# Full writeups for this challenge avaliable on [https://github.com/evyatar9/Writeups/blob/master/CTFs/2021-CTF_HackTheBox/Cyber_Apocalypse_2021/](https://github.com/evyatar9/Writeups/blob/master/CTFs/2021-CTF_HackTheBox/Cyber_Apocalypse_2021/)
# CTF HackTheBox 2021 Cyber Apocalypse 2021 - Key Mission
Forensics: Pwn, Points: 300
![info.JPG](https://github.com/evyatar9/Writeups/raw/master/CTFs/2021-CTF_HackTheBox/Cyber_Apocalypse_2021/Forensics-Key_mission/images/info.JPG)
Attached file [forensics_key_mission.zip](https://github.com/evyatar9/Writeups/blob/master/CTFs/2021-CTF_HackTheBox/Cyber_Apocalypse_2021/Forensics-Key_mission/forensics_key_mission.zip)
# Key Mission Solution
The attached file contains .pcap file, Let's try to observe it using Wireshark:
![wireshark.JPG](https://github.com/evyatar9/Writeups/raw/master/CTFs/2021-CTF_HackTheBox/Cyber_Apocalypse_2021/Forensics-Key_mission/images/wireshark.JPG)
So by clicking on Statistics->Capture File Properties we can see the follow:
![prop.JPG](https://github.com/evyatar9/Writeups/raw/master/CTFs/2021-CTF_HackTheBox/Cyber_Apocalypse_2021/Forensics-Key_mission/images/prop.JPG)
It's mean we are dealing with capute file was taked from USB device.
By looking for Device Description header for another packets we can see the follow:
![device.JPG](https://github.com/evyatar9/Writeups/raw/master/CTFs/2021-CTF_HackTheBox/Cyber_Apocalypse_2021/Forensics-Key_mission/images/device.JPG)
By searching for Device name: BlackWidow Ultimate we can found the following link [https://www2.razer.com/ap-en/gaming-keyboards-keypads/razer-blackwidowultimate-2016](https://www2.razer.com/ap-en/gaming-keyboards-keypads/razer-blackwidowultimate-2016):
![blackwidow.JPG](https://github.com/evyatar9/Writeups/raw/master/CTFs/2021-CTF_HackTheBox/Cyber_Apocalypse_2021/Forensics-Key_mission/images/blackwidow.JPG)
So now we are know that is keyboard usb device, Great.
By looking at the following [https://www.usb.org/sites/default/files/documents/hut1_12v2.pdf](https://www.usb.org/sites/default/files/documents/hut1_12v2.pdf) we can understand how the keyboard input works.
We can use ```tshark``` filter to take all relevant hid data packetes:``` console┌─[evyatar@parrot]─[/ctf_htb/cyber_apocalypse/forensics/key_mission]└──╼ $ tshark -r key_mission.pcap -T fields -e usb.capdata 'usb.data_len == 8'020000000000000002000c00000000000200000000000000000000000000000000002c00000000000000000000000000000004000000000000000000000000000000100000000000000000000000000000002c000000000000000000000000000000160000000000000000000000000000000800000000000000000000000000000011000000000000000000000000000000070000000000000000000000000000000c0000000000000000000000000000001100000000000000000000000000...```
Now, Let's remove all ```0000000000000000``` using ```grep```:``` console┌─[evyatar@parrot]─[/ctf_htb/cyber_apocalypse/forensics/key_mission]└──╼ $ tshark -r key_mission.pcap -T fields -e usb.capdata 'usb.data_len == 8' | grep -v 0000000000000000020000000000000002000c0000000000020000000000000000002c00000000000000040000000000000010000000000000002c0000000000000016000000000000000800000000000000110000000000000007000000000000000c0000000000000011000000000000000a000000000000002c00000000000000160000000000000008000000000000000600000000000000150000000000000008000000000000001700000000000000040000000000000015000000000000001c00000000000000340000000000000016000000000000002c000000000000000f0000000000000012000000000000000600000000000000040000000000000017000000000000000c00000000000000120000000000000011000000000000002c0000000000000012000000000000001900000000000000080000000000000015000000000000002c0000000000000017000000000000000b000000000000000c0000000000000016000000000000002c0000000000000017000000000000001200000000000000170000000000000004000000000000000f000000000000000f000000000000001c000000000000002c0000000000000008000000000000001100000000000000060000000000000015000000000000001c0000000000000013000000000000001700000000000000080000000000000007000000000000002c0000000000000006000000000000000b0000000000000004000000000000001100000000000000110000000000000008000000000000000f000000000000002c00000000000000170000000000000012000000000000002c00000000000000100000000000000004000000000000000e0000000000000008000000000000002c0000000000000016000000000000001800000000000000150000000000000008000000000000002c00000000000000110000000000000012000000000000002c000000000000001200000000000000110000000000000008000000000000002c0000000000000008000000000000000f00000000000000160000000000000008000000000000002c000000000000001a000000000000000c000000000000000f000000000000000f000000000000002c00000000000000050000000000000008000000000000002c00000000000000040000000000000005000000000000000f0000000000000008000000000000002c00000000000000170000000000000012000000000000002c0000000000000015000000000000000800000000000000040000000000000007000000000000002c000000000000000c0000000000000017000000000000002c0000000000000008000000000000001b0000000000000006000000000000000800000000000000130000000000000017000000000000002c00000000000000120000000000000009000