forked from cuckoosandbox/cuckoo
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathdumptls.py
More file actions
46 lines (35 loc) · 1.76 KB
/
Copy pathdumptls.py
File metadata and controls
46 lines (35 loc) · 1.76 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
# Copyright (C) 2010-2014 Cuckoo Foundation.
# This file is part of Cuckoo Sandbox - http://www.cuckoosandbox.org
# See the file 'docs/LICENSE' for copying permission.
from lib.cuckoo.common.abstracts import Processing
class TLSMasterSecrets(Processing):
"""Cross-references TLS master secrets extracted from the monitor and key
information extracted from the PCAP to dump a master secrets file
compatible with, e.g., Wireshark."""
order = 2
key = "dumptls"
def run(self):
metakeys = {}
# Build server random -> session id from the pcap information.
if "network" in self.results and "tls" in self.results["network"]:
for row in self.results["network"]["tls"]:
metakeys[row["server_random"]] = row["session_id"]
results = {}
# Fetch all key information from the behavior logs.
for process in self.results.get("behavior", {}).get("processes", []):
if process["process_name"] != "lsass.exe":
continue
for call in process["calls"]:
args = call["arguments"]
if call["api"] != "PRF" or args["type"] != "key expansion":
continue
if args["server_random"] not in metakeys:
continue
# We keep the results in a dictionary before writing them out
# to a file in order to avoid duplicates (in an easy way).
results[metakeys[args["server_random"]]] = \
args["master_secret"]
with open(self.tlsmaster_path, "wb") as f:
for session_id, master_secret in sorted(results.items()):
print>>f, "RSA Session-ID:%s Master-Key:%s" % (
session_id, master_secret)