4

I recently found malware that uses TLS 1.2 to communicate with the c2 server. I wanted to check the content of that but is encrypted. I have tried the method with the SSLKEYLOGFILE but unlike for HTTPS traffic via the browser (in this case firefox), there is no "encrypt TLS" tab in wireshark.

Is there a way to get the decrypted content of the request from the malware?

5

No. without cooperation from either side, you cannot decrypt the TLS traffic. That is the purpose of TLS. You are in the same position as an attacker of TLS, and TLS is doing its job.

Since you have access to the computer that runs one side of the TLS connections, you can use a debugger to find the session keys in RAM and dump them (i.e. do the same thing browsers do when you ask for SSLKEYLOGFILE). This of course is harder, because the malware is not cooperating.

EDIT: Like Zicar mentioned, if the malware is doing a bad job at being a TLS client, then MiTM-ing it might be easy. If it's not checking the certificate or checking it using the host's trusted root CAs store. Then you don't need to reverse engineer it. If it pins the server cert then you need to modify the malware to pin your own cert instead or skip the pinned cert check to MiTM it. If it uses a client cert, you need to extract the client cert and key to MiTM it.

3

From what I understand, SSLKEYLOGFILE is an environment variable, problem is, programs usually need to be coded to deal with environment variables, thing that no malware creator will do since they don't want their C2 traffic to be intercepted.

A solution would be to use a MITM setup, here are some ideas I use at my job to do this sort of thing:

If you know the ip addresses of C2s you can add a route on the system to modify the destination of the traffic to a localhost or, better yet, another system on the network that has a script made by you that is listening on the same port as the C2 server using it's own SSL key and certificate. Using the script you can then just pipe the decrypted data to one of the C2 servers and log the data sent and received into a file. You can use fakenet-ng to redirect the connection on the system that is running the malware.

If you suspect the malware to use HTTPS than you can setup mitmproxy on the second system and make it a gateway and run it in transparent mode to intercept the packets on the fly. They have a tutorial on their docs page about it, I personally recommend using mitmweb, you can play with the protocol in a browser and replay requests with different arguments to see what happens.

Some considerations:

  1. If the SSL certificate of the C2 is valid and you want the first alternative, then you want to add a certificate authority on the system running the malware that has signed the key that your server is using.
  2. If the malware is using SSL certificate pinning (aka verifing that the server uses a specific certificate) then you might need to to some reverse engineering in order to find out where you should put your certificate in the executable of the malware.
  3. If the malware is using client SSL certificate validation then you might need to extract the client certificate and key from the malware and use that on your MITM server as the client certificate and key for your script

From personal experience in the field I can say that most of the times the malware just uses SSL without even setting the option to verify that the certificate is valid, so you shouldn't worry that much about needing to modify or reverse engineer the sample to decrypt the traffic, you might need to do that to understand what it's sending as the malware might obvuscate the data sent (re-encrypting it with some embeded key or making the traffic look legit).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.