22xCode
22xCode 博客

基于eCapture无需 CA 证书捕获 SSL/TLS 明文

2023-11-27 22:18:09 326

curl

查看curl使用哪个库

root@zzx:~# ldd `which curl` | grep -E "tls|ssl|nspr|nss"
	libssl.so.3 => /lib/x86_64-linux-gnu/libssl.so.3 (0x00007ff14c35c000)
	libgnutls.so.30 => /lib/x86_64-linux-gnu/libgnutls.so.30 (0x00007ff14b99c000)

执行下./ecapture tls 查看库路径是否匹配
在ecapture运行的情况下, 开启另一个窗口执行curl https://ip.me
可以看到明文结果

tls_2023/11/27 16:20:55 PID:9767, Comm:curl, TID:9767, Version:TLS1_3_VERSION, Send 69 bytes to 0.0.0.0, Payload:
GET / HTTP/1.1
Host: ip.me
User-Agent: curl/7.81.0
Accept: */*


tls_2023/11/27 16:20:55 TLS1_3_VERSION: save CLIENT_RANDOM cfb344a4d8cb4dc9a2e428e8d3df4b2685912f3d7d18e80786fbd16fee5078f6 to file success, 1002 bytes
tls_2023/11/27 16:20:55 PID:9767, Comm:curl, TID:9767, Version:TLS1_3_VERSION, Recived 177 bytes from 212.102.35.236:443, Payload:
HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Mon, 27 Nov 2023 08:20:55 GMT
Content-Type: text/plain; charset=utf-8
Content-Length: 14
Connection: keep-alive

211.17.57.*

firefox

对firefox这类运行时才能看到使用了哪些库的程序

root@zzx:~# pldd 8381 | grep -E "tls|ssl|nspr|nss"
/snap/firefox/3416/usr/lib/firefox/libnspr4.so
/snap/firefox/3416/usr/lib/firefox/libnssutil3.so
/snap/firefox/3416/usr/lib/firefox/libnss3.so
/snap/firefox/3416/usr/lib/firefox/libssl3.so
/snap/firefox/3416/usr/lib/firefox/libnssckbi.so
/lib/x86_64-linux-gnu/libnss_mdns4_minimal.so.2

与ecapture默认找到的库是不一致的, 我们以指定库路径的方式启动
root@zzx:~# ./ecapture tls --nspr="/snap/firefox/3416/usr/lib/firefox/libnspr4.so"
浏览器里访问https://forge.speedtest.cn/api/location/geo?ip=38.94.109.27
ecapture输出

{"ip":"38.94.109.27","full_ip":"38.94.109.27","country":"\u7f8e\u56fd","country_code":"US","province":"","city":"","distinct":null,"isp":null,"operator":null,"lon":"-80.1879","lat":"25.7722","net_str":"\u7f8e\u56fd"}

mysql

指定mysqld二进制文件路径启动 ./ecapture mysqld -m="/usr/sbin/mysqld"
启动其他窗口登录mysql 执行show databases;

