Setup the vulnerable web server.
Kali Linux already has apache installed, so simply enable the SSL mod, create a directory to hold the key material, generate the private key and ssl cert, and restart the server to
sudo a2enmod ssl
sudo mkdir /etc/apache2/ssl
sudo openssl req -x509 -nodes - days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/webserver.key -out /etc/apache2/ssl/webserver.crt
Then you'll need to edit the ssl site configuration to enable it for your ip address (not the one below).
vi /etc/apache2/sites-available/default-sslAdd the information for your server.
and change the following lines to use the newly generated key material:
Then restart the apache server
sudo service apache2 restart
And test the server using a web browser:
To test for / exploit the vulnerability I'm initially using the python test code here: https://gist.github.com/takeshixx/10107280
git clone https://gist.github.com/takeshixx/10107280
python hb-test.py 192.168.4.134|more
Great I can confirm that I have been able to extract data from the vulnerable OpenSSL library. But the returned data doesn't make much sense.
Many people have been kind enough to release tools that take the exploitation a step further. Robert David Graham @erratarob released the heartleech tool as a response to the cloudflare challenge. This tool provides a bunch of extra features including;
- Automated extraction of mass amounts of memory
- Automated retrieval of private keys
- Limited IDS evasion (most signature based IDS products)
- STARTTLS (email server library)
Building the binary on OSX 10.9 is fairly easy but you need to download and compile the OpenSSL library as documented in Robert's instructions. Once built simply run it against the site in question;
Extract and Use the Private Key:
Good, it reports it as vulnerable. Now lets try to extract the private key.