I'm currently investigating one very suspicious app on my system (Windows 10 x64 bit). I wanted to try and understand outgoing https traffic it utilizes by trying to MITM it using Fiddler but as I assumed, app itself doesn't use system proxy settings so trying to MITM it with Fiddler was a failure because requests weren't present in the window over there. I assumed that app doesn't accept system default proxy server settings but rather just using default NIC and not using any loopbacks which MITM softwares such as Fiddler relay on. I found out that app was written in C# and I tried reverse engineering it and noticed this interesting function which seems to do SSL pinning

internal bool method_2(
    HttpRequestMessage httpRequestMessage_0,
    X509Certificate2 x509Certificate2_0,
    X509Chain x509Chain_0,
    SslPolicyErrors sslPolicyErrors_0)
    return x509Certificate2_0.Thumbprint == "32WQEE518D60E0A21D56BFBC3CDFB28701710C"

It seems that upon SSL handshake it checks for certificate and if it doesn't match this thumbprint it just declines connection. I want to understand what are my options on trying to sniff packages and see its content?

I understand I can do following:

  1. Sniff traffic via Wireshark and intercept TLS ciphersuit configs, key exchange and just manually take the data and try to decrypt.
  2. Placing return true before checking validity of certificate using debugger (dnSPY or similar IL c# decompilers / debuggers)

Is there something more I can try and what could be potentially best way to get incoming and outcoming data from this app?

  • If debugging the program is a hassle you might consider patching the binary instead – Moshe Green Mar 7 at 19:39
  • Patching in what way? @MosheGreen – TrueStar Mar 7 at 20:09
  • In the second method that you mentioned - instead of placing a return true dynamically with a debugger - perhaps it might be more convenient to patch the function in the file on disk and then sniffing the connection using a mitm solution. This might be preferable if for e.g the application generates traffic immediately when it starts which might hinder placing a debugger in time to catch the traffic. – Moshe Green Mar 7 at 20:15
  • @MosheGreen How do i patch it exactly? I have .exe which is compiled already. Only thing i can do is debug and return true manually but what you suggest is to edit assembly code and recompile again? – TrueStar Mar 7 at 20:26
  • I'm unfamiliar with the .net/C# IL situation but depending on how good the disassembler/decompiler tools are it might be possible to patch by editing the assembly and repacking as you suggest. Alternatively you can try using a tool with a hex editor to edit the program file directly (i.e changing the bytecode in the .exe itself). There might be an issue with signing on windows, meaning that the .exe is signed and editing it might break the signature and prevent you from running it (although there are probably ways around that too) – Moshe Green Mar 8 at 5:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.