11 ms·

Is the vulnerability, or this script to exploit it, platform-specific? I tried this script against a Raspberry Pi running Raspbian with an unpatched OpenSSL lib

by quasque 13y ago

Is the vulnerability, or this script to exploit it, platform-specific? I tried this script against a Raspberry Pi running Raspbian with an unpatched OpenSSL library, but received an unexpected EOF.

danielweber 13y ago
If your webserver has the vulnerable version of the OpenSSL library, then your server will return some extra bytes, from someplace in memory. It may turn out that the space in memory it's returning from is useless. Or, like yahoo, you may be giving out plain-text ASCII passwords to complete strangers who can type a command line. Which of these two extremes you get is largely based on luck.
- quasque 13y ago
  Thanks for the information. I modified the script to request a different number of bytes. It seems that 16384 is too much and causes the server to abort sending, but lower amounts work to successfully dump memory. EDIT: The other thing is that it seems better to check for "Server Hello Done" at the end of the handshake message as some servers seem to send all submessages within one handshake message (though not sure if they're OpenSSL-based), i.e. look for ord(pay[-4]) == 0x0E rather than at ord(pay[0]).
  - smtddr 13y ago
    For those that don't python and/or don't know where to edit. hb = h2bin(''' 18 03 02 00 03 01 40 00 ''') See that "40 00" there? That's hex and 0x4000 = 16384. Change it to something like "02 00", so it's 0x200 = 512, or 0x400 = 1024 ...or whatever you want.(But keep it at a power of 2... I assume). http://en.wikipedia.org/wiki/Power_of_two http://en.wikipedia.org/wiki/Power_of_two
    - axisK 13y ago
      As long as it's valid hex it should be fine, there seems to be a lower bound at which point servers don't respond but I didn't play around for too long with that part. Most articles also mention 64kb which the script can do with some small modifications.
    - 2bjorn 12y ago
      you might also want to use [1] xmpp, starttls, proxy support with valid tls records, custom palyoad and stuff.. configurable via cmdline options. [1] https://gist.github.com/tintinweb/10411753 https://gist.github.com/tintinweb/10411753 | hb-test.py aka heartbleed.py

by quasque 13y ago

Is the vulnerability, or this script to exploit it, platform-specific? I tried this script against a Raspberry Pi running Raspbian with an unpatched OpenSSL library, but received an unexpected EOF.

danielweber 13y ago

If your webserver has the vulnerable version of the OpenSSL library, then your server will return some extra bytes, from someplace in memory. It may turn out that the space in memory it's returning from is useless. Or, like yahoo, you may be giving out plain-text ASCII passwords to complete strangers who can type a command line. Which of these two extremes you get is largely based on luck.

quasque 13y ago
Thanks for the information. I modified the script to request a different number of bytes. It seems that 16384 is too much and causes the server to abort sending, but lower amounts work to successfully dump memory. EDIT: The other thing is that it seems better to check for "Server Hello Done" at the end of the handshake message as some servers seem to send all submessages within one handshake message (though not sure if they're OpenSSL-based), i.e. look for ord(pay[-4]) == 0x0E rather than at ord(pay[0]).
- smtddr 13y ago
  For those that don't python and/or don't know where to edit. hb = h2bin(''' 18 03 02 00 03 01 40 00 ''') See that "40 00" there? That's hex and 0x4000 = 16384. Change it to something like "02 00", so it's 0x200 = 512, or 0x400 = 1024 ...or whatever you want.(But keep it at a power of 2... I assume). http://en.wikipedia.org/wiki/Power_of_two http://en.wikipedia.org/wiki/Power_of_two
  - axisK 13y ago
    As long as it's valid hex it should be fine, there seems to be a lower bound at which point servers don't respond but I didn't play around for too long with that part. Most articles also mention 64kb which the script can do with some small modifications.
  - 2bjorn 12y ago
    you might also want to use [1] xmpp, starttls, proxy support with valid tls records, custom palyoad and stuff.. configurable via cmdline options. [1] https://gist.github.com/tintinweb/10411753 https://gist.github.com/tintinweb/10411753 | hb-test.py aka heartbleed.py