mysqld_2023/11/27 16:54:58 ECAPTURE :: version :linux_x86_64:0.6.6-20231119-06b63d6:5.15.0-1050-azure
mysqld_2023/11/27 16:54:58 ECAPTURE :: start to run EBPFProbeMysqld module
2023/11/27 16:54:58 ECAPTURE :: pid info :11781
mysqld_2023/11/27 16:54:58 ECAPTURE ::	Module.Run()
mysqld_2023/11/27 16:54:58 EBPFProbeMysqld	BPF bytecode filename:user/bytecode/mysqld_kern.o
mysqld_2023/11/27 16:54:58 EBPFProbeMysqld	Mysql Version:mysqld-8.0, binrayPath:/usr/sbin/mysqld, FunctionName:_Z16dispatch_commandP3THDPK8COM_DATA19enum_server_command ,UprobeOffset:0
mysqld_2023/11/27 16:55:09  PID:11635, Comm:connection, Time:1701075309,  length:(0/0),  return:DISPATCH_COMMAND_SUCCESS, Line:select @@version_comment limit 1
mysqld_2023/11/27 16:55:18  PID:11635, Comm:connection, Time:1701075318,  length:(0/0),  return:DISPATCH_COMMAND_SUCCESS, Line:show database
^Croot@zzx:~# ./ecapture mysqld -m="/usr/sbin/mysqld"
mysqld_2023/11/27 16:55:25 ECAPTURE :: version :linux_x86_64:0.6.6-20231119-06b63d6:5.15.0-1050-azure
mysqld_2023/11/27 16:55:25 ECAPTURE :: start to run EBPFProbeMysqld module
2023/11/27 16:55:25 ECAPTURE :: pid info :11794
mysqld_2023/11/27 16:55:25 ECAPTURE ::	Module.Run()
mysqld_2023/11/27 16:55:25 EBPFProbeMysqld	BPF bytecode filename:user/bytecode/mysqld_kern.o
mysqld_2023/11/27 16:55:25 EBPFProbeMysqld	Mysql Version:mysqld-8.0, binrayPath:/usr/sbin/mysqld, FunctionName:_Z16dispatch_commandP3THDPK8COM_DATA19enum_server_command ,UprobeOffset:0
mysqld_2023/11/27 16:55:28  PID:11635, Comm:connection, Time:1701075328,  length:(0/0),  return:DISPATCH_COMMAND_SUCCESS, Line:show databases

成功打印

也可将日志转发到其他地方, 写个接受tcp链接的小程序

package main

import (
    "fmt"
    "io"
    "net"
)

func handleConnection(conn net.Conn) {
    defer conn.Close()
    buffer := make([]byte, 1024)
    for {
        n, err := conn.Read(buffer)
        if err == io.EOF {
            fmt.Println("Connection closed by client.")
            break
        } else if err != nil {
            fmt.Printf("Error reading from connection: %s\n", err)
            break
        }
        fmt.Printf("Received from %s: %s\n", conn.RemoteAddr(), string(buffer[:n]))
        _, err = conn.Write([]byte("Message received successfully\n"))
        if err != nil {
            fmt.Printf("Error writing to connection: %s\n", err)
            break
        }
    }
}

func main() {
    listener, err := net.Listen("tcp", ":8888")
    if err != nil {
        fmt.Printf("Error starting TCP server: %s\n", err)
        return
    }
    defer listener.Close()
    fmt.Println("TCP server is listening on port 8888")
    for {
        conn, err := listener.Accept()
        if err != nil {
            fmt.Printf("Error accepting connection: %s\n", err)
            continue
        }
        go handleConnection(conn)
    }
}
root@localhost:~/test# go build tcp.go && ./tcp
TCP server is listening on port 8888

./ecapture mysqld -m="/usr/sbin/mysqld" -l tcp://192.168.160.128:8888

Received from 192.168.160.129:49702: mysqld_2023/11/27 17:10:50 ECAPTURE ::	Module.Run()
mysqld_2023/11/27 17:10:50 EBPFProbeMysqld	BPF bytecode filename:user/bytecode/mysqld_kern.o

Received from 192.168.160.129:49702: mysqld_2023/11/27 17:10:50 EBPFProbeMysqld	Mysql Version:mysqld-8.0, binrayPath:/usr/sbin/mysqld, FunctionName:_Z16dispatch_commandP3THDPK8COM_DATA19enum_server_command ,UprobeOffset:0

Received from 192.168.160.129:49702: mysqld_2023/11/27 17:11:02  PID:11635, Comm:connection, Time:1701076262,  length:(0/0),  return:DISPATCH_COMMAND_SUCCESS, Line:show databases


Linux服务器替换rm命令

先把rm禁了mv /bin/rm /bin/fuckrm或者chmod 000 /bin/rm然后vim /usr/local/bin/rm#!/bin/bash # 获取当前时间戳 timestamp=$(date +%Y%m%d%H) # 目标路径 trash/时间戳 target_dir=
2024-11-23

排查记录: Java所有接口卡死

线上接口, 每天凌晨三四点后开始卡死, 重启后恢复调用后等待两分钟, 然后504两分钟正好是nginx反代的超时时间排查过程日志把nginx和应用日志都找出来看了下, 没发现什么问题应用机器状态看了下cpu占用率/内存, 没问题磁盘占用也没问题应用状态通过jps查找到java进程然后jstack 进
2024-11-07

