Skip to content

Instantly share code, notes, and snippets.

@ciel334288
Last active December 31, 2020 09:28
Show Gist options
  • Select an option

  • Save ciel334288/f14f50dc6f690c6ed51f405aba6d1841 to your computer and use it in GitHub Desktop.

Select an option

Save ciel334288/f14f50dc6f690c6ed51f405aba6d1841 to your computer and use it in GitHub Desktop.
Deadly Arthropod forensics challenge from Hackthebox
# USB HID keyboard/keypad: http://www.usb.org/developers/hidpage/Hut1_12v2.pdf
keys={ '04':'a',
'05':'b',
'06':'c',
'07':'d',
'08':'e',
'09':'f',
'0a':'g',
'0b':'h',
'0c':'i',
'0d':'j',
'0e':'k',
'0f':'l',
'10':'m',
'11':'n',
'12':'o',
'13':'p',
'14':'q',
'15':'r',
'16':'s',
'17':'t',
'18':'u',
'19':'v',
'1a':'w',
'1b':'x',
'1c':'y',
'1d':'z',
'1e':'1',
'1f':'@',
'20':'3',
'21':'4',
'22':'5',
'23':'6',
'24':'7',
'25':'8',
'26':'9',
'27':'0',
'28':'\n',
'29':'ESC',
'2a':'BACKSPACE',
'2b':'\t',
'2c':' ',
'2d':'_',
'2e':'=',
'2f':'{',
'30':'}',
'31':'\\',
'32':'#',
'33':';',
'34':"'",
'35':'',
'36':',',
'37':'.',
'38':'/',
'50':'<',
'4f':'>' }
data=[]
# tshark -r deadly_arthropod.pcap -Tfields -e usb.capdata > capdata && cat capdata|cut -d: -f1,3 > lov_capdata && rm capdata
with open('lov_capdata','r') as f:
for k in f.readlines():
if k[:2] == '02':
try:
data.append(keys[k.split(':')[1].strip()].upper())
except:
pass
elif k[:2] == '00':
try:
data.append(keys[k.split(':')[1].strip()])
except:
pass
_fstr=''.join(_ for _ in data)
print (f'{_fstr}%s\n')
idx=0
_reog=[]
for i in _fstr:
if i == '<':
idx-=1
continue
if i == '>':
idx+=1
else:
_reog.insert(idx,i)
idx+=1
fstr=''.join(_ for _ in _reog)
print (fstr.replace('<','').replace('>',''))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment