Wireshark Decryption

From SambaWiki
Revision as of 15:35, 14 December 2018 by Aaptel (talk | contribs) (Aaptel moved page Wireshark Keytab to Wireshark Decryption)
The printable version is no longer supported and may have rendering errors. Please update your browser bookmarks and please use the default browser print function instead.

Using Wireshark with a keytab to decrypt encrypted traffic

Prerequisite

You only need to do that once:

  • Open Wireshark
  • Goto: Preferences -> Protocols -> KRB5
  • Select: Try to decrypt encrypted Kerberos blobs

Basic decryption

The easiest way, on a unix-like system is to run

wireshark -K <PATH TO KEYTAB> <PCAP FILE>

Note: Wireshark for 64-bit Windows (GUI or command-line) doesn't like the -K flag, run the 32-bit Windows version instead.

The other way, is to specify the keytab in Preferences -> Protocols -> KRB5 -> keytab path

How to extract the keytab?

See: How to extract a keytab from a windows domain with Samba

Decrypted AES DCE/RPC

To do this, you will need metze's wireshark branch, and his patched verison of MIT Kerberos

http://gitweb.samba.org/?p=metze/wireshark/wip.git;a=shortlog;h=refs/heads/ws-metze-gssapi git://git.samba.org/metze/wireshark/wip.git ws-metze-gssapi

Also, you will need to apply krb5-1.6-wireshark-hack-01.diff to MIT Kerberos 1.6, and set LD_LIBRARY_PATH to wherever you put the result.