Writeup - Intercepted Conversati

先通过tshark 提取usb数据包内容字段

 .\tshark -r .\intercept.pcapng -T fields -e usb.capdata -Y 'usb.capdata && usb.transfer_type =
= 0x01 && frame.len == 72' > usbdata.txt

image.png

键盘流量包的第三个字节为敲击标志

mappings = { 0x04:"A",  0x05:"B",  0x06:"C", 0x07:"D",
 0x08:"E", 0x09:"F", 0x0A:"G",  0x0B:"H",
  0x0C:"I",  0x0D:"J", 0x0E:"K", 0x0F:"L",
   0x10:"M", 0x11:"N",0x12:"O",  0x13:"P",
    0x14:"Q", 0x15:"R", 0x16:"S", 0x17:"T",
     0x18:"U",0x19:"V", 0x1A:"W", 0x1B:"X",
      0x1C:"Y", 0x1D:"Z", 0x1E:"1", 0x1F:"2",
       0x20:"3", 0x21:"4", 0x22:"5",  0x23:"6",
        0x24:"7", 0x25:"8", 0x26:"9", 0x27:"0",
         0x28:"n", 0x2a:"[DEL]",  0X2B:"    ",
          0x2C:" ",  0x2D:"-", 0x2E:"=",
           0x2F:"[",  0x30:"]",  0x31:"\\", 0x32:"~", 0x33:";",  0x34:"'", 0x36:",",  0x37:"." }

通过python脚本提取第三个字节，并对应到键盘按键

image.png

参考资料：

http://www.cnblogs.com/ECJTUACM-873284962/p/9473808.html
https://lab.insightsecurity.com.br/writeup-intercepted-conversations-pt-1-icectf-2016/

了解了usb流量包的分析 及相关协议