Ok, so I managed to grab the TLS session keys, so I was able to decrypt the requests !
First, this allowed me to grab the “X-Plex-Api-Token”
, so I did a bit of cURL from the NAS:
Freeben@FreeNAS2:/volume1/home/Freeben/tcpdump/target/bin $ curl -v -4 "https://metadata.provider.plex.tv/library/metadata/5d77689f308bca002032e2e3?includeReviews=1&X-Plex-Country=FR&X-Plex-Language=fr-FR&X-Plex-Text-Format=markdown&X-Plex-Api-Token=XXX-REDACTED-XXX"
* Trying 104.18.13.47:443...
* Connected to metadata.provider.plex.tv (104.18.13.47) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: none
* CApath: /etc/ssl/certs/
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-CHACHA20-POLY1305
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: C=US; ST=California; L=San Francisco; O=Cloudflare, Inc.; CN=plex.tv
* start date: May 20 00:00:00 2021 GMT
* expire date: Aug 17 23:59:59 2021 GMT
* subjectAltName: host "metadata.provider.plex.tv" matched cert's "*.provider.plex.tv"
* issuer: C=US; O=Cloudflare, Inc.; CN=Cloudflare Inc ECC CA-3
* SSL certificate verify ok.
> GET /library/metadata/5d77689f308bca002032e2e3?includeReviews=1&X-Plex-Country=FR&X-Plex-Language=fr-FR&X-Plex-Text-Format=markdown&X-Plex-Api-Token=XXX-REDACTED-XXX HTTP/1.1
> Host: metadata.provider.plex.tv
> User-Agent: curl/7.77.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 200 OK
< Date: Sat, 10 Jul 2021 01:15:11 GMT
< Content-Type: application/xml; charset=utf-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Access-Control-Allow-Origin: *
< Cache-Control: max-age=86400
< Content-Language: fr
< Etag: W/"1d8e-Gip8PumA1sz9/4g+RJJ7MEnZ9mc"
< Expect-Ct: max-age=0
< Referrer-Policy: no-referrer
< Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
< Vary: Accept, Accept-Encoding, X-Plex-Language, X-Plex-Provider-Version
< X-Content-Type-Options: nosniff
< X-Dns-Prefetch-Control: off
< X-Download-Options: noopen
< X-Frame-Options: SAMEORIGIN
< X-Permitted-Cross-Domain-Policies: none
< X-Plex-Cache: bypass
< X-Plex-Container-Start: 0
< X-Plex-Container-Total-Size: 1
< X-Plex-Timestamp: 1625791245
< X-Plex-Version: 86f5f28
< X-Xss-Protection: 0
< CF-Cache-Status: MISS
< Server: cloudflare
< CF-RAY: 66c5f086595db76f-CDG
<
<?xml version="1.0"?><MediaContainer offset="0" totalSize="1" identifier="tv.plex.provider.metadata" size="1"><Video art="https://image.tmdb.org/t/p/original/1Dhp3oJ3xnqmxHjkoUZpZJN283t.jpg" guid="plex://movie/5d77689f308bca002032e2e3" key="/library/metadata/5d77689f308bca002032e2e3" rating="6.5" ratingKey="5d77689f308bca002032e2e3" studio="Films 7" summary="Bébel et ses petits camarades du cours Louis XIV, sont réputés pour être des fainéants et d’invétérés farceurs. Leur lycée est même dernier du classement au baccalauréat avec 100 % de recalés à l’examen ! Après une plaisanterie qui tourne mal, les trublions se retrouvent obligés d’obtenir leur bac à tout prix, tout en rusant et trichant, s’ils ne veulent pas finir en prison…" type="movie" thumb="https://image.tmdb.org/t/p/original/rbYoFUzstYpGw1A2UYDSh7SqQOn.jpg" addedAt="325900800" duration="5520000" publicPagesURL="https://watch.plex.tv/movie/the-under-gifted" slug="the-under-gifted" userState="0" title="Les Sous-doués" originalTitle="Les sous-doués" contentRating="fr/U" originallyAvailableAt="1980-04-30T00:00:00Z" year="1980" ratingImage="imdb://image.rating" imdbRatingCount="3373"><Image alt="The