PICOCTF 2019 • NETWORK FORENSICS • TLS DECRYPTION

WebNet0: Decrypting TLS Traffic with RSA Private Keys

By Abdo•4 min read•PicoCTF 2019
EVIDENCE PCAPcapture.pcap
CRYPTO KEYpicopico.key (RSA)
DISSECTOR TOOLWireshark & tshark
FLAGpicoCTF{nongshim...}
TLS Decryption and Packet Capture Analysis
FIGURE 1: Decrypting TLS Sessions via Server RSA Private KeyWireshark Cryptographic Dissector

1. The Scenario & The Encrypted TLS Problem

We are handed two files:

  • capture.pcap: A packet capture of a client browsing a website over HTTPS (port 443).
  • picopico.key: An RSA private key in PEM format.

Opening capture.pcap in Wireshark shows traffic between client port 57581 and server port 443. If you attempt to follow the stream, the application data is encrypted inside TLS records:

[Client Hello] -> [Server Hello] -> [Certificate] -> [Client Key Exchange] -> [Application Data (Encrypted)]

2. Loading the RSA Private Key in Wireshark

Because the web server in this capture negotiated an RSA key exchange cipher suite (TLS_RSA_WITH_AES_...), having the server's private key allows us to decrypt the session pre-master secret.

Step-by-Step Configuration:
  1. In Wireshark, press Ctrl + Shift + P (or go to Edit -> Preferences).
  2. In the left sidebar, click RSA Keys.
  3. Click Add new keyfile... and select picopico.key.
  4. Click OK.
FIGURE 2: Adding picopico.key to Wireshark RSA Keys Preferences
Wireshark RSA Keys configuration window

3. Inspecting Decrypted HTTP Traffic & Finding the Flag

Once the key is saved, reload the capture (Ctrl + R). Wireshark decrypts the TLS payloads on the fly, and bright green HTTP packets immediately appear in the packet list!

FIGURE 3: TLS Traffic Decrypted into Cleartext HTTP Packets
Decrypted HTTP packets in Wireshark packet list

Look at Packet 32: it's an HTTP/1.1 200 OK response from the web server.

FIGURE 4: Target Response (Packet 32 — HTTP/1.1 200 OK)
Packet 32 HTTP 200 OK selected
FIGURE 5: Custom Header in Packet Details Tree (Pico-Flag)
Pico-Flag header containing flag in HTTP tree

Expanding the Hypertext Transfer Protocol tree reveals that the server returned a custom HTTP response header:

HTTP/1.1 200 OK

Server: Apache/2.4.29 (Ubuntu)

Pico-Flag: picoCTF{nongshim.shrimp.crackers}

Content-Length: 821

4. The Fast Terminal Route (tshark CLI)

Once Wireshark has the key loaded in its preferences profile, you can dump decrypted HTTP headers straight from the terminal with a single command:

Windows PowerShell Command:
& "C:\Program Files\Wireshark\tshark.exe" -r .\capture.pcap -Y "http" -V | Select-String "pico"
FIGURE 6: Terminal Extraction Output via tshark
tshark command extracting picoCTF flag
Linux / macOS Alternative:
tshark -r capture.pcap -Y "http" -V | grep -i "pico"

5. Forensic Takeaway: Why RSA Key Exchange is Obsolete

RSA Key Exchange vs. Perfect Forward Secrecy (PFS):

Static RSA Key Exchange (Legacy):

The client encrypts the session key using the server's static public key. If an investigator (or attacker) gets the server's private key years later, 100% of historical recorded traffic can be passively decrypted.

Diffie-Hellman / PFS (Modern TLS 1.3):

Every session negotiates unique, disposable keys (ECDHE). Even if the server's master private key is leaked, past captures cannot be decrypted. In modern DFIR, analysts must capture the browser's SSLKEYLOGFILE in memory to decrypt traffic.

Decrypted Final Flag:

picoCTF{nongshim.shrimp.crackers}