5 ms·
Cracking Cloudflare's heartbleed challenge
- tomkwok 13y agoWhich one's better: https://github.com/indutny/heartbleed https://github.com/indutny/heartbleed (in node.js) or https://github.com/robertdavidgraham/heartleech https://github.com/robertdavidgraham/heartleech (in C)?
- einaros 13y agoI've published another toolset in Python here: https://github.com/einaros/heartbleed-tools https://github.com/einaros/heartbleed-tools The final test I did before publishing yielded ~100Mbit/sec of bleed from the challenge server, and had the prime in a few secs. I also detailed a couple of other challenge observations here: https://hacking.ventures/rsa-keys-in-heartbleed-memory/ https://hacking.ventures/rsa-keys-in-heartbleed-memory/
- chubot 13y agoThanks for publishing. FWIW I tried your tools, and it said my server Nginx HTTPS was vulnerable, but I couldn't get any keys out of it. I created a 180MB dump file, and then scanned it, and it finished without finding keys (and I repeated this again) I also tried the code you linked here: https://news.ycombinator.com/item?id=7577659 https://news.ycombinator.com/item?id=7577659 This also failed, and it actually said my server was likely not vulnerable? I compiled my own Nginx, (but not my own SSL, that came from Debian 7.0 Wheezy) Linux ... 3.9.3-x86_64-linode33 #1 SMP Mon May 20 10:22:57 EDT 2013 x86_64 GNU/Linux OpenSSL 1.0.1e 11 Feb 2013 I just upgraded the Debian libssl1.0.0 package, and now your code says I am safe. I see there is the len(all_data) > 24 check. Should compiling my own Nginx have any effect on whether the exploit works? I would think not, but 2 different exploits failed (although maybe I didn't run it long enough). FWIW it was Nginx 1.0.12. EDIT: FWIW, now that I read Cloudflare's results, they think the Nginx server is only vulnerable shortly after being restarted. My server was running for months, which may have explained why it wasn't vulnerable. Oh well. http://blog.cloudflare.com/the-results-of-the-cloudflare-challenge http://blog.cloudflare.com/the-results-of-the-cloudflare-cha...
- einaros 13y agoNo, the primes (and thus key) can be retrieved at any time, but it may be more frequently found right after reboot. I would recommend you to gather at least a gigabyte before digging for the key - preferably more. I dumped 43 GB from CloudFlare on Sunday, and found the prime 194 times in that dump. It can be found in much less time, however. Here's a test I just did against the CloudFlare server, resulting in the full prime 34 times in 60 seconds: https://twitter.com/einaros/status/456136820913238016 https://twitter.com/einaros/status/456136820913238016 The code from the second posted you noted (https://news.ycombinator.com/item?id=7577659 https://news.ycombinator.com/item?id=7577659) isn't mine. That one builds off of the original Python PoC, which fails for a lot of configurations. The Github code is the first publication I've done. Let me know if you see a server that's vulnerable, that the Github code fails to detect.
- indutny 13y agoOn other hand - you could try using my tool, and keep it running up until it'll find the key. It doesn't collect any dumps and does all processing in a real time.
- einaros 13y agoI didn't actually write mine to collect primes :) I'm working with data dumped from other network devices, and for the most running various Yara rules during and after collection.
- quasque 13y agoWas the other prime present in your 43 GB dump or just the one starting with 0xc4ea13ad? Or any other components of the private key? My own program only saved the snippets of memory in which a little-endian prime was detected - I didn't keep the rest of the data.
- einaros 13y agoDoing realtime prime detection is trivial in mine as well. Either pipe the outfile or add to the lib. I didn't write the dump tool with keys as primary target; they just happened to be there.
- sp332 13y agoI couldn't get heartleech to build at all. The Makefile is malformed, for a start.
- juhanima 13y agoYes, but you don't really need the Makefile. Just check out README.md and do as it says, and it should build just fine. Actually just $ gcc -o heartleech -lcrypto -lssl -ldl heartleech.c might work dependening a bit on the distro. Seems to work, too.
- sp332 13y agoIt doesn't link for me on Ubuntu 13.10. I wasn't going to be too hard on a quick project for being unportable, but a broken build tool makes it difficult to get working anywhere.
- moyix 13y agoIs it so hard to look at the README? > This is tricky. This uses the ssl3_write_bytes() function in order to send heartbeats encrypted after the SSL handshake is complete. This function is sometimes exported in OpenSSL libraries, and sometimes not. > If that's the trouble, then you have to download and build OpenSSL, then link this tool with their object files. I did this by doing: git clone git://git.openssl.org/openssl.git cd openssl ./config make depend make gcc ../heartleech/heartleech.c libcrypto.a libssl.a -ldl -o heartleech > This is evil, because I'm simultaneously linking to the local libraries and the system libraries for OpenSSL, but it seems to work without too much trouble.
- sp332 13y agoSorry if I wasn't clear, but I did try that. Result: http://pastebin.com/mM3G7NgX http://pastebin.com/mM3G7NgX I finally got it working by using instructions from a different heartbleed PoC: gcc heartleech.c -o heartleech -lssl -lcrypto -ldl -I~/openssl-1.0.1g/include -L~/openssl-1.0.1g
- indutny 13y agoI think it is a matter of taste mostly, they all use similar method, I think
- jgrahamc 13y agoThis is the code used by the first person to extract the private key.
- tomkwok 13y agoAnd as he mentioned, it's a node.js script (plus the node-v0.10.26.patch).
- filipedeschamps 13y agoThank you for the post explaining. It's great to have good guys like you around. Keep up with the good job.
- user2994cb 13y agoNice. To speed things up, you could look for 128 byte malloc'ed chunks with a 16 byte header of "xx xx xx xx 90 00 00 00" or "xx xx xx xx 91 00 00 00" (for a 2048 bit modulus). Looks to me like OpenSSL caches the modulus for Montgomery multiplication and that's where the primes in higher memory are coming from (see rsa_eay.c around line 774).
- gojomo 13y agoAn interesting variant of prime-number search. It may not turn up the largest primes yet known... just the economically valuable smaller ones.