使用wireshark分析HTTPS数据包

浅浅的花香味﹌ 2023-01-19 04:53 53阅读 0赞

## 概要 ##

本文的主要内容是使用wireshark分析https数据流，因为https使用SSL或TLS加密，因此要先使用中间人技术获取通信使用的加密密钥，然后通过wireshark工具导入数据包，再导入密钥进行解密即可看到原始的数据流；如果你想实时看到解密数据，推荐使用Charles或者fiddle工具进行中间人代理分析；该文主要目的是为记录一种通过wireshark分析https数据流的方式，原文链接：[Link][].

关于中间人代理，如果你是用chrome访问，你可以通过声明 SSLKEYLOGFILE=~/tls/key.log变量来获取解密wireshark的key，参考：[Link][Link 1]；

两个实例：

1.  [TLS1.2 HandShake Protocol][]
2.  [MacOS下wireshark抓取Chrome HTTPS][MacOS_wireshark_Chrome HTTPS]

## **Executive Summary** ##

This tutorial is designed for security professionals who investigate suspicious network activity and review packet captures (pcaps) of the traffic. The instructions assume you are familiar with [Wireshark][], and it focuses on Wireshark version 3.x.

When reviewing suspicious network activity, we often run across encrypted traffic. Why? Because most websites use the Hypertext Transfer Protocol Secure (HTTPS) protocol. But like most websites, various types of malware also use HTTPS. When reviewing pcaps from malware activity, it’s very helpful to know what’s contained within post-infection traffic.

This Wireshark tutorial describes how to decrypt HTTPS traffic from a pcap in Wireshark. Decryption is possible with a text-based log containing encryption key data captured when the pcap was originally recorded. With this key log file, we can decrypt HTTPS activity in a pcap and review its contents.

Today, we will examine HTTPS activity from a [Dridex][] malware infection.

Note: Our instructions assume you have customized your Wireshark column display as previously described in “[Customizing Wireshark – Changing Your Column Display][Customizing Wireshark _ Changing Your Column Display].”.

Here is a Github repository with a ZIP archive containing the [pcap and a key log file used for this tutorial][].

**Warning:** The pcap used for this tutorial contains Windows-based malware. There is a risk of infection if using a Windows computer. We recommend you review this pcap in a non-Windows environment like BSD, Linux or macOS if at all possible.

## **The Context Behind Encrypted Traffic** ##

In the mid- to late-1990s, the most common protocol used by websites was Hypertext Transfer Protocol (HTTP), which generated unencrypted web traffic. However, as security became an increasing concern, websites started switching to HTTPS, and now we rarely see HTTP traffic from web browsing.

HTTPS is essentially an encrypted communications tunnel containing HTTP traffic. These tunnels first used Secure Sockets Layer (SSL) as an encryption protocol. Today most HTTPS traffic uses Transport Layer Security (TLS).

## **HTTPS Web Traffic** ##

HTTPS traffic often reveals a domain name. For example, when viewing https://www.wireshark.org in a web browser, a pcap would show www.wireshark.org as the server name for this traffic when viewed in a [customized Wireshark column display][Customizing Wireshark _ Changing Your Column Display]. Unfortunately, we don’t know other details like the actual URL or data returned from the server. Following the Transmission Control Protocol (TCP) stream from a pcap will not reveal the content of this traffic because it is encrypted.

![The screenshots show what is seen when viewing https://www.wireshark.org in a web browser, vs. what a pcap would show when viewed in a customized Wireshark column display.][The screenshots show what is seen when viewing https_www.wireshark.org in a web browser_ vs. what a pcap would show when viewed in a customized Wireshark column display.]

Figure 1. Traffic from HTTPS traffic to www.wireshark.org.

![Wireshark - Follow TCP Stream (tcp.stream eq0) - Ethernet0][Wireshark - Follow TCP Stream _tcp.stream eq0_ - Ethernet0]

Figure 2. TCP stream of HTTPS traffic to and from server at www.wireshark.org.

## **Encryption Key Log File** ##

An encryption key log is a text file. An example is shown in Figure 3.

![Wireshark-tutorial-KeysLogFile.txt - Mousepad][]

Figure 3. The key log file used in this tutorial.

These logs are created using a Man in the Middle (MitM) technique when the pcap is originally recorded. If no such file was created when the pcap was recorded, you cannot decrypt HTTPS traffic in that pcap.

