[SR-Users] Re: SSL key logger for Diffie-Hellman cipher

Hi Calvin, Thanks for the tip on capturing on LO interface, I'm sure you just saved me some headaches ;) Interestingly when I check the environ I do see the env vars being set, but in the maps I don't see the keylogger: root@csbc03:~# cat /proc/2216899/environ LANG=en_US.UTF-8PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binPIDFILE=/run/kamailio/kamailio.pidHOME=/run/kamailioLOGNAME=kamailioUSER=kamailioINVOCATION_ID=fb5d2818a5434319ab2381262737dcffJOURNAL_STREAM=8:1642042024RUNTIME_DIRECTORY=/run/kamailioCFGFILE=/etc/kamailio/csbc.cfgSHM_MEMORY=512PKG_MEMORY=32SSLKEYLOG_UDP=10.2.1.19:1234LD_PRELOAD=/opt/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so /usr/lib/x86_64-linux-gnu/libssl.so.1.1RUN_KAMAILIO=yesGROUP=kamailioDUMP_CORE=yes root@csbc03:~# root@csbc03:~# fgrep ssl /proc/2216899/maps 7f1ceef99000-7f1ceefb6000 r--p 00000000 08:06 266231 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 7f1ceefb6000-7f1cef004000 r-xp 0001d000 08:06 266231 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 7f1cef004000-7f1cef01e000 r--p 0006b000 08:06 266231 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 7f1cef01e000-7f1cef01f000 ---p 00085000 08:06 266231 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 7f1cef01f000-7f1cef028000 r--p 00085000 08:06 266231 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 7f1cef028000-7f1cef02c000 rw-p 0008e000 08:06 266231 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 root@csbc03:~# This is on a debian 10 box. I have another box for testing on debian12, I set the exact same config as you and I still don't see the keylogger being loaded: root@csbc01:~# lsb_release -a No LSB modules are available. Distributor ID: Debian Description: Debian GNU/Linux 12 (bookworm) Release: 12 Codename: bookworm root@csbc01:~# root@csbc01:~# cat /etc/default/kamailio.d/voipmonitor # ANSIBLE_MANAGED_FILE - Do NOT edit this file as it is auto-generated by Ansible. SSLKEYLOG_UDP='127.0.0.1:1234' LD_PRELOAD="/usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so /usr/lib/x86_64-linux-gnu/libssl.so.3" root@csbc01:~# root@csbc01:~# file /usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so /usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=f1a884cad7648cc38a579b1d00a9ad523297b78c, with debug_info, not stripped root@csbc01:~# root@csbc01:~# file /usr/lib/x86_64-linux-gnu/libssl.so.3 /usr/lib/x86_64-linux-gnu/libssl.so.3: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=dd6b0615fc5d03f9c698d6d0c9d2da1b1e8f2d24, stripped root@csbc01:~# root@csbc01:~# cat /proc/181454/environ LANG=en_US.UTF-8PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/binPIDFILE=/run/kamailio/kamailio.pidHOME=/run/kamailioLOGNAME=kamailioUSER=kamailioINVOCATION_ID=059a5e15f1bb4e2bae17c0b5ec9c731eJOURNAL_STREAM=8:2661302RUNTIME_DIRECTORY=/run/kamailioSYSTEMD_EXEC_PID=181394CFGFILE=/etc/kamailio/csbc.cfgSHM_MEMORY=512PKG_MEMORY=32RUN_KAMAILIO=yesGROUP=kamailioDUMP_CORE=yesSSLKEYLOG_UDP=127.0.0.1:1234LD_PRELOAD=/usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so /usr/lib/x86_64-linux-gnu/libssl.so.3 root@csbc01:~# root@csbc01:~# fgrep ssl /proc/181454/maps 7f0c537b6000-7f0c537d5000 r--p 00000000 08:01 3674382 /usr/lib/x86_64-linux-gnu/libssl.so.3 7f0c537d5000-7f0c53833000 r-xp 0001f000 08:01 3674382 /usr/lib/x86_64-linux-gnu/libssl.so.3 7f0c53833000-7f0c53852000 r--p 0007d000 08:01 3674382 /usr/lib/x86_64-linux-gnu/libssl.so.3 7f0c53852000-7f0c5385c000 r--p 0009c000 08:01 3674382 /usr/lib/x86_64-linux-gnu/libssl.so.3 7f0c5385c000-7f0c53860000 rw-p 000a6000 08:01 3674382 /usr/lib/x86_64-linux-gnu/libssl.so.3 root@csbc01:~# Any other ideas of what I can be missing? On Tue, Mar 5, 2024 at 2:30 PM Calvin E. <calvine(a)gmail.com> wrote: > > Make sure you are preloading the correct OpenSSL library. On my Debian > 12 box it is libssl.so.3 not libssl.so.1.1. You can confirm which is > loaded by checking the "maps" of a running proc: > > $ sudo fgrep ssl /proc/2951676/maps > 7f26647a4000-7f26647c3000 r--p 00000000 08:01 131274 > /usr/lib/x86_64-linux-gnu/libssl.so.3 > 7f26647c3000-7f2664821000 r-xp 0001f000 08:01 131274 > /usr/lib/x86_64-linux-gnu/libssl.so.3 > 7f2664821000-7f2664840000 r--p 0007d000 08:01 131274 > /usr/lib/x86_64-linux-gnu/libssl.so.3 > 7f2664840000-7f266484a000 r--p 0009c000 08:01 131274 > /usr/lib/x86_64-linux-gnu/libssl.so.3 > 7f266484a000-7f266484e000 rw-p 000a6000 08:01 131274 > /usr/lib/x86_64-linux-gnu/libssl.so.3 > 7f266484e000-7f266484f000 r--p 00000000 08:01 154916 > /usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so > 7f266484f000-7f2664850000 r-xp 00001000 08:01 154916 > /usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so > 7f2664850000-7f2664851000 r--p 00002000 08:01 154916 > /usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so > 7f2664851000-7f2664852000 r--p 00002000 08:01 154916 > /usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so > 7f2664852000-7f2664853000 rw-p 00003000 08:01 154916 > /usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so > > My systemd /lib/systemd/system/kamailio.service has a line > "EnvironmentFile=-/etc/default/kamailio.d/*" so I dropped a file > there: > > $ cat /etc/default/kamailio.d/voipmonitor > SSLKEYLOG_UDP='127.0.0.1:1234' > LD_PRELOAD="/usr/local/src/voipmonitor-git/tools/ssl_keylogger/sslkeylog.so > /usr/lib/x86_64-linux-gnu/libssl.so.3" > > In my environment we're using "packetbuffer_sender = yes" to copy all > packets to a central processor. I'm sending the keys to localhost so > they can get picked up by the sniffer instead of sending them > separately to the central processor. For this to work, the sniffer > also must capture the "lo" interface.