Hands-On Network Forensics

Case study – decrypting the Metasploit Reverse HTTPS Shellcode

It is practically impossible to decrypt the HTTPS communication without using a man-in-the-middle or some sorts of SSL offloader. In the case of a Meterpreter shell, the key and certificates are dynamically generated and are then removed, making it more difficult to decrypt the encrypted sessions. However, sometimes a malicious attacker may use and impersonate SSL certificates and leave them on their system. In such cases, obtaining the private key can decrypt the HTTPS payloads for us. The following example demonstrates the SSL decryption in cases of a self-signed certificate and we are assuming that the incident responders somehow managed to grab the keys from the attackers ...