Usb Hid Keystrokes

Category: FORENSICS · Difficulty: Advanced · Points: 500 · Challenge: 490

Background

A rogue microcontroller was detected posing as a standard USB human interface peripheral on a critical infrastructure terminal. The provided capture recorded raw interrupt transfers detailing keystroke scan codes. Decode the keystroke sequence. FORMAT: FLAG{ }

Analysis

The capture is 177 bytes and holds a single Ethernet frame carrying one IPv4 packet and one TCP segment from 192.168.1.100 to 192.168.1.1 on port 80, with no handshake and no retransmission. Because port 80 dissects as HTTP, the payload can be read straight out of the file without any stream reassembly:

$ tshark -r traffic-048.pcap -q -z io,phs
frame                frames:1 bytes:137
  eth                frames:1 bytes:137
    ip               frames:1 bytes:137
      tcp            frames:1 bytes:137

$ strings -n 6 traffic-048.pcap
GET /endpoint?token=FLAG{cwa2026_eddbe691e84f28ea} HTTP/1.1
Host: cwa.internal

The value sits in the query string rather than in a header or a request body. That placement carries forensic weight on its own, since query strings of this shape reach proxy logs and referrer headers considerably more often than request bodies do. The brief describes keystroke scan codes carried over raw USB interrupt transfers, but the capture contains only a single HTTP request, so no scan code table was required to read the content.

Result

FLAG{cwa2026_eddbe691e84f28ea}