Tenable CTF Forensic Challenges

The challenges I completed were all Wireshark related, from a provided PCAP file

H4ck3R_m4n exp0sed! 1 25
Open the pcap in Wireshark
Browse Statistics->Conversations
Note files downloaded by hackerman – supersecure.7z
Note compressed file password “bbqsauce”
Note file uploaded butter.jpg
Browse to butter.jpg file stream. Save and view Data As … -> Raw
Save As… butter.jpg
View file – image contains flag{u_p4ss_butt3r}

H4ck3R_m4n exp0sed! 2 25
Browse to the 7z file stream. Save And View Data As… -> Raw
Save As… supersecure.7z
On the command line run: 7z e supersecure.7z – extracts 2 files – dataz and pickle_nick.png
pickle_nick.png has image with flag{pickl3_NIIICK}

H4ck3R_m4n exp0sed! 3 50
2nd file extracted is dataz – hex
Open CyberChef – use recipe From Hex; From Base64
Output is a JFIF (JPG) file.
Save output as dataz.jpg, open in image viewer
flag{20_minute_adventure}

Cat Taps 100

This is a capture of USB keyboard traffic. I found a great article by ProgrammerSought explaining this here, from which they produced the below code. Note: certain characters need to be mapped, as they are missing, but it is sufficient to figure out the answer – flag{usb_pcaps_are_fun}.

mappings = { 0x04:"A",  0x05:"B",  0x06:"C", 0x07:"D", 0x08:"E", 0x09:"F", 0x0A:"G",  0x0B:"H", 0x0C:"I",  0x0D:"J", 0x0E:"K", 0x0F:"L", 0x10:"M", 0x11:"N",0x12:"O",  0x13:"P", 0x14:"Q", 0x15:"R", 0x16:"S", 0x17:"T", 0x18:"U",0x19:"V", 0x1A:"W", 0x1B:"X", 0x1C:"Y", 0x1D:"Z", 0x1E:"1", 0x1F:"2", 0x20:"3", 0x21:"4", 0x22:"5",  0x23:"6", 0x24:"7", 0x25:"8", 0x26:"9", 0x27:"0", 0x28:"\n", 0x2a:"[DEL]",  0X2B:"    ", 0x2C:" ",  0x2D:"-", 0x2E:"=", 0x2F:"[",  0x30:"]",  0x31:"\\", 0x32:"~", 0x33:";",  0x34:"'", 0x36:",",  0x37:"." }
nums = []
keys = open('usbdata.txt')
for line in keys:
    if line[0]!='0' or line[1]!='0' or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0':
         continue
    nums.append(int(line[6:8],16))
keys.close()
output = ""
for n in nums:
    if n == 0 :
        continue
    if n in mappings:
        output += mappings[n]
print 'output :\n' + output