正文

使用 eBPF 捕获无需 CA 证书的 SSL/TLS 文本内容

admin
admin V管理员 /0 评论 /37 阅读
1228
此篇文章发布距今已超过14天，您需要注意文章的内容或图片是否可用！

支持Linux/Android内核版本x86_64 4.18及以上，aarch64 5.5及以上。需要ROOT权限。不支持Windows和macOS系统。

  • SSL/TLS明文捕获，支持openssllibresslboringsslgnutlsnspr(nss)库。

  • GoTLS明文支持go tls库，指的是使用golang语言编写的https/tls程序进行加密通信。

  • Bash 审计，捕获 bash 命令以进行主机安全审计。

  • Zsh 审计，捕获 zsh 命令进行主机安全审计。

  • MySQL查询SQL审计，支持mysqld 5.65.78.0，以及MariaDB。

捕获 openssl 文本内容

sudo ecapture tls2024-09-15T11:51:31Z INF AppName="eCapture(旁观者)"2024-09-15T11:51:31Z INF HomePage=https://ecapture.cc2024-09-15T11:51:31Z INF Repository=https://github.com/gojue/ecapture2024-09-15T11:51:31Z INF Author="CFC4N <[email protected]>"2024-09-15T11:51:31Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."2024-09-15T11:51:31Z INF Version=linux_arm64:0.8.6-20240915-d87ae48:5.15.0-113-generic2024-09-15T11:51:31Z INF Listen=localhost:282562024-09-15T11:51:31Z INF eCapture running logs logger=2024-09-15T11:51:31Z INF the file handler that receives the captured event eventCollector=2024-09-15T11:51:31Z INF listen=localhost:282562024-09-15T11:51:31Z INF https server starting...You can update the configuration file via the HTTP interface.2024-09-15T11:51:31Z WRN ========== module starting. ==========2024-09-15T11:51:31Z INF Kernel Info=5.15.152 Pid=2336982024-09-15T11:51:31Z INF BTF bytecode mode: CORE. btfMode=02024-09-15T11:51:31Z INF master key keylogger has been set. eBPFProgramType=Text keylogger=2024-09-15T11:51:31Z INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL2024-09-15T11:51:31Z INF Module.Run()2024-09-15T11:51:31Z WRN OpenSSL/BoringSSL version not found from shared library file, used default version OpenSSL Version=linux_default_3_02024-09-15T11:51:31Z INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/usr/lib/aarch64-linux-gnu/libssl.so.32024-09-15T11:51:31Z INF target all process.2024-09-15T11:51:31Z INF target all users.2024-09-15T11:51:31Z INF setupManagers eBPFProgramType=Text2024-09-15T11:51:31Z INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_3_0_0_kern_core.o2024-09-15T11:51:32Z INF perfEventReader created mapSize(MB)=42024-09-15T11:51:32Z INF perfEventReader created mapSize(MB)=42024-09-15T11:51:32Z INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL2024-09-15T11:51:53Z ??? UUID:233851_233851_curl_5_1_172.16.71.1:51837, Name:HTTP2Request, Type:2, Length:304Frame Type  =>  SETTINGSFrame Type  =>  WINDOW_UPDATEFrame Type  =>  HEADERSheader field ":method" = "GET"header field ":path" = "/"header field ":scheme" = "https"header field ":authority" = "google.com"header field "user-agent" = "curl/7.81.0"header field "accept" = "*/*"Frame Type  =>  SETTINGS2024-09-15T11:51:53Z ??? UUID:233851_233851_curl_5_0_172.16.71.1:51837, Name:HTTP2Response, Type:4, Length:1160Frame Type  =>  SETTINGSFrame Type  =>  WINDOW_UPDATEFrame Type  =>  SETTINGSFrame Type  =>  HEADERSheader field ":status" = "301"header field "location" = "https://www.google.com/"header field "content-type" = "text/html; charset=UTF-8"header field "content-security-policy-report-only" = "object-src 'none';base-uri 'self';script-src 'nonce-qvZZ0XreBfeqRnUEV1WoYw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp"header field "date" = "Sun, 15 Sep 2024 11:51:52 GMT"header field "expires" = "Tue, 15 Oct 2024 11:51:52 GMT"header field "cache-control" = "public, max-age=2592000"header field "server" = "gws"header field "content-length" = "220"header field "x-xss-protection" = "0"header field "x-frame-options" = "SAMEORIGIN"header field "alt-svc" = "h3=":443"; ma=2592000,h3-29=":443"; ma=2592000"Frame Type  =>  PINGFrame Type  =>  DATA<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://www.google.com/">here</A>.</BODY></HTML>

eCapture 工具包含 8 个模块，分别支持 OpenSSL、GnuTLS、NSPR、BoringSSL 和 GoTLS 等 TLS/SSL 加密库的明文捕获。此外，它还有助于对 Bash、MySQL 和 PostgreSQL 应用程序进行软件审计。

  • bash 捕获 bash 命令

  • zsh 捕获 zsh 命令

  • gnutls 捕获 gnutls 文本内容，无需 gnutls 库的 CA 证书。

  • gotls 捕获使用 TLS/HTTPS 加密的 Golang 程序的纯文本通信。

  • mysqld 从 mysqld 5.6/5.7/8.0 捕获 sql 查询。

  • nss 捕获 nss/nspr 加密文本内容，无需 nss/nspr 库的 CA 证书。

  • postgres 从 postgres 10+ 捕获 sql 查询。

  • tls 用于捕获没有 CA 证书的 tls/ssl 文本内容。（支持 openssl 1.0.x/1.1.x/3.0.x 或更新版本）。您可以使用ecapture -h查看子命令列表。

eCapture 搜索/etc/ld.so.conf文件默认，搜索 SO文件的加载目录，并搜索openssl分片库位置。或者您可以使用--libssl 标志来设置分片库路径。

