0x34: '\'', 0x36: ',', 0x37: '.',
    0x38: '/'
}

# Provided hex values
hex_values = [
"0000160000000000",
"0000000000000000",
"0000120000000000",
"0000000000000000",
"00002c0000000000",
"0000000000000000",
"0000170000000000",
"0000000000000000",
"00000b0000000000",
"0000000000000000",
"0000080000000000",
"0000000000000000",
"00002c0000000000",
"0000000000000000",
"0000040000000000",
"0000000000000000",
"0000110000000000",
"0000000000000000",
"0000160000000000",
"0000000000000000",
"00001a0000000000",
"0000000000000000",
"0000080000000000",
"0000000000000000",
"0000150000000000",
"0000000000000000",
"00002c0000000000",
"0000000000000000",
"00000c0000000000",
"0000000000000000",
"0000160000000000",
"0000000000000000",
"00002c0000000000",
"0000000000000000",
"0000090000000000",
"0000000000000000",
"00000f0000000000",
"0000000000000000",
"0000040000000000",
"0000000000000000",
"00000a0000000000",
"0000000000000000",
"0200000000000000",
"02002f0000000000",
"0200000000000000",
"0000000000000000",
"0000090000000000",
"0000000000000000",
"0000240000000000",
"0000000000000000",
"0000240000000000",
"0000000000000000",
"0000200000000000",
"0000000000000000",
"0000200000000000",
"0000000000000000",
"0000080000000000",
"0000000000000000",
"0000270000000000",
"0000000000000000",
"0000270000000000",
"0000000000000000",
"0000260000000000",
"0000000000000000",
"0000200000000000",
"0000000000000000",
"0000050000000000",
"0000000000000000",
"0000240000000000",
"0000000000000000",
"0000070000000000",
"0000000000000000",
"00001f0000000000",
"0000000000000000",
"0000250000000000",
"0000000000000000",
"00001e0000000000",
"0000000000000000",
"0000070000000000",
"0000000000000000",
"0000070000000000",
"0000000000000000",
"0000270000000000",
"0000000000000000",
"0000040000000000",
"0000000000000000",
"0000200000000000",
"0000000000000000",
"0000270000000000",
"0000000000000000",
"0000090000000000",
"0000000000000000",
"0000060000000000",
"0000000000000000",
"0000090000000000",
"0000000000000000",
"0000200000000000",
"0000000000000000",
"0000210000000000",
"0000000000000000",
"0000040000000000",
"0000000000000000",
"0000260000000000",
"0000000000000000",
"0000230000000000",
"0000000000000000",
"0000200000000000",
"0000000000000000",
"0000210000000000",
"0000000000000000",
"0200000000000000",
"0200300000000000",
"0200000000000000",
"0000000000000000",
"00002c0000000000",
"0000000000000000",
"00000b0000000000",
"0000000000000000",
"0000040000000000",
"0000000000000000",
"00000b0000000000",
"0000000000000000",
"0000040000000000",
"0000000000000000",
"00000b0000000000",
"0000000000000000",
"0000040000000000",
"0000000000000000",
"00000b0000000000",
"0000000000000000",
"00002c0000000000",
"0000000000000000",
"00000f0000000000",
"0000000000000000",
"0000120000000000",
"0000000000000000",
"00000f0000000000",
"0000000000000000",
"0000280000000000",
"0000000000000000",
"0100000000000000",
"0100060000000000"
]

# Function to decode the keycodes
def decode_usb_keystrokes(hex_values):
    flag = []
    for hex_value in hex_values:
        keycode_hex = hex_value[4:6]  # Extract the relevant two hex digits
        keycode = int(keycode_hex, 16)
        if keycode in usb_hid_map:
            flag.append(usb_hid_map[keycode])
    return ''.join(flag)

# Decoding the flag
decoded_flag = decode_usb_keystrokes(hex_values)
print(decoded_flag)

flag[f7733e0093b7d281dd0a30fcf34a9634]