1

I am trying to decrypt https traffic from an exe file, which is sending requests to some site. However, data is not being decrypted. How it looks like inside a Wireshark - https://prnt.sc/sfv7xb

Full SSL log - https://mega.nz/file/mMdl1SaR#4LzJrN2Z9TYP4zqT_XGLpWZb9D8e-tyBFST7PYJnUls Also, I have noticed, that requests from the browser are decrypted successfully, but when they run from an exe file, they are left undecrypted.

Improve this question

2 Answers 2

Reset to default
1

Wireshark needs the encryption keys.

See https://wiki.wireshark.org/TLS

TLS Decryption

Wireshark supports TLS decryption when appropriate secrets are provided. The two available methods are:

Key log file using per-session secrets (#Using_the_.28Pre.29-Master-Secret).

Decryption using an RSA private key (#RSA_Keys).

A key log file is a universal mechanism that always enables decryption, even if a Diffie-Hellman (DH) key exchange is in use. The RSA private key only works in a limited number of cases.

The key log file is a text file generated by applications such as Firefox, Chrome and curl when the SSLKEYLOGFILE environment variable is set. To be precise, their underlying library (NSS, OpenSSL or boringssl) writes the required per-session secrets to a file. This file can subsequently be configured in Wireshark (#Using_the_.28Pre.29-Master-Secret).

The RSA private key file can only be used in the following circumstances:

The cipher suite selected by the server is not using (EC)DHE.
The protocol version is SSLv3, (D)TLS 1.0-1.2. It does not work with TLS 1.3.

The private key matches the server certificate. It does not work with the client certificate, nor the Certificate Authority (CA) certificate.

The session has not been resumed. The handshake must include the ClientKeyExchange handshake message.

The key log file is generally recommended since it works in all cases, but requires the continuous ability to export the secrets from either the client or server application. The only advantage of the RSA private key is that it needs to be configured only once in Wireshark to enable decryption, subject to the above limitations.

Improve this answer
3
  • I am using master secrets. But exe traffic is being ignored. HTTPS requests from browser(chrome) are being decrypted fine
    – Raicha
    May 13, 2020 at 10:01
  • @Raicha: Maybe something like superuser.com/a/1029318/52492 applies?
    – RedGrittyBrick
    May 13, 2020 at 10:38
  • It may apply if there was an error of some kind. But it just says in the log that decryptor not found. Would like to know what is the difference between requests from browser and executable. Maybe requests from executables are handled differently by windows, and maybe it does not store encryption keys for those requests. Not sure
    – Raicha
    May 13, 2020 at 11:25
0

The SSLKEYLOGFILE environment variable variable is only respected by a handful number of applications, primarily browsers. Most other software will simply continue doing SSL as usual, without logging any keys. This issue is particularly obvious when trying analyze network traffic from malware.

Try running the traffic from the .exe through a TLS proxy instead. You can use PolarProxy (our tool) or SSLsplit to generate a PCAP file with the traffic in decrypted form. Another option is to run the traffic through mitmproxy and let it export the SSL key material.

The downside of using a TLS proxy is that you'll need to convince the monitored application to trust your proxy's root CA certificate.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.