Hack Like a Pro: Hacking the Heartbleed Vulnerability « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!In recent weeks,the Heartbleed vulnerabilityof OpenSSL has been dominating the information security headlines. This vulnerability enables an attacker to extract data from the server's memory that may contain authentication credentials, cookies, the servers private key, and personally identifiable info (PII) that could be used for identity theft. As a result, websites around the world have been scrambling to close this hole. Fortunately for us, many still have not, and many may never be closed.Basically, OpenSSL is an encryption library used in HTTPS (secure HTTP). The idea is that any data traveling over this secured version of HTTP should be secure and encrypted. During communication, OpenSSL uses a "heartbeat" that echoes back data to verify that the data was received correctly. It's kind of like one machine telling the other, "Yes, I got that data and you can send more now."The Heartbleed vulnerability enables a hacker to trick OpenSSL by sending asinglebyte of data while telling the server it sent 64K bytes of data. The server will then send back 64K bytes of data to be checked and echoed back. The server will then respond with 64K of random data from its memory.In this tutorial, I'll show you a simple exploit for getting that OpenSSL to spill the contents of its memory and possibly give us the user's credentials and other information.Step 1: Update MetasploitThe first step is to updateMetasploitto get the new auxiliary module for Heartbleed. Type:kali > msfupdateMetasploit will then go through the long and slow process of updating its modules and framework. Be patient here, it takes awhile.When you are finally returned to theKaliprompt, the update has completed.Step 2: Start MetasploitNow, we need to start the Metasploit console. At any terminal prompt, type:kali > msfconsoleYou should be greeted with a screen like that below.Step 3: Find HeartbleedNow, we need to find the new Heartbleed module. We can use the built-in search feature in Metasploit. Type:search heartbleedThis should bring up two auxiliary modules for Heartbleed. Select the first one as I've highlighted below.Step 4: Use Auxiliary ModuleNext, we need to load this payload. Simply type:use auxiliary/scanner/ssl/openssl_heartbleedThis will load the heartbleed module.Whenever I am using a new module, I like to look at the info page. Once we have loaded the module, type:msf > infoAs we can see in the screenshot below, this reveals the options that need to set in order to use this module and a description of the module.Step 5: Set OptionsAlthough this module has numerous options, the critical one is RHOSTS (notice the plural here). Let's set it to a target website I set up on my network that is still vulnerable to Heartbleed.msf > set RHOSTS 192.168.1.169Step 6: Run the ModuleFinally, set the option 'verbose" to "true". This will provide us with verbose output.msf > set verbose trueAnd now let's run it:msf > runAs you can see in the screenshot below, the server leaked about 64K bytes of what was in its memory.Step 7: SuccessIf credentials, personally identifiable information (PII), or the server's private key had been in memory, they would have leaked out as well. Of course, we could set up this Heartbleed scanner to run repeatedly to gather the info in memory at a continual basis, eventually gaining access to all the info that traversed RAM.In my next Heartbleed post, we will start working on a scanner script to scan the world for websites and servers still vulnerable to the Heartbleed vulnerability, so make sure to come back. While you're waiting, you can use your spare time to increase your skills in Metasploit by knowingall of the commandsandhacking scriptsavailable.Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseHeartbleed red codeandHeartbleed heartsimages via ShutterstockRelatedHack Like a Pro:How to Scan the Internet for Heartbleed VulnerabilitiesHeartbleed Still Lingers:How to Check Your Android Device for VulnerabilitiesNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Exploit and Gain Remote Access to PCs Running Windows XPHack Like a Pro:How to Hack Web Apps, Part 1 (Getting Started)Hack Like a Pro:Using the Nmap Scripting Engine (NSE) for ReconnaissanceHack Like a Pro:Hacking Windows XP Through Windows 8 Using Adobe Flash PlayerHack Like a Pro:Using Nexpose to Scan for Network & System VulnerabilitiesHack Like a Pro:How to Find Website Vulnerabilities Using WiktoHack Like a Pro:How to Find the Latest Exploits and Vulnerabilities—Directly from MicrosoftWhite Hat Hacking:Hack the Pentagon?Hack Like a Pro:How to Use Hacking Team's Adobe Flash ExploitHack Like a Pro:How to Hack Web Apps, Part 5 (Finding Vulnerable WordPress Websites)Hack Like a Pro:Linux Basics for the Aspiring Hacker, Part 18 (Scheduling Jobs)Hack Like a Pro:How to Exploit Adobe Flash with a Corrupted Movie File to Hack Windows 7The Panama Papers Hack:Further Proof That Hacking Is Changing the WorldHack Like a Pro:How to Find Almost Every Known Vulnerability & Exploit Out ThereNews:Hack the Switch? Nintendo's Ready to Reward You Up to $20,000How To:Find Your Computer's Vulnerability Using LynisHow To:Fix Your Hacked and Malware-Infested Website with GoogleHack Like a Pro:How to Crash Your Roommate's Windows 7 PC with a LinkHack Like a Pro:How to Scan for Vulnerabilities with NessusHack Like a Pro:How to Hack Web Apps, Part 6 (Using OWASP ZAP to Find Vulnerabilities)How To:Hack web browsers with BeEFHIOB:WebSite Hacking Series Part 2: Hacking WebSites Using The DotNetNuke VulnerabilityHow To:Learn to Code Your Own Games with This Hands-on BundleHack Like a Pro:How to Hack the Shellshock VulnerabilityHow To:Hack Coin-Operated Laudromat Machines for Free Wash & Dry CyclesNews:Best Hacking SoftwareNull Byte:Never Let Us DieHack Like a Pro:Hacking Samba on Ubuntu and Installing the MeterpreterNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreHow To:Hack Wi-Fi Using Wifite in Kali