# strange-pcap

| Info     | Details        |
| -------- | -------------- |
| Category | Forensics      |
| File     | Strange.pcapng |

### Challenge Overview

This challenge is about analyzing carefully a **.pcapng** file.

My usual approach when analyzing a **.pcapng** file is to start with **basic file inspection commands**:

```bash
file Strange.pcapng
exiftool Strange.pcapng
binwalk Strange.pcapng
```

It seems that **binwalk** found a **protected zip archive** named **flag** which contains **flag.txt**. Unfortunately it cannot be cracked with tools like **John** or **Hashcat** so it must be a way to unzip it.

I retrieved the archive using:

```bash
binwalk -e Strange.pcapng
```

### Traffic Analysis

Opening the file using **wireshark** we see that we've got a lot of **USB captures**. I tried some **exfiltration combinations** and one of them was **usbhid.data**.

> Note: **HID (Human Interface Device)** is a device-class protocol used over USB or Bluetooth that standardizes communication between human-interface devices (e.g., keyboards and mice) and a host computer.

The moment that I saw **HID** I was thinking directly about the **password** that we need to extract the **flag**.

I extracted all those packets using:

```bash
tshark -r Strange.pcapng -Y "usbhid.data" -T fields -e usbhid.data > data.txt
awk 'length($0) >= 16' data.txt | sed 's/../&:/g; s/:$//' > data_final.txt
```

(This command filters out **short (noise) entries** and formats the remaining **USB HID data** into **xx:yy byte notation**, preparing it for **script-based analysis**).

### HID Decoding

I used the following **script** to convert the captured **HID data** into **plaintext**.

* <https://github.com/TeamRocketIst/ctf-usb-keyboard-parser>

```bash
┌──(razvanttn㉿Centru)-[~/ctf-usb-keyboard-parser]
└─$ python3 usbkeyboard.py ../ctf/data_clean.txt
7vgj4SSL9NHVuK0D6d3F
```

With this **password** we can extract the content of the **archive** (**flag.txt**).

*made by k0d*
