This is part one of a multi-part series associated with the HeartBleed vulnerability. This part deals with getting your environment setup with a vulnerable SSL webserver (using Kali Linux), and the client software used to test for and exploit it.
Setup the vulnerable web server.
Kali Linux already has apache installed, so simply enable the SSL mod, create a directory to hold the key material, generate the private key and ssl cert, and restart the server to
Then you'll need to edit the ssl site configuration to enable it for your ip address (not the one below).
and change the following lines to use the newly generated key material:
Then restart the apache server
And test the server using a web browser:
To test for / exploit the vulnerability I'm initially using the python test code here: https://gist.github.com/takeshixx/10107280
Great I can confirm that I have been able to extract data from the vulnerable OpenSSL library. But the returned data doesn't make much sense.
Many people have been kind enough to release tools that take the exploitation a step further. Robert David Graham @erratarob released the heartleech tool as a response to the cloudflare challenge. This tool provides a bunch of extra features including;
Building the binary on OSX 10.9 is fairly easy but you need to download and compile the OpenSSL library as documented in Robert's instructions. Once built simply run it against the site in question;
Extract and Use the Private Key:
Good, it reports it as vulnerable. Now lets try to extract the private key.
Setup the vulnerable web server.
Kali Linux already has apache installed, so simply enable the SSL mod, create a directory to hold the key material, generate the private key and ssl cert, and restart the server to
sudo a2enmod ssl
sudo mkdir /etc/apache2/ssl
cd /etc/apache2/ssl
sudo openssl req -x509 -nodes - days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/webserver.key -out /etc/apache2/ssl/webserver.crt
Then you'll need to edit the ssl site configuration to enable it for your ip address (not the one below).
vi /etc/apache2/sites-available/default-sslAdd the information for your server.
ServerName 192.168.4.134:443
and change the following lines to use the newly generated key material:
SSLCertificateFile /etc/apache2/ssl/webserver.crt
SSLCertificateKeyFile /etc/apache2/ssl/webserver.key
Then restart the apache server
sudo service apache2 restart
And test the server using a web browser:
Your browser should still complain about the self-signed cert.
Install the HeartBleed test software:
To test for / exploit the vulnerability I'm initially using the python test code here: https://gist.github.com/takeshixx/10107280
git clone https://gist.github.com/takeshixx/10107280
cd 10107280
python hb-test.py 192.168.4.134|more
Great I can confirm that I have been able to extract data from the vulnerable OpenSSL library. But the returned data doesn't make much sense.
Many people have been kind enough to release tools that take the exploitation a step further. Robert David Graham @erratarob released the heartleech tool as a response to the cloudflare challenge. This tool provides a bunch of extra features including;
- Automated extraction of mass amounts of memory
- Automated retrieval of private keys
- Limited IDS evasion (most signature based IDS products)
- STARTTLS (email server library)
Building the binary on OSX 10.9 is fairly easy but you need to download and compile the OpenSSL library as documented in Robert's instructions. Once built simply run it against the site in question;
Extract and Use the Private Key:
Good, it reports it as vulnerable. Now lets try to extract the private key.
Very quickly it came back with the key material, now I could create a new server certificate using this private key and impersonate the server. Which should match the one on the vulnerable web server.
Now with the private key extracted, I can create a message and encrypt it with the extracted private key, and verify the signature using the certificate that I got from the web server.
Very good work by @erratarob on the speed of getting a tool like this out publicly, I should have a new post soon with results of testing the IDS evasion functionality soon.
Comments