基于eCapture无需 CA 证书捕获 SSL/TLS 明文

curl查看curl使用哪个库root@zzx:~# ldd `which curl` | grep -E "tls|ssl|nspr|nss" libssl.so.3 => /lib/x86_64-linux-gnu/libssl.so.3 (0x00007ff14c35c000) libgn
2023-11-27
Ubuntu编译调试OpenJDK8

Ubuntu编译调试OpenJDK8

Centos编译调试OpenJDK11下载源码非官方 切换到jdk8u分支https://github.com/unofficial-openjdk/openjdk.git编译编译jdk需要一个引导jdk, 引导jdk版本需要比编译版本小一个版本或等于当前版本命令行运行sh configure -
2022-08-05

Java服务高CPU占用代码排查方法

1.查找进程通过top -c命令可以确定出现问题的进程2.查找线程 接下来就要找到这个进程中是哪个线程出现问题这个确定也是比较简单的，只需要输入命令：top -Hp PID例top -Hp 9828 3.定位代码jstack 进程PID | grep 线程id的16进制 -c 显示行数jstack
2022-03-31

SpringBoot连接Redis服务出现Command timed out

docker 部署的redis一直出现超时docker pull redis 网上的都说要设置这个值spring.redis.timeout=50000 然而实际使用过程中仍然超时查看redis 服务端配置-bash# cat redis.conf | grep tcp-k tcp-keepali
2020-12-14

修改Linux服务器登录欢迎语

vim /etc/motd
2020-12-13

freemarker 时间显示不正常 设置时区

项目在本地开发的时候显示正常，部署上服务器就一直差8个小时，最后发现freemarker官方文档有这样的说明time_zone：时区的名称来显示并格式化时间。 默认情况下，使用JVM的时区。 也可以是 Java 时区 API 接受的值，或者 "JVM default" (从 FreeMarker 2
2020-03-28
IDEA 2019.1 xml 不高亮

IDEA 2019.1 xml 不高亮

前几天更新了idea后，发现xml里的代码都没有了高亮，变得跟记事本一个德性了打开setting ，搜索 File Types，找到xml项， 查看下方的匹配格式，果然没有xml，(idea真是厉害)点击右方的+，输入*.xml，点击ok，解决问题
2020-03-28

npm install 淘宝镜像

npm install --registry=https://registry.npm.taobao.org
2020-03-28
Java中方法的参数传递机制

Java中方法的参数传递机制

来看一段代码 public class Man { private String name; private Integer age; public String getName() { return name; } publi
2020-03-28
基于自定义注解手写权限控制

基于自定义注解手写权限控制

方法一: AOP 方法二: 拦截器项目结构项目依赖<dependencies> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-w
2020-03-28

Docker 部署 详细全过程 附代码

Docker 部署本站 全过程环境：CentOS7.61. 安装Docker其他版本CentOS可以参考这个https://help.aliyun.com/document_detail/187598.html查看本机内核版本，内核版本需高于 3.10uname -r 确保 yum 包最新yum u
2020-03-28

SpringBoot 启动普通java工程

引入依赖<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter</artifactId> <version>2.0.9</version> </dependency>
2020-03-28

Vue.js DOM操作

<template> <input type="button" @click="reply($event)" value="回复"> </template> export default { methods: { replyFun(e) {
2020-03-29
CentOS7编译调试OpenJDK12

CentOS7编译调试OpenJDK12

1. 下载源码https://hg.openjdk.java.net/jdk/jdk12点击左侧的browse，再点击zip，就可以下载zip格式的源码压缩包。unzip xxx.zip 解压文件2. 安装jdkyum install java-11-openjdk-devel -y3. 运行con
2020-04-23
编写自己的Spring Boot Starter

编写自己的Spring Boot Starter

1.新建一个maven项目命名规则统一是xxx-spring-boot-starter完整pom.xml<?xml version="1.0" encoding="UTF-8"?> <project xmlns="http://maven.apache.org/POM/4.0.0"
2020-06-29