Bettercap2 + apache2. Problem with apache2 ssl WITHOUT a private key?

my idea is to replace google.com page on victim's device with my STATIC ( no server responses after loading this page by victim, just static page ) apache2 index.html using official google.com cert.

Steps:

  1. Copy .pem cert from google.com site (public key)
  2. Create virtual host in apache2 with this .pem file as a cert and random .key file, start https server

site1.com virtual host file in /etc/apache2/sites-enabled

<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/html
ServerName site1.com
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
SSLCertificateFile /var/www/html/cert/google_my.pem
SSLCertificateKeyFile /var/www/html/cert/prive.key
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions  StdEnvVars
</FilesMatch>
</VirtualHost>
</IfModule>
  1. Start dns spoofing with bettercap2 ( redirect victim to the apache2 server address )
  2. Victim opens google.com in browser, but my page will be shown ( apache2 index.html encrypted with google.com public key, so no browser mismatch with CA list, no warning )

Everything works fine except apache2: the problem is that apache2 do not let you to start ssl server without prive.key (I just want to show index.html without victim's input decryption)

error.log file:

[Wed Jul 14 15:57:50.268046 2021] [ssl:emerg] [pid 4221:tid 139629725621280] AH02565: Certificate and private key site1.com:443:0 from /var/www/html/cert/google_my.pem and /var/www/html/cert/prive.key do not match
AH00016: Configuration Failed

prive.key generated by openssl

Is it possible to implement this method? What is the problem here?


Ответы (0 шт):