Private Assertion Nexus

Difficulty
Points

Easy

150

Description

I've heard talk about a simple method of communication, but I'm not sure what it is. Luckily I found some traffic of the said communication, but I'm too noob to figure it out. Please help me crack this enigma of a transmission.

57KB
traffic.pcap
Open

Solution

TL;DR

  1. Find the correct sourcecode which leads to the key mappings.

  2. Decrypt the l2cap packets.

  3. Stonks

Analysis

Viewing the packets captured, we mostly see garbage data that are not relevant to solving the challenge.

Garbage Data 1

We can see that the first few packets are mostly configuration packets and can put these aside first.

Garbagde Data 2

Followed by these long chain of USB_INTERRUPT packets, which we can also put aside and come back to them later if needed.

Scrolling down, we suddenly see a bunch of L2CAP packets.

L2CAP Packets

We can filter to see only these packets by entering btl2cap in the filter bar.

Filtering L2CAP packets

Searching online, we can see that L2CAP packets are used for Bluetooth communication.

Purpose of L2CAP Packets

This indicates that there may be potential data that we can decode in these packets, so let's spend some time looking into it.

Expanding the Bluetooth L2CAP Protocol field in Wireshark, we can see that every single L2CAP packet has the payload starting with a1

L2CAP Protocol Field

This might be a header specific to this kind of Bluetooth device, so we can try looking it up.

Decoding L2CAP Packets

Searching for the keywords bluetooth l2cap a1 payload on Google, we come across a CTF writeup on a similar challenge.

Taken from the writeup:

Let's look at one of the payloads from the pcap: a10201ff0300

Comparing with the above code or image, we can decipher that the a1 byte is the value denoting this is a data packet. 02 is the ID for a mouse...

An example payload we have is a1010200000000000000. We have the a1 the same, but since the second byte they have is 02 which represents the ID for a mouse, our payload has 01, which should represent the ID for a keyboard.

There is also a reference to a source code provided by the author of the writeup:

Another good place for packet structure is lines 174-182 of https://github.com/benizi/hidclient/blob/master/hidclient.c

Looking at the source code on lines 184-190 for our keyboard payload struct, we can see that our payload matches the struct.

I'm not sure why but the source code defines the ID for keyboard as 2 instead (lines 139-141):

Looking back at the keyboard struct, we see that the 3rd byte represents the modifier keys, then the rest of the bytes represents the keys pressed.

Scrolling down the source code to lines 826-956, we see that we have the modifier keys and values that represents the keys pressed:

We can automate this using a script to make things easier for us. We can do so using the pyshark library in Python.

Firstly, we need to extract the payload from the L2CAP packets.

extract.py
Extracted output

We can then filter the packets where only our 2nd byte is equal to 01, and then check if the 3rd byte is 02 as having the third byte as 02 means a LEFT SHIFT is pressed (according to the source code).

We then see that the other bytes are all null except for the 4th byte, so we can guess that that is our value representing the key pressed.

So we can grab the 4th byte, check what character it represents (A=4, B=5, C=6 and so on...), and substitute it for the corresponding character, and check the 2nd byte to see if the LEFT SHIFT key is pressed.

PreviousNetworking

Last updated

Was this helpful?