## **Example of a Pcap With a Key Log File** ##

A password-protected ZIP archive containing the pcap and its key log file is available at [this Github repository][pcap and a key log file used for this tutorial]. Go to the Github page, click on the ZIP archive entry, then download it as shown in Figures 4 and 5. Of note, the pcap contained in this ZIP archive provides access to a Windows-based malware sample when decrypted with the key log. As always, we recommend you exercise caution and follow steps from this tutorial in a non-Windows environment.

![pan-unit42/wireshark-tutorial-decrypting-HTTPS-traffic - the screenshot shows the Github repository with the link to the ZIP archive used for this tutorial on decrypting HTTPS traffic.][pan-unit42_wireshark-tutorial-decrypting-HTTPS-traffic - the screenshot shows the Github repository with the link to the ZIP archive used for this tutorial on decrypting HTTPS traffic.]

Figure 4. Github repository with link to ZIP archive used for this tutorial.

![pan-unit42/wireshark-tutorial-decrypting-HTTPS-traffic - the screenshot shows how downloading the ZIP archive used for this tutorial on decrypting HTTPS traffic works in the Github repository.][pan-unit42_wireshark-tutorial-decrypting-HTTPS-traffic - the screenshot shows how downloading the ZIP archive used for this tutorial on decrypting HTTPS traffic works in the Github repository.]

Figure 5. Downloading the ZIP archive for this tutorial.

Use ***infected*** as the password to extract the pcap and key log file from the ZIP archive. This will provide two files as shown in Figure 6:

*  Wireshark-tutorial-KeysLogFile.txt
 *  Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap

![Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.zip - These screenshots show how to unzip the ZIP archive used for this tutorial on decrypting HTTPS traffic.][]

Figure 6. Key log file and pcap for this tutorial.

## **HTTPS Traffic Without the Key Log File** ##

Open ***Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap*** in Wireshark. Use a basic web filter as described in this previous [tutorial about Wireshark filters][]. Our basic filter for Wireshark 3.x is:

(http.request or tls.handshake.type eq 1) and !(ssdp)

This pcap is from a Dridex malware infection on a Windows 10 host. All web traffic, including the infection activity, is HTTPS. Without the key log file, we cannot see any details of the traffic, just the IP addresses, TCP ports and domain names, as shown in Figure 7.

![Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.zip - This screenshot shows the pcap from the tutorial on decrypting HTTPS traffic when viewed in Wireshark using the basic web filter without any decryption.][]

Figure 7. Viewing the pcap in Wireshark using the basic web filter without any decryption.

## **Loading the Key Log File** ##

Open ***Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap*** in Wireshark. Then use the menu path ***Edit --> Preferences*** to bring up the Preferences Menu, as shown in Figure 8.

!["Open Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap in Wireshark. Then use the menu path Edit --> Preferences to bring up the Preferences Menu, as shown here. "][Open Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap in Wireshark. Then use the menu path Edit --_ Preferences to bring up the Preferences Menu_ as shown here.]

Figure 8. Getting to the Preferences Menu in Wireshark.

On the left side of the Preferences Menu, click on Protocols, as shown in Figure 9.

![On the left side of the Wireshark - Preferences Menu, click on Protocols, as shown here.][On the left side of the Wireshark - Preferences Menu_ click on Protocols_ as shown here.]

Figure 9. Selecting Protocols in the Preferences Menu.

If you are using Wireshark version 2.x, scroll down until you find ***SSL*** and select it. If you are using Wireshark version 3.x, scroll down to ***TLS*** and select it. Once you have selected SSL or TLS, you should see a line for ***(Pre)-Master-Secret log filename***. Click on the “Browse” button and select our key log file named ***Wireshark-tutorial-KeysLogFile.txt***, as shown in Figures 10, 11 and 12.

![Once you have selected TLS in Wireshark 3.x, you should see a line for (Pre)-Master-Secret log filename.][Once you have selected TLS in Wireshark 3.x_ you should see a line for _Pre_-Master-Secret log filename.]

Figure 10. Finding the (Pre)-Master-Secret log filename field under TLS in Wireshark 3.x.

![To proceed with the tutorial on decrypting HTTPS traffic, select our key log file named Wireshark-tutorial-KeysLogFile.txt after clicking the "Browse" button.][To proceed with the tutorial on decrypting HTTPS traffic_ select our key log file named Wireshark-tutorial-KeysLogFile.txt after clicking the _Browse_ button.]

Figure 11. Selecting our key log file for this tutorial.

![This shows how the screen appears in Wireshark once the key log file for the decrypting HTTPS traffic tutorial has been properly selected.][]

Figure 12. Once the file has been selected as the (Pre)-Master-Secret log filename, click “OK.”