Under-Gifted" type="background" url="https://metadata-static.plex.tv/1/gracenote/1c2949f9b418df1b8dff57688d0121d7.jpg"/><Image alt="The Under-Gifted" type="snapshot" url="https://metadata-static.plex.tv/2/gracenote/269ff15ba91d55b0083fee98eef30704.jpg"/><Collection guid="plex://collection/5ec2f633eae5400040556e3d" key="/library/collections/5ec2f633eae5400040556e3d" summary="" tag="Les Sous-doués" thumb="https://image.tmdb.org/t/p/original/nzQrDU01HLItnlg3NBWFcXYwCyB.jpg"/><Role thumb="https://metadata-static.plex.tv/people/5d776826eb5d26001f1dd4ba.jpg" directory="1" role="Baptiste Laval, dit "Bébel"" slug="daniel-auteuil" tag="Daniel Auteuil"/><Role thumb="https://metadata-static.plex.tv/people/5d77682b7228e5001f1dd52e.jpg" directory="1" role="le commissaire" slug="michel-galabru" tag="Michel Galabru"/><Role thumb="https://metadata-static.plex.tv/people/5d77682e3c3c2a001fbcca0f.jpg" directory="1" role="Lucie Jumaucourt" slug="maria-pacome" tag="Maria Pacôme"/><Role directory="1" role="Julien Senquin" slug="philippe-taccini" tag="Philippe Taccini"/><Role thumb="https://image.tmdb.org/t/p/original/6tI2snTTmkfeHL5r990YPhz2BpF.jpg" directory="1" role="Léon Jumaucourt" slug="hubert-deschamps" tag="Hubert Deschamps"/><Role thumb="https://metadata-static.plex.tv/people/5d7768274de0ee001fcc8d80.jpg" directory="1" role="Gaston Pourquier" slug="raymond-bussieres" tag="Raymond Bussières"/><Role thumb="https://image.tmdb.org/t/p/original/or0dDDOML8gNnVU5iov9xo51IxY.jpg" directory="1" role="le père de Julien" slug="etienne-draber" tag="Étienne Draber"/><Role thumb="https://metadata-static.plex.tv/people/5d7768635af944001f20190e.jpg" directory="1" role="Catherine Jumaucourt" slug="tonie-marshall" tag="Tonie Marshall"/><Role thumb="https://metadata-static.plex.tv/people/5d776825eb5d26001f1dd1aa.jpg" directory="1" role="le pion" slug="richard-bohringer" tag="Richard Bohringer"/><Role thumb="https://metadata-static.plex.tv/people/5d776876594b2b001e68d0ee.jpg" directory="1" role="Caroline Janin" slug="francoise-michaud" tag="Françoise Michaud"/><Role thumb="https://metadata-static.plex.tv/people/5d776834f59e580021898a3c.jpg" directory="1" role="Gaëtan" slug="gaetan-bloom" tag="Gaëtan Bloom"/><Role thumb="https://metadata-static.plex.tv/people/5d77682da091de001f2e7180.jpg" directory="1" role="Graffiti" slug="patrick-laurent" tag="Patrick Laurent"/><Role thumb="https://metadata-static.plex.tv/people/5d77689f308bca002032e305.jpg" directory="1" role="MC²" slug="gilles-roussel" tag="Gilles Roussel"/><Role thumb="https://metadata-static.plex.tv/people/5d776ab823d5a3001f50805b.jpg" directory="1" role="Jeanne Dutrete (Hamilton)" slug="catherine-erhardy" tag="Katherine Erhardy"/><Role thumb="https://metadata-static.plex.tv/people/5d776890308bca002032cffe.jpg" directory="1" role="Togo" slug="honore-nzue" tag="Honoré N'Zué"/><Role thumb="https://metadata-static.plex.tv/8/people/8bec5825a40bb846d6c4678951c111c6.jpg" directory="1" role="L'écolo" slug="mathieu-schiffman" tag="Mathieu Schiffman"/><Role thumb="https://metadata-static.plex.tv/4/people/4abef05269e41427cea8555378f84c2c.jpg" directory="1" role="Zard, le grand dadais" slug="patrick-zard" tag="Patrick Zard"/><Role thumb="https://metadata-static.plex.tv/people/5d776884103a2d001f574336.jpg" directory="1" role="Bruce Kateka" slug="dominique-hulin" tag="Dominique Hulin"/><Role thumb="https://metadata-static.plex.tv/people/5d77682b151a60001f24b9f7.jpg" directory="1" role="le