TLS RSA Key Extraction (Help/Hint Wanted)

asked 2020-08-04 10:42:29 +0000

CWatson
3 ●1 ●2 ●2

updated 2020-08-04 14:15:20 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●973 ●227 https://www.wireshark.org

HI all,

Hope you are all safe!!

I need some help with an exercise I have if anyone can help?

The task is, given a PCAP file, I believe I need to extract a private key from within the PCAP, and then re-apply said key to the same PCAP file via WSharks preferences > SSL > etc... to decrypt the traffic.

I am pretty certain I have found the Private Key, and have extracted and saved it to a text file.

"-----BEGIN PRIVATE KEY----- MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAg....etc..etc..."

I then try to reapply the key in the aforementioned preferences, but it doesn't work.

I have been trying this for about 2 weeks now, and have probably watched half of youtube and read 2 dozen articles of the on-the-line content on the webznet. I have also now started to doubt myself and think i need to use PreMasters etc.. which I have also located.

Could someone please point me in the right direction? Please don't give the answer. A document or youtube, or anything I can use to move forwards would be great.

Thanks. C.

edit retag flag offensive close merge delete

Comments

If you've read this much already you should know that it comes down to the details. Of these you provide little, so it's then hard to point to 'the right article'. For starters, what did you learn about the TLS connection so far?

Jaap ( 2020-08-04 11:01:07 +0000 )edit

So I know that during a TLS connection being established there is a handshake and things go on, but most importantly they exchange keys. I believe it is these keys that I need to identify, and extract, which again I have done so I think, identifying the "Server Hello, Certificate" packet in the PCAP. ( I was going to upload a screen shot but the system wont let me until i have 60 points so I put it here instead : https://ibb.co/YkWzkRt )

I then need to tell Wireshark to use this key to decrypt any encrypted traffic within the PCAP file, thus revealing the SSL traffic in plain text.

I am stuck at knowing that I have the right pieces or not. Once I know I have the right pieces, I can probably move on from there.

Thanks. C.

CWatson ( 2020-08-04 11:19:14 +0000 )edit

add a comment

Comments

Ok thanks to grahamb for pointing out a sily mistake and having read and watched everything EXCEPT the wireshark manual itself. d'oh!

Hint to anyone else doing this in the future:

So basically I was ALMOST there! You don't need to fill in all the boxes when applying the RSA Key in the preferences. Just the file containing the extracted key, and the IP address of the box. Job done!

Exercise completed!

CWatson ( 2020-08-04 14:01:53 +0000 )edit

It's an area that has changed a bit recently and so a lot of third party tutorials and examples are out of date.

grahamb ( 2020-08-04 14:14:41 +0000 )edit

Thanks. Once i get enough points to do so, i will upvote.

CWatson ( 2020-08-04 14:43:43 +0000 )edit

No need, accepting the answer is what we like folks to do here and you've done that so job done.

grahamb ( 2020-08-04 14:52:20 +0000 )edit

Dear CWatson, I have exact same problem, but even after reading the TLS Wiki page I am no smarter. - So you extracted your RSA key and placed it in Notepad and saved as KEY.pem - You go Edit - Preferences and then what? Do you only edit "RSA key list"? And you only specify IP address and add your .pem file? No Port? No Protocol? Can you add more IP addresses? Source and Destination? - What about TLS debug file? What about Pre-shared key? what about Pre-Master-Secret log filename? - Then you go and find your encrypted handshake packet and see packet bytes in plain text now?

fff ( 2024-05-19 09:53:26 +0000 )edit

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

TLS RSA Key Extraction (Help/Hint Wanted)

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

TLS RSA Key Extraction (Help/Hint Wanted) edit

Comments

1 Answer

Comments

Your Answer

Question Tools

Stats

Related questions

TLS RSA Key Extraction (Help/Hint Wanted)