Logger

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

A client reported that a PC might have been infected, as it's running slow. We've collected all the evidence from the suspect workstation, and found a suspicious trace of USB traffic. Can you identify the compromised data?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Since it's a .pcap file, let's open it using wireshark.

3. Notice there are many URB_INTERRUPT packets.

4. These USB packets are keystrokes, there was some vuln that affect USB wireless devices. (keyboard).

5. Let's export all of it as the indicates keystrokes.

6. First we need to filter the USB Keyboard packets. I did a small outsource about the command to use, found out this one:

usb.transfer_type == 0x01 and frame.len == 35 and !(usb.capdata == 00:00:00:00:00:00:00:00)

1. Now select all the packets, then click file -> export specified packets.

2. Now to get the flag, i used this python script.

COMMAND - to get the .txt file which we will use for the script.

tshark -r ../../../../../Downloads/bin/foren/logger/exported.pcapng -Y 'usb.capdata && usb.data_len == 8' -T fields -e usb.capdata | sed 's/../:&/g2' > keystrokes.txt

1. Following the capslock command, we shall get the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.