père de MC2" slug="feodor-atkine" tag="Féodor Atkine"/><Role thumb="https://metadata-static.plex.tv/people/5d77687723d5a3001f4eca14.jpg" directory="1" role="Ruth, copine de Caroline" slug="petronille-moss" tag="Pétronille Moss"/><Role thumb="https://metadata-static.plex.tv/people/5d77682d961905001eb92816.jpg" directory="1" role="le menuisier" slug="jean-cherlian" tag="Jean Cherlian"/><Role thumb="https://metadata-static.plex.tv/a/people/abb11f6919cfbea032837595b5277cfe.jpg" directory="1" role="Mohammed, le serveur" slug="henri-attal" tag="Henri Attal"/><Role thumb="https://metadata-static.plex.tv/people/5d77682f151a60001f24c8b6.jpg" directory="1" role="Mustapha le terroriste" slug="mohamed-zinet" tag="Mohamed Zinet"/><Role directory="1" role="la juge" slug="odile-poisson" tag="Odile Poisson"/><Role directory="1" role="le père de Togo" slug="georges-anderson" tag="Georges Anderson"/><Role thumb="https://metadata-static.plex.tv/people/5d77689f308bca002032e309.jpg" directory="1" role="Marthe" slug="marie-therese-orain" tag="Marie-Thérèse Orain"/><Role thumb="https://metadata-static.plex.tv/people/5d776890308bca002032d002.jpg" directory="1" role="Sarah" slug="helene-zidi" tag="Hélène Zidi"/><Director thumb="https://metadata-static.plex.tv/people/5d7768274de0ee001fcc8d77.jpg" directory="1" role="director" slug="claude-zidi" tag="Claude Zidi"/><Producer thumb="https://metadata-static.plex.tv/people/5d7768274de0ee001fcc8d77.jpg" directory="1" role="producer" slug="claude-zidi" tag="Claude Zidi"/><Writer directory="1" role="writer" slug="michel-fabre" tag="Michel Fabre"/><Genre filter="genre=5d9c046c705e7a001e6c8d99" ratingKey="genre_5d9c046c705e7a001e6c8d99" tag="Comédie" originalTag="Comedy" directory="1" context="tag.genre"/><Rating image="imdb://image.rating" type="audience" value="6.5"/><Rating image="themoviedb://image.rating" type="audience" value="6.5"/><Similar guid="plex://movie/5d7768365af944001f1fa359" tag="French Fried Vacation"/><Similar guid="plex://movie/5d776d16ad5437001f7ccc3c" tag="The Closet"/><Similar guid="plex://movie/5d9f352cadeb7a0021ce14f9" tag="The Restaurant"/><Similar guid="plex://movie/5d7768475af944001f1fdb8f" tag="French Fried Vacation 3: Friends Forever"/><Similar guid="plex://movie/5d776850e6d55c0020410b2d" tag="The Sucker"/><Similar guid="plex://movie/5d77685b54c0f0001f3071af" tag="The Fugitives"/><Similar guid="plex://movie/5d77686333f255001e8549de" tag="French Fried Vacation 2"/><Similar* Connection #0 to host metadata.provider.plex.tv left intact
guid="plex://movie/5d77682e3c3c2a001fbcc9cf" tag="Le gendarme de Saint‐Tropez"/><Similar guid="plex://movie/5d776890308bca002032cfd7" tag="Les sous‐doués en vacances"/><Similar guid="plex://movie/5d7768a3fb0d55001f516410" tag="Stadium Nuts"/><Country tag="France"/><Studio tag="Films 7"/><Guid id="imdb://tt0081541"/><Guid id="tmdb://60175"/><Guid id="tvdb://12271"/></Video></MediaContainer>[8]+ Done(127) X-Plex-Text-Format=markdown
[7]+ Done(127) X-Plex-Language=fr-FR
[6]+ Done(127) X-Plex-Country=FR
[5]+ Done curl -v -4 https://metadata.provider.plex.tv/library/metadata/5d77689f308bca002032e2e3?includeReviews=1
So, the request sent using basic cURL over HTTP/1.1 (apparently Asustor does not know how to compile cURL with HTTP/2 support.
@drzoidberg33 I’ll send the decrypted pcap, when I can figure out how to tell Wireshark to export the decrypted content