sklton-key

README

sklton-key

sklton-key, pronounced 'skeleton key', allows you to decrypt TLS traffic of a target go process. sklton-key attaches to go processes and intercepts the KeyLogWriter method to enable SSLKEYLOGFILE-style logging of TLS secrets.

Requirements

• binary must contain DWARF debugging information
• binary must be compiled with at least go1.8

Installation

go install github.com/amlweems/sklton-key

Usage

$ sklton-key -h
Usage of sklton-key:
  -pid int
    	Pid to attach to.
  -cmd string
    	Command to launch and attach to.
  -log string
    	Log file to write key log to (default "skl.log")
  -tcpdump
    	If true, capture packets and save pcap to a file
  -dev string
    	Device to capture packets on (default "eth0")
  -pcap string
    	Path to write pcap to (default "skl.pcap")

You may now start your target process and launch sklton-key to begin writing the key log:

$ sklton-key -cmd ./target-binary -tcpdump -dev en0

Once the binary begins making requests, you can use Wireshark to decrypt the packet capture. Wireshark 1.6.0 and above can use these log files to decrypt packets. Set the following Wireshark setting to your skl.log file.

Edit→Preferences→Protocols→TLS→(Pre)-Master-Secret log filename

Documentation

Overview

sklton-key attaches to arbitrary golang processes and intercepts the KeyLogWriter method to enable SSLKEYLOGFILE-style debugging of a target.

KeyLogWriter was introduced in go1.8:

https://github.com/golang/go/commit/320bd562cbb24a01beb02706c42d06a290160645

TLS 1.3 support was added in go1.13

Copyright 2020 Anthony Weems

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.