CTF—MISC—USB键盘流量分析
时间:2021-08-24
本文章向大家介绍CTF—MISC—USB键盘流量分析,主要包括CTF—MISC—USB键盘流量分析使用实例、应用技巧、基本知识点总结和需要注意事项,具有一定的参考价值,需要的朋友可以参考一下。
题目
题目名称:键盘流量题目类型:MISC
解题思路
题目下载解压发现是55.pcapng、miwen.txt两个文件
55.pcapng
打开pcap包,发现是usb的键盘流量,键盘流量的数据记录在Data中,需要把所有Data数据提取出来,进行十六进制键位转换得出数据包记录的键盘敲击内容
1、利用wireshark tshark.exe命令提取流量数据,详情如下:
tshark.exe -T json -r 55.pcapng > test.json
//用法 tshark.exe -T json -r 数据包名称 > 要导出的文件
导出的文件如下,键盘数据存储在usbhid.data中,将所有的usbhid.data值提取出来
2、利用python编写的脚本对提取出来的所有usbhid.data转化生成敲击内容,脚本原理
#!/usr/bin/env python
# -*- coding:utf-8 -*-
normalKeys = {"04":"a", "05":"b", "06":"c", "07":"d", "08":"e", "09":"f", "0a":"g", "0b":"h", "0c":"i", "0d":"j", "0e":"k", "0f":"l", "10":"m", "11":"n", "12":"o", "13":"p", "14":"q", "15":"r", "16":"s", "17":"t", "18":"u", "19":"v", "1a":"w", "1b":"x", "1c":"y", "1d":"z","1e":"1", "1f":"2", "20":"3", "21":"4", "22":"5", "23":"6","24":"7","25":"8","26":"9","27":"0","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"-","2e":"=","2f":"[","30":"]","31":"\\","32":"<NON>","33":";","34":"'","35":"<GA>","36":",","37":".","38":"/","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
shiftKeys = {"04":"A", "05":"B", "06":"C", "07":"D", "08":"E", "09":"F", "0a":"G", "0b":"H", "0c":"I", "0d":"J", "0e":"K", "0f":"L", "10":"M", "11":"N", "12":"O", "13":"P", "14":"Q", "15":"R", "16":"S", "17":"T", "18":"U", "19":"V", "1a":"W", "1b":"X", "1c":"Y", "1d":"Z","1e":"!", "1f":"@", "20":"#", "21":"$", "22":"%", "23":"^","24":"&","25":"*","26":"(","27":")","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"<NON>","33":"\"","34":":","35":"<GA>","36":"<","37":">","38":"?","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
output = []
keys = open('usbdata.txt')
for line in keys:
try:
if line[0]!='0' or (line[1]!='0' and line[1]!='2') or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0' or line[6:8]=="00":
continue
if line[6:8] in normalKeys.keys():
output += [[normalKeys[line[6:8]]],[shiftKeys[line[6:8]]]][line[1]=='2']
else:
output += ['[unknown]']
except:
pass
keys.close()
flag=0
print("".join(output))
for i in range(len(output)):
try:
a=output.index('<DEL>')
del output[a]
del output[a-1]
except:
pass
for i in range(len(output)):
try:
if output[i]=="<CAP>":
flag+=1
output.pop(i)
if flag==2:
flag=0
if flag!=0:
output[i]=output[i].upper()
except:
pass
print ('output :' + "".join(output))
内容为
plk<DEL>eae<DEL>sey<DEL>fii<DEL>ndts<DEL>hery<DEL>ealy<DEL>keyd<DEL>words<DEL>
output :pleasefindtherealkeyword
key
原文地址:https://www.cnblogs.com/renhaoblog/p/15148455.html
- Java面试系列24-spring(3)-配置文件相关问题
- Java基础-day03-基础题
- 简单易学的机器学习算法——EM算法
- 备库跳归档恢复的有趣案例(r9笔记第19天)
- Java基础-day02-代码题
- 优化算法——拟牛顿法之L-BFGS算法
- 一次性能突发情况的紧急修复(r9笔记第18天)
- Java基础-day02-基础题
- 简单易学的机器学习算法——AdaBoost
- 用脚本来讲一个技术生活的故事 (r9笔记第32天)
- 优化算法——拟牛顿法之BFGS算法
- 对于tnsping的连接超时的功能补充(二)(r9笔记第22天)
- 用深度学习每次得到的结果都不一样,怎么办?
- 优化算法——拟牛顿法之DFP算法
- JavaScript 教程
- JavaScript 编辑工具
- JavaScript 与HTML
- JavaScript 与Java
- JavaScript 数据结构
- JavaScript 基本数据类型
- JavaScript 特殊数据类型
- JavaScript 运算符
- JavaScript typeof 运算符
- JavaScript 表达式
- JavaScript 类型转换
- JavaScript 基本语法
- JavaScript 注释
- Javascript 基本处理流程
- Javascript 选择结构
- Javascript if 语句
- Javascript if 语句的嵌套
- Javascript switch 语句
- Javascript 循环结构
- Javascript 循环结构实例
- Javascript 跳转语句
- Javascript 控制语句总结
- Javascript 函数介绍
- Javascript 函数的定义
- Javascript 函数调用
- Javascript 几种特殊的函数
- JavaScript 内置函数简介
- Javascript eval() 函数
- Javascript isFinite() 函数
- Javascript isNaN() 函数
- parseInt() 与 parseFloat()
- escape() 与 unescape()
- Javascript 字符串介绍
- Javascript length属性
- javascript 字符串函数
- Javascript 日期对象简介
- Javascript 日期对象用途
- Date 对象属性和方法
- Javascript 数组是什么
- Javascript 创建数组
- Javascript 数组赋值与取值
- Javascript 数组属性和方法
- Python 二进制,十进制,十六进制转换
- 原生node处理get和post请求
- 如何在Vue中自己实现v-model
- 【STM32F429】第1章 当前主流的小型嵌入式GUI
- 【Unity游戏开发】升级Unity2019后,资源管线后处理采坑记录
- Angular @Effect监听指定Action类型的实现原理
- SAP Spartacus shipping address页面请求1 - Address
- SAP Spartacus shipping address页面请求2.1 - setDefaultAddress
- SAP Spartacus只执行指定单元测试的小技巧
- SAP CDS view里将Date和time连接成timestamp的函数
- SAP CDS view里计算两个date & time字段间包含的seconds秒数
- SAP CDS view里的日期操作函数(往后推算X天得到新日期)
- SAP CDS view的日期格式转换,比如从YYYYMMDD转到DD/MM/YYYY
- SAP CDS view如何取得当前系统日期和系统时间戳
- Vue 父组件如何监听子组件的生命周期