ratched

ratched is a Man-in-the-Middle (MitM) proxy that specifically intercepts TLS connections. It is intended to be used in conjunction with the Linux iptabes REDIRECT target; all connections that should be intercepted can be redirected to the local ratched port. Through the SO_ORIGINAL_DST sockopt, ratched can determine the intended destination (before iptables packet mangling) and tries to establish a connection to the original target.

The thing that sets it apart from other MitM software is the following:

1. ratched does not intercept traffic indiscriminately. In particular, it first waits for the TLS client to send its ClientHello so that ratched can parse it and decide by the Server Name Indication TLS extension (SNI) if the target should be intercepted or not. This is particularly useful when you have virtual hosting, but only want to intercept connections to a specific hostname.

2. ratched is not intended to only sniff passwords, but primarily dumps the traffic into a PCAPNG file. The PCAPNG file format was chosen because it allows for annotation of connections with comments (in particular, which hostname was indicated in the SNI extension) and also allows name resolution information to be embedded in the capture file (again, to map the target IP address to the SNI extension's hostname)

3. ratched has individual configuration for each intercepted SNI, including supported groups (formerly known as "supported elliptic curves"), cipher suites and specific TLS versions on client and server side, and allows for specifying custom certificates/keys for different intercepted hosts.

4. ratched provides extensive support for client certificates and also offers automatic forging for client certificates as well (similar to forged server certificates in the other direction).

5. ratched supports OCSP stapling and can automatically forge positive OCSP responses when a client sends a status request TLS extension.

Setup

Once ratched is listening on the routing machine (in the example, on port 9999), simply add an iptables entry that specifies what traffic you want to capture. For example, to intercept everything from 192.168.1.7 that tries to reach port 443, use:

# iptables -t nat -A PREROUTING -p tcp -s 192.168.1.7 --dport 443 -j REDIRECT --to-ports 9999

In order to intercept everything that goes to 443, simply do:

# iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 9999

If you're acting as a router and want to intercept locally incoming traffic, use the DNAT target instead of REDIRECT, such as:

# iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 443 -j DNAT --to 192.168.123.1:9999

Here, eth1 is the interface you're intercepting traffing at and 192.168.123.1 is the local interface IP address.

Usage

The help page should be pretty self-explanatory:

usage: ratched [-c path] [-f hostname:port] [--single-shot] [--dump-certs]
               [--keyspec keyspec] [--initial-read-timeout secs]
               [--mark-forged-certificates] [--no-recalculate-keyids]
               [--daemonize] [--logfile file] [--flush-logs] [--crl-uri uri]
               [--ocsp-uri uri] [--write-memdumps-into-files]
               [--use-ipv6-encapsulation] [-l hostname:port]
               [-d key=value[,key=value,...]] [-i hostname[,key=value,...]]
               [--pcap-comment comment] [-o filename] [-v]

ratched - TLS connection router that performs a man-in-the-middle attack