7

I'm currently enjoying a forensics CTF challenge. We were provided a PCAPNG file. When opened in Wireshark, the file contains a sequence of URB_INTERRUPT packets from two devices - but no GET_DESCRIPTOR info that identifies either device.

The first device give a sequence of 8-bit data like this:

00:00:00:00:00:00:00:00
00:00:04:00:00:00:00:00
00:00:04:15:00:00:00:00
00:00:00:15:00:00:00:00
00:00:08:15:00:00:00:00
00:00:08:00:00:00:00:00
00:00:00:00:00:00:00:00
02:00:00:00:00:00:00:00
02:00:2d:00:00:00:00:00
00:00:2d:00:00:00:00:00

Guessing that this was a keyboard, I decoded the sequence to this message:

scanlines-are-real-cool-guys

Which seems like a hint, right? The second (much longer) sequence of URB_INTERRUPT packets from the second device is 7-bit data like this:

01:00:01:00:02:00:00
01:00:00:00:02:00:00
01:00:00:00:01:00:00
01:00:00:00:02:00:00
01:00:01:00:01:00:00
01:00:01:00:02:00:00
01:00:00:00:02:00:00
01:00:01:00:01:00:00
01:00:01:00:00:00:00
01:00:00:00:01:00:00
01:00:ff:ff:01:00:00
01:00:fe:ff:00:00:00
01:00:ff:ff:00:00:00
01:00:ff:ff:00:00:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00
01:00:ff:ff:ff:ff:00

I guessed that this could be a mouse - even though most mouse data seem to only contain 4 bits, based on the fact that:

  1. Only two of the bits seem to change in any significant way - all other bits seem to only ever be 00, 01, or ff - thus potentially being the x and y coordinates
  2. The variable data stays in between 0 and 255
  3. Mice and keyboards seem to be the most common devices using URB_INTERRUPT

Acting on that guess, I sent the data through AWK:

awk -F: 'function comp(v){if(v>127)v-=256;return v}{x+=comp(strtonum("0x"$3));y+=comp(strtonum("0x"$5))}$1=="01"{print x,y}' hexoutput_second-part.txt > mouse1.txt

And then through GNUPLOT - hoping to get a traced message or something from an on-screen keyboard. But no luck - the plot ends up as:

enter image description here

Not especially helpful.

So my question is - how would I go tracking down what other devices could be sending 7 bit URB_INTERRUPT data? What is the best way to attack this identification process?

Thank you!

2
  • Are you able to provide the pcap file?
    – julian
    Jun 27 '18 at 13:59
  • @SYS_V Sure - here is a link: file.io/qm7oMO - thank you! Jun 27 '18 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.