如果目标程序是静态编译的，可以--libssl直接将程序路径设置为flag的值。

OpenSSL模块支持三种捕获模式：

  • pcap/pcapng模式以格式存储捕获的纯文本数据pcap-NG。

  • keylog/key模式将 TLS 握手密钥保存到文件中。

  • text模式直接捕获纯文本数据，输出到指定文件或打印到命令行。

支持1.0/1.1/2.0TCP 上的 TLS 加密 http 和QUICUDP 上的 http3 协议。您可以指定-m pcap或-m pcapng并将其与--pcapfile和参数结合使用。的-i默认值为-

pcapfile。ecapture_openssl.pcapngsudo ecapture tls -m pcap -i eth0 --pcapfile=ecapture.pcapng tcp port 443

该命令将捕获的明文数据包保存为pcapng文件，可以使用来查看Wireshark。

sudo ecapture tls -m pcap -w ecap.pcapng -i ens1602024-09-15T06:54:12Z INF AppName="eCapture(旁观者)"2024-09-15T06:54:12Z INF HomePage=https://ecapture.cc2024-09-15T06:54:12Z INF Repository=https://github.com/gojue/ecapture2024-09-15T06:54:12Z INF Author="CFC4N <[email protected]>"2024-09-15T06:54:12Z INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64."2024-09-15T06:54:12Z INF Version=linux_arm64:0.8.6-20240915-d87ae48:5.15.0-113-generic2024-09-15T06:54:12Z INF Listen=localhost:282562024-09-15T06:54:12Z INF eCapture running logs logger=2024-09-15T06:54:12Z INF the file handler that receives the captured event eventCollector=2024-09-15T06:54:12Z WRN ========== module starting. ==========2024-09-15T06:54:12Z INF Kernel Info=5.15.152 Pid=2304402024-09-15T06:54:12Z INF BTF bytecode mode: CORE. btfMode=02024-09-15T06:54:12Z INF listen=localhost:282562024-09-15T06:54:12Z INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL2024-09-15T06:54:12Z INF Module.Run()2024-09-15T06:54:12Z INF https server starting...You can update the configuration file via the HTTP interface.2024-09-15T06:54:12Z WRN OpenSSL/BoringSSL version not found from shared library file, used default version OpenSSL Version=linux_default_3_02024-09-15T06:54:12Z INF HOOK type:Openssl elf ElfType=2 IFindex=2 IFname=ens160 PcapFilter= binrayPath=/usr/lib/aarch64-linux-gnu/libssl.so.32024-09-15T06:54:12Z INF Hook masterKey function Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"]2024-09-15T06:54:12Z INF target all process.2024-09-15T06:54:12Z INF target all users.2024-09-15T06:54:12Z INF setupManagers eBPFProgramType=PcapNG2024-09-15T06:54:12Z INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_3_0_0_kern_core.o2024-09-15T06:54:12Z INF packets saved into pcapng file. pcapng path=/home/ecapture/ecap.pcapng2024-09-15T06:54:12Z INF perfEventReader created mapSize(MB)=42024-09-15T06:54:12Z INF perfEventReader created mapSize(MB)=42024-09-15T06:54:12Z INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL2024-09-15T06:54:14Z INF packets saved into pcapng file. count=42024-09-15T06:54:16Z INF non-TLSv1.3 cipher suite found CLientRandom=f08e8d784962d1693c042f9fe266345507ccfaba58b823904a357f30dbfa1e71 CipherId=02024-09-15T06:54:16Z INF non-TLSv1.3 cipher suite found CLientRandom=f08e8d784962d1693c042f9fe266345507ccfaba58b823904a357f30dbfa1e71 CipherId=02024-09-15T06:54:16Z INF packets saved into pcapng file. count=1832024-09-15T06:54:16Z INF CLIENT_RANDOM save success CLientRandom=f08e8d784962d1693c042f9fe266345507ccfaba58b823904a357f30dbfa1e71 TlsVersion=TLS1_2_VERSION bytes=1762024-09-15T06:54:18Z INF packets saved into pcapng file. count=65^C2024-09-15T06:54:18Z INF module close.2024-09-15T06:54:18Z INF packets saved into pcapng file. count=32024-09-15T06:54:18Z INF packets saved into pcapng file. count=2552024-09-15T06:54:18Z INF Module closed,message recived from Context2024-09-15T06:54:18Z INF iModule module close2024-09-15T06:54:18Z INF bye bye.

您可以指定-m keylog或-m key并将其与参数结合使用--keylogfile，该参数默认为ecapture_masterkey.log。

抓取到的OpenSSL TLSMaster Secret信息保存到--keylogfile。您也可以启用tcpdump抓包功能，然后使用Wireshark打开文件并设置Master Secret路径来查看明文数据包。

sudo ecapture tls -m keylog -keylogfile=openssl_keylog.log

也可以直接使用tshark软件进行实时解密并显示：

tshark -o tls.keylog_file:ecapture_masterkey.log -Y http -T fields -e http.file_data -f "port 443" -i eth0

https://github.com/gojue/ecapture


推荐站内搜索：最好用的开发软件、免费开源系统、渗透测试工具云盘下载、最新渗透测试资料、最新黑客工具下载……
ZhouSa.com