## **HTTPS Traffic With the Key Log File** ##

Once you have clicked “OK,” when using the basic filter, your Wireshark column display will list the decrypted HTTP requests under each of the HTTPS lines, as shown in Figure 13.

![This screenshot advances the decrypting HTTPS traffic tutorial by showing how your Wireshark column display will list decrypted HTTP requests under each of the HTTPS lines.][]

Figure 13. HTTPS decryption in Wireshark after using the key log file.

In this pcap, we now see HTTP requests to microsoft.com and skype.com domains previously hidden in the HTTPS traffic. We also find the following traffic caused by the Dridex infection:

*  foodsgoodforliver\[.\]com - GET /invest\_20.dll
 *  105711\[.\]com - POST /docs.php

The GET request to foodsgoodforliver\[.\]com returned a DLL file for Dridex. The POST requests to 105711\[.\]com are command and control (C2) traffic from the Dridex-infected Windows host.

We can review the traffic by following HTTP streams. Right-click on the line to select it, then left-click to bring up a menu to follow the HTTP stream. Figures 14 and 15 show following the HTTP stream for the HTTP GET request to foodsgoodforliver\[.\]com.

![Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - this shows the series of clicks that allow you to follow the HTTP stream for the GET request to foodsgoodforliver\[.\]com][Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - this shows the series of clicks that allow you to follow the HTTP stream for the GET request to foodsgoodforliver_._com]

Figure 14. Following HTTP stream for the GET request to foodsgoodforliver\[.\]com.

![Wireshark - Follow HTTP Stream (tcp.stream eq 2) - Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - the screenshot shows how the HTTP stream indicates an EXE or DLL returned from the server][Wireshark - Follow HTTP Stream _tcp.stream eq 2_ - Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - the screenshot shows how the HTTP stream indicates an EXE or DLL returned from the server]

Figure 15. HTTP stream indicates an EXE or DLL returned from the server.

Since we have the key log file for this traffic, we can now export this malware from the pcap. Use the menu path ***File --> Export Objects --> HTTP*** to export this file from the pcap, as shown in Figure 16.

![Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - the screenshot shows the series of clicks required to export the malware binary used as an example in the decrypting HTTPS traffic tutorial.][]

Figure 16. Exporting the malware binary returned from foodsgoodforliver\[.\]com.

If you are in a BSD, Linux or macOS environment, open a terminal window and use the file command to confirm this is a DLL file. Then use shasum -a 256 to get the SHA256 hash of the file, as shown in Figure 17.

![The screenshot from the decrypting HTTPS traffic tutorial shows how you can open a terminal window in a BSD, Linux or macOS environment, use the file command to confirm this is a DLL file, and then get the SHA256 hash of the file.][The screenshot from the decrypting HTTPS traffic tutorial shows how you can open a terminal window in a BSD_ Linux or macOS environment_ use the file command to confirm this is a DLL file_ and then get the SHA256 hash of the file.]

Figure 17. Getting the SHA256 hash of this malware in a Linux environment.

The SHA256 hash of this malware is:

31cf42b2a7c5c558f44cfc67684cc344c17d4946d3a1e0b2cecb8eb58173cb2f

If you [search for this hash][] online, you should find results from at least two publicly available online sandbox environments.

Finally, we can review C2 traffic from this Dridex infection. Use your basic web filter, then follow an HTTP stream from one of the POST requests to 105711\[.\]com. An example from one of the HTTP streams is shown in Figure 18.

![Wireshark - Follow HTTP Stream (tcp.stream eq 5) - Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - the screenshot shows the HTTP stream from one of the Dridex C2 POST requests.][Wireshark - Follow HTTP Stream _tcp.stream eq 5_ - Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - the screenshot shows the HTTP stream from one of the Dridex C2 POST requests.]

Figure 18. HTTP stream from one of the Dridex C2 POST requests.

## **Conclusion** ##

This tutorial reviewed how to decrypt HTTPS traffic in a pcap with Wireshark using a key log text file. Without a key log file created when the pcap was originally recorded, you cannot decrypt HTTPS traffic from that pcap in Wireshark.