000000000002c000000000000001800000000000000160000000000000037000000000000002c000000000002000000000000000200170000000000020000000000000000000b000000000000000c0000000000000016000000000000002c000000000000000c0000000000000011000000000000000900000000000000120000000000000015000000000000001000000000000000040000000000000017000000000000000c00000000000000120000000000000011000000000000002c000000000000000c0000000000000016000000000000002c0000000000000006000000000000001200000000000000110000000000000009000000000000000c0000000000000007000000000000000800000000000000110000000000000017000000000000000c0000000000000004000000000000000f000000000000002c000000000000000400000000000000110000000000000007000000000000002c0000000000000010000000000000001800000000000000160000000000000017000000000000002c000000000000001100000000000000120000000000000017000000000000002c00000000000000050000000000000008000000000000002c0000000000000016000000000000000b0000000000000004000000000000001500000000000000080000000000000007000000000000002c000000000000001a000000000000000c0000000000000017000000000000000b000000000000002c00000000000000040000000000000011000000000000001c000000000000001200000000000000110000000000000008000000000000002c0000000000000008000000000000000f000000000000001600000000000000080000000000000037000000000000002c000000000002000000000000000200170000000000020000000000000000000b0000000000000008000000000000002c00000000000000160000000000000008000000000000000600000000000000150000000000000008000000000000001700000000000000040000000000000015000000000000001c00000000000000340000000000000016000000000000002c000000000000000b000000000000000c0000000000000007000000000000000700000000000000080000000000000011000000000000002c000000000000000f0000000000000012000000000000000600000000000000040000000000000017000000000000000c00000000000000120000000000000011000000000000002c000000000000000c0000000000000016000000000000002c000000000002000000000000000200060000000000020000000000000002000b000000000002000000000000000200170000000000020000000000000002000500000000000200000000000000020000000000000002002f000000000002000000000000000000040000000000020000000000000002002d00000000000200000000000000000013000000000000000f0000000000000004000000000000000600000000000000200000000000020000000000000002002d0000000000020000000000000000000900000000000200000000000000020004000000000002000000000000000000150000000000020000000000000002002d0000000000020000000000000000000900000000000200000000000000020004000000000002000000000000000000150000000000020000000000000002002d00000000000200000000000000000004000000000000001a0000000000000004000000000000001c0000000000020000000000000002002d000000000002000000000000000000090000000000000015000000000000002700000000000000100000000000020000000000000002002d0000000000020000000000000000000800000000000000040000000000000008000000000000002a00000000000000150000000000000017000000000000000b0000000000020000000000000002003000000000000200000000000000```
Great, Let's just write it to file called ```input_keys``` (using ```tshark -r key_mission.pcap -T fields -e usb.capdata 'usb.data_len == 8' | grep -v 0000000000000000 > input_keys```)
So with the attached linked above we can create python script to translate the bytes to character:```pythonimport re
keys = {"02": "SHIFT",        "04": "aA",        "05": "bB",        "06": "cC",        "07": "dD",        "08": "eE",        "09": "fF",        "0a": "gG",        "0b": "hH",        "0c": "iI",        "0d": "jJ",        "0e": "kK",        "0f": "lL",        "10": "mM",        "11": "nN",        "12": "oO",        "13": "pP",        "14": "qQ",        "15": "rR",        "16": "sS",        "17": "tT",        "18": "uU",        "19": "vV",        "1a": "wW",        "1b": "xX",        "1c": "yY",        "1d": "zZ",        "1e": "1!",        "1f": "2@",        "20": "3#",        "21": "4$",        "22": "5%",        "23": "6^",        "24": "7&",        "25": "8*",        "26": "9(",        "27":"0)",        "2a":"DELETE",        "2d": "-_",        "2f": "[{",        "30": "]}",        "2c": " "}flag = ""
filename = 'input_keys' with open(filename, "r") as f:    data = f.readline()    while data:        data = f.readline()        res = re.findall("..", data)         if len(res) > 2:            if res[2] in keys:                if res[2] == "2a": #delete - remove the last character                    flag = flag[:-1]                else:                    if res[0] == "02": #shift - take upper case                        flag +=keys[res[2]][1]                    else: # take lower case                        flag += keys[res[2]][0] print(flag)```
Let's run it:```console┌─[evyatar@parrot]─[/ctf_htb/cyber_apocalypse/forensics/key_mission]└──╼ $ python3 solve.py input_keys I am sending secretarys location over this totally encrypted channel to make sure no one else will be able to read it except of us This information is confidential and must not be shared with anyone else The secretarys hidden location is CHTB{a_plac3_fAr_fAr_away_fr0m_earth}```
And we get the flag ```CHTB{a_plac3_fAr_fAr_away_fr0m_earth}```.