Wireshark Decryption: Difference between revisions
(→Decrypted AES DCE/RPC: Fix Kerberos link and branch name of git tree.) |
|||
Line 5: | Line 5: | ||
wireshark -K PATH_TO_KEYTAB |
wireshark -K PATH_TO_KEYTAB |
||
Note: Wireshark for 64-bit Windows (GUI or command-line) doesn't like the -K flag, [http://ask.wireshark.org/questions/7408/keytab-kerberos run the 32-bit Windows version instead]. |
|||
The other way, is to specify it in Preferences -> Protocols -> KRB5 -> keytab path |
The other way, is to specify it in Preferences -> Protocols -> KRB5 -> keytab path |
Revision as of 09:27, 3 February 2013
Using Wireshark with a keytab to decrypt encrypted traffic
Basic decryption
The easiest way, on a unix-like system is to run
wireshark -K PATH_TO_KEYTAB
Note: Wireshark for 64-bit Windows (GUI or command-line) doesn't like the -K flag, run the 32-bit Windows version instead.
The other way, is to specify it in Preferences -> Protocols -> KRB5 -> keytab path
Either way, you must set Preferences -> Protocols -> KRB5 -> Try to decrypt encrypted Kerberos blobs (otherwise it won't try).
To get the keytab, see How to extract a keytab from a windows domain with Samba
Decrypted AES DCE/RPC
To do this, you will need metze's wireshark branch, and his patched verison of MIT Kerberos
http://gitweb.samba.org/?p=metze/wireshark/wip.git;a=shortlog;h=refs/heads/ws-metze-gssapi git://git.samba.org/metze/wireshark/wip.git ws-metze-gssapi
Also, you will need to apply krb5-1.6-wireshark-hack-01.diff to MIT Kerberos 1.6, and set LD_LIBRARY_PATH to wherever you put the result.