Snyk Fetch The Flag - ClickityClack

In this challenge, we started with a pcapng file that contains the hidden flag inside. Initially, I tried to analyze it using Wireshark, but couldn’t find anything relevant. That’s when a simple Google search gave me the key clue:

pcapng usb ctf

This search led me to discover a tool called Usb_Keyboard_Parser.py that parses USB traffic packets, such as keypresses.

All it takes is to pass the file to the script to retrieve the flag at the end of the keypresses.

python Usb_Keyboard_Parser.py click.pcapng

[-] Found Modifier in 10 packets [-]

[+] Using filter "usbhid.data" Retrived HID Data is : 

aaaaacaaaaaaaaaabaaaaaababadaaaabaaaaaacaaaabaaaaaaadabbacbabccabcccabcgccccccgccdcdcgccdfccdccdfccddccfccfdbccaccbacbbcbbcbbbcbbcbbbbbcbbcbbcgbcbbbcbbbccbacbcbbbcbbcbbbbbbcbbafbbbababaaeabaaaaaaacaaaaaaaacaaaaaaeabaaaaaaabaaababbbbacbbabbbbbbbbbbbebbbabbbcbebbcbbcbbebbcacbbbbbfbbbcacbgcababbdbbdbababbabbcbbababbbaebabaabbbaeabbaababbabaebabbabbaeabaaabaaaabaabaabaaabaaaaebaaaaaaabacaabaaaaaaaaaaaaeaaaaaaaaaaaaaaaaaaaaaaacaaaaaaaaaaabaabaaafaabababbabaaaacaababaaacabaababbbbbbbebcbdcccccccfdceddceddcddefeeheeefeaeeeeiefeefefnefefeiefeeiefefefeeieefaeeeejeedfedhdedbdegddcdgdddcdcdacdfdccccdfcccbbbcbbbbbbbbbadaaaaaaaaaaflag{a3ce310e9a0dc53bc030847192e2f585}

↑↑Thhis iis a ppreetty ccool thhing tthatt I hhave ffigguredd ooutt.
Yoou can capturre thhe chharacteers yyouuu type in PCAPs.aa↑↑
mmmmmmmmmm↑↑
mmmmmmmmmm↑↑
mmmmmmmmmm↑↑
mmmmmmmmmm↑↑
mmmmmmmmmm↑↑
mmmmmmmmmmaaaaaaabdbaaaaaaaaabaaaaaa

🚩 Flag

flag{a3ce310e9a0dc53bc030847192e2f585}