Skip to main content

Testing the CVE2014-0160 HeartBleed Attack - Part I

This is part one of a multi-part series associated with the HeartBleed vulnerability.  This part deals with getting your environment setup with a vulnerable SSL webserver (using Kali Linux), and the client software used to test for and exploit it.

Setup the vulnerable web server.

Kali Linux already has apache installed, so simply enable the SSL mod, create a directory to hold the key material, generate the private key and ssl cert, and restart the server to

sudo a2enmod ssl
sudo mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
sudo openssl req -x509 -nodes - days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/webserver.key -out /etc/apache2/ssl/webserver.crt

Then you'll need to edit the ssl site configuration to enable it for your ip address (not the one below).

vi /etc/apache2/sites-available/default-ssl
Add the information for your server.


and change the following lines to use the newly generated key material:

SSLCertificateFile /etc/apache2/ssl/webserver.crt
SSLCertificateKeyFile /etc/apache2/ssl/webserver.key

Then restart the apache server

sudo service apache2 restart

And test the server using a web browser:

Your browser should still complain about the self-signed cert.

Install the HeartBleed test software:

To test for / exploit the vulnerability I'm initially using the python test code here:

git clone
cd 10107280

Great I can confirm that I have been able to extract data from the vulnerable OpenSSL library.  But the returned data doesn't make much sense.

Many people have been kind enough to release tools that take the exploitation a step further.  Robert David Graham @erratarob released the heartleech tool as a response to the cloudflare challenge.  This tool provides a bunch of extra features including;

  • Automated extraction of mass amounts of memory
  • Automated retrieval of private keys
  • Limited IDS evasion (most signature based IDS products)
  • STARTTLS (email server library)

Building the binary on OSX 10.9 is fairly easy but you need to download and compile the OpenSSL library as documented in Robert's instructions.  Once built simply run it against the site in question;

Extract and Use the Private Key:

Good, it reports it as vulnerable.  Now lets try to extract the private key.

Very quickly it came back with the key material, now I could create a new server certificate using this private key and impersonate the server.  Which should match the one on the vulnerable web server.

Now with the private key extracted, I can create a message and encrypt it with the extracted private key, and verify the signature using the certificate that I got from the web server.

Very good work by @erratarob on the speed of getting a tool like this out publicly, I should have a new post soon with results of testing the IDS evasion functionality soon.


Popular posts from this blog

OpenSolaris, ZFS, iSCSI and OSX - Creative Storage - Part II

In part I of this post, I looked at the simple steps required to setup a relatively simple storage solution using OpenSolaris, ZFS, iSCSI and OSX. This was about a month ago, and I've made some significant changes on how this is used for me. At the end of the last post I left off on the part dealing with configuration of the iSCSI initiator side of the solution. I stopped here because there were some issues related to the installation and use of the software. The iSCSI initiator that I was using was Studio Network Solutions GlobalSAN initiator (version which is used to allow for connections to their products. This software will also allow for connections to ANY iSCSI target! After the configuration of the iSCSI target on the ZFS pool, and installation of the client it was trivial to get the connection established with the storage pool, and it showed up in OSX as a raw disk which had not been formatted. I proceeded to format the disk as HFS+ and it then mounted as a lo

Local Classified Penny Auction Scam

While there are a lot of new posts regarding the new ways to exploit people using novel techniques and 0day exploits, there continues to be a rash of tried and true methods of coercion.  I want to just walk through a simple example and reflect on how effective these methods continue to be. Many people turn toward online classified sites to buy and sell items online.  This example starts with which even I've used on occasion to find used electronics and other items.  Doing a search on the site for a " Samsung Galaxy Note 2 " returns a posting from today with someone selling one for an unreasonably priced unit. $125 for a $500 phone?, but what if it's for real?  No harm in just asking some simple questions.  Email sent with some obvious questions regarding the condition and location. About an hour passes before I get a response from what appears to be a legit seller. Notice no answer to the questions I asked, but a friendly pointer at where th

Edmonton HeartBleed Information Session - April 16th, Royal Glenora Club

Since the latest major OpenSSL vulnerability was publicly disclosed, many people and organizations are scrambling to understand, respond and prepare themselves for the future.  Twitter, vendor support channels and media outlets have been quick to cover different angles of the issue but there has been overwhelming amount  of information released. With all this information, it can be difficult to understand what's relevant.  To help clarify we holding a special ISACA sponsored 2-hour session on Wednesday, April 16th, starting at 12:00pm at the Royal Glenora Club.   Benoit and I will be attempting to explain as much of the issue as we can from a technical and non-technical perspective, discussing the vulnerability, its scope with relation to our personal and professional lives and other related concerns such as our trust in the public PKI system.  The second hour we will be an interactive discussion about how others are dealing with problem, questions about related topics,