mothran/tlslite — pull request #1 by makomk (2014-04-09 17:17:30+00:00)
Title: Try and obtain server's private RSA key. Works occasionally against Apache.

This adds a new command line option to try and obtain the RSA private key of affected OpenSSL servers, particularly Apache. This isn't terribly reliable and using high values of -n unfortunately doesn't seem to help on my test system - it succeeds in the first few attempts of a given run or not at all. At some point it seems to be more productive to try again with a new connection than increase -n further. I've been keeping a prior version of this based on my own modified tlslite under my hat for a day or so but it doesn't seem worth delaying much longer since other people have probably already figured it out by this point. (Probably with more reliable exploits too.)