Weird Movements - dalCTF

Category: Forensics Flag: dalctf{h3h3_i_s2_p41nt} We're given a packet capture. The capture turns out to be a Linux USB HID (mouse) trace — the user held left-click and physically drew the flag on screen. The drawn text is ROT13-encoded, giving one extra layer of obfuscation. file capture.pcap # pca