> For the complete documentation index, see [llms.txt](https://writeups.ayweth20.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.ayweth20.com/2021/dvctf-to-join-davincicode/forensics/sus-usb.md).

# Sus USB

{% file src="/files/kIoSVMc48MngEQQAjOsy" %}

{% file src="/files/YszBckt4zpm6bkxdZ9bw" %}

**Category:** Forensics - **Points:** 49 - **Solves:** 7\
**Description:** I found a weird USB stick on the floor in my office building's parking. I plugged it in before my colleague yelled at me and proceeded to investigate the USB stick. He only managed to extract this; can you make any sense out of it? What have I done to my pc!

**Infos:**

> A .bin file is provided (dump.bin)

**Solution:**\
To solve this challenge you need to imagine the situation written in the description. So there is a person who finds a USB key on the floor of his work building. He plugs the USB on a computer and there is nothing on the key. His coworker finds just the "cracking" file by doing deep researches on the key. What can be this USB key? A Rubber Ducky USB !!! So now we need to find a decrypter of Rubber Ducky code and it is good. There is [DuckToolkit](https://ducktoolkit.com/decode#). When we upload the file on the website, it returns the script (duckycode.txt) contain in the file and we can find the FLAG in it.

<details>

<summary>🚩 FLAG</summary>

```
DVC{u5b_4r3_d4n63r0u5}
```

</details>