Heartbleed is a vulnerability which was found in OpenSSL Cryptographic software library. This vulnerability occurs by exploiting the Heartbeat Extension of OpenSSL TLS/TDLS (Transport Layer Security), and thus, it got such name. Successful exploitation of this vulnerability can result in disclosure of server private keys and sometimes sensitive credentials. To exploit this vulnerability, we need to understand how heartbeat extension works and why it is used. The need for this extension arises as in TLS there is no such feature to check whether the remote host is alive or not when there is no data transfer happening on both ends. This extension overcomes this limitation by sending a heartbeat requests to the host and receiving appropriate responses. However in the vulnerable implementation, there is no validation on the length of bytes client requested. Thus, a remote attacker can craft an appropriate heartbeat request to read no of bytes from the server’s memory. Heartbeat Message Sent by Attacker. As can be seen, in the above heartbeat message the attacker says the payload data is of 1 byte, but he sends the length of the payload as 65535 bytes, which leads the vulnerable server to read these bytes from its memory.
Install Wamp Server
Configure Wamp to use SSL
Configure Wamp to Listen on NAT Network Interface
Configure root password for PhpMyAdmin
Exploit Heartbleed Vulnerability
Lab setup for this vulnerability is pretty straight forward. We will be using a 32-bit version of wamp server version 2 with 32-bit OpenSSL binary version 1.0.1. All required files for lab setup can be downloaded from the link given below. Download VM Files – https://drive.google.com/open?id=0B9Dl0ONdsnRnNExiMzRjUWl2Y3M Download Win7 Lab VM – https://www.dropbox.com/s/7ewnafvqb0900pb/W7Client_v5.rar?dl=0 Download Kali Lab VM – https://www.dropbox.com/s/64yjrhl02yioto2/Kali_v5u.rar?dl=0 Step 1: After extracting all files we will install Wamp server on our VM as follows:
Now select your default browser in our machine we have o only Internet Explorer, so we are selecting IE as our default browser.
Untick “Launch WampServer 2 Now” as we need to do some configurations before
Step 2: At this step, we have successfully installed Wamp Server. Now we are going to configure it to use SSL. To do that, we will be extracting the files from vulnerable openSSL version.
Copy above-selected files and paste these in C:wampbinapacheApache2.2.21bin folder as follows.
Step 1: We will now generate SSL certificates and key files. To do that open command prompt window in current Apache bin folder and execute commands as follows: OpenSSL genrsa -des3 -out server.key 1024
After that type in the following command: openssl req -new -x509 -nodes -sha1 -days 365 -key server.key -out server.crt -config C:wampbinapacheapache2.2.21confopenssl.cnf
After that type the following command one by one: xcopy server.key server.key.orig del server.key openssl rsa -in server.key.orig -out server.key
Step 2: Create a folder named ssl in C:wampbinapacheApache2.2.21 directory. Step 3: Copy server.key and server.crt files created in step 1 to ssl folder as follows.
Step 4: Copy and replace the configuration files from downloaded VM files (httpd.conf and httpd-ssl.conf) in following directories. httpd.conf – C:wampbinapacheApache2.2.21conf httpd-ssl.conf – C:wampbinapacheApache2.2.21confextra
Step 5: Start Wamp Server.
If everything went well, you should be able to browse the wamp server at https://localhost which will show you SSL certificate error which is shown below:
Step 1: Now we need to enable wamp server on our NAT network interface so that we can access it from our attacking machine. To do that, we will execute “ipconfig /all” command in command prompt and note down the IP address of NAT network interface as follows.
Further, we need to define the NAT Network Interface IP address in Apache config files. To do that Open C:wampbinapacheApache2.2.21confhttpd.conf file, comment the line “Listen 80” and add your NAT network interface IP address as follows.
Open C:wampbinapacheApache2.2.21confextrahttpd-ssl.conf file, comment the line “Listen 443” and add your NAT network interface IP address as follows.
Step 1: As we will be stealing the MySQL root user password during our exploitation phase, we need to create one as follows: Open the Mysql Console from Wamp Menu
For Password, press enter and execute the following query to set a password for the root user. SQL Query for password set : set password for ‘root’@’localhost’ = password(‘tester123’);
Step 2: To reflect above changes in current wamp configuration We need to copy two files from the downloaded VM files as follows:
copy and paste config.inc.php file in C:wampappsphpmyadmin3.4.10.1 directory copy and paste phpmyadmin.conf file in C:wampalias directory Further, we will be restarting wamp server to reflect current changes.
If everything is configured properly, you will now be able to browse Wamp Server at your NAT network Interface IP address.
Browse PHPMyAdmin via https and enter a password set earlier via MySQL prompt.
Exploiting the vulnerability To exploit the vulnerability, we will be using infamous Metasploit framework from Rapid 7. We will start the Metasploit by issuing command MSF console in our Kali machine. Step 1: We searched for the auxiliary available for heartbleed vulnerability and came up with following results.
Step 2: We issue use command to use the auxiliary module by typing use auxiliary/scanner/ssl/openssl_heartbleed
Step 3: We configured the module and set RHOSTS to our vulnerable win7 machine and set RPORT to 443. Note: We need to enable VERBOSE mode by typing set VERBOSE true to view the memory dump.
As can be seen, we were successfully able to fetch MySQL root password highlighted with green color. We can also see the cookies of root user highlighted in red color.
References: http://www.theregister.co.uk/2014/04/09/heartbleed_explained/ https://tools.ietf.org/html/rfc6520 https://github.com/sensepost/heartbleed-poc https://sourceforge.net/projects/wampserver/files/WampServer%202/WampServer%202.2/ https://indy.fulgan.com/SSL/ https://www.shilpasys.com/new/wp-content/uploads/2014/04/heartbleed-wallpaper-hd.png https://www.pythian.com/blog/test-lab-using-virtualbox-nat-networking/