[Link]: https://unit42.paloaltonetworks.com/wireshark-tutorial-decrypting-https-traffic/
[Link 1]: https://www.zhihu.com/question/52424131
[TLS1.2 HandShake Protocol]: https://laoqingcai.com/tls1.2-handshake/
[MacOS_wireshark_Chrome HTTPS]: https://segmentfault.com/a/1190000021142289
[Wireshark]: https://www.wireshark.org/
[Dridex]: https://en.wikipedia.org/wiki/Dridex
[Customizing Wireshark _ Changing Your Column Display]: https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/
[pcap and a key log file used for this tutorial]: https://github.com/pan-unit42/wireshark-tutorial-decrypting-HTTPS-traffic
[The screenshots show what is seen when viewing https_www.wireshark.org in a web browser_ vs. what a pcap would show when viewed in a customized Wireshark column display.]: /images/20221021/ead5a1859d934a62a0c992a815d3d303.png
[Wireshark - Follow TCP Stream _tcp.stream eq0_ - Ethernet0]: /images/20221021/eaa333a71cd64d8d9b740a6c8291db43.png
[Wireshark-tutorial-KeysLogFile.txt - Mousepad]: /images/20221021/50ae8293c0534646ab513dd99edbb455.png
[pan-unit42_wireshark-tutorial-decrypting-HTTPS-traffic - the screenshot shows the Github repository with the link to the ZIP archive used for this tutorial on decrypting HTTPS traffic.]: /images/20221021/51e505d795704de58279a7aa91010ea4.png
[pan-unit42_wireshark-tutorial-decrypting-HTTPS-traffic - the screenshot shows how downloading the ZIP archive used for this tutorial on decrypting HTTPS traffic works in the Github repository.]: /images/20221021/12a4f8739829483f832a7229c594dce6.png
[Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.zip - These screenshots show how to unzip the ZIP archive used for this tutorial on decrypting HTTPS traffic.]: /images/20221021/89ec12f75b854182b94e64b7c7bac926.png
[tutorial about Wireshark filters]: https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/
[Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.zip - This screenshot shows the pcap from the tutorial on decrypting HTTPS traffic when viewed in Wireshark using the basic web filter without any decryption.]: /images/20221021/270aca27013d4eb291df78646b82882d.png
[Open Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap in Wireshark. Then use the menu path Edit --_ Preferences to bring up the Preferences Menu_ as shown here.]: /images/20221021/0b61eb875a4f498aaa7a2f783f5688bb.png
[On the left side of the Wireshark - Preferences Menu_ click on Protocols_ as shown here.]: /images/20221021/914bc74b58da4c9eb7d28c53ebb28c20.png
[Once you have selected TLS in Wireshark 3.x_ you should see a line for _Pre_-Master-Secret log filename.]: /images/20221021/95738ec1856e44f18dedf6312f3c467d.png
[To proceed with the tutorial on decrypting HTTPS traffic_ select our key log file named Wireshark-tutorial-KeysLogFile.txt after clicking the _Browse_ button.]: /images/20221021/4305e62111e74ef2a0f8dc60b07a683c.png
[This shows how the screen appears in Wireshark once the key log file for the decrypting HTTPS traffic tutorial has been properly selected.]: /images/20221021/71626f7bea8b49beb0ce7562b5bbad5b.png
[This screenshot advances the decrypting HTTPS traffic tutorial by showing how your Wireshark column display will list decrypted HTTP requests under each of the HTTPS lines.]: /images/20221021/c9baf1bd8bd548e4bfae158f9d2f037a.png
[Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - this shows the series of clicks that allow you to follow the HTTP stream for the GET request to foodsgoodforliver_._com]: /images/20221021/fed1889ee2c5424db88afce74e575989.png
[Wireshark - Follow HTTP Stream _tcp.stream eq 2_ - Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - the screenshot shows how the HTTP stream indicates an EXE or DLL returned from the server]: /images/20221021/ece3314d46b94131a618373dba25f436.png
[Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - the screenshot shows the series of clicks required to export the malware binary used as an example in the decrypting HTTPS traffic tutorial.]: /images/20221021/47ed4450516d47d1bc3151a8bcddc8b0.png
[The screenshot from the decrypting HTTPS traffic tutorial shows how you can open a terminal window in a BSD_ Linux or macOS environment_ use the file command to confirm this is a DLL file_ and then get the SHA256 hash of the file.]: /images/20221021/6eb51caa4dbf4e64be42f4afa3c1b991.png
[search for this hash]: https://www.google.com/search?q=31cf42b2a7c5c558f44cfc67684cc344c17d4946d3a1e0b2cecb8eb58173cb2f
[Wireshark - Follow HTTP Stream _tcp.stream eq 5_ - Wireshark-tutorial-on-decrypting-HTTPS-SSL-TLS-traffic.pcap - the screenshot shows the HTTP stream from one of the Dridex C2 POST requests.]: /images/20221021/df34c27cf23f47d4a5d3d3e08c13e6cf.png