rapid7/metasploit-framework — pull request #3437 by jvazquez-r7 (2014-06-09 22:43:01+00:00)
Title: Add module for CVE-2014-0224, OpenSSL CCS injection

Nothing very special, just got some code from the hearbleed scanner and did a first scanner based on the python poc available: http://www.tripwire.com/state-of-security/incident-detection/detection-script-for-cve-2014-0224-openssl-cipher-change-spec-injection/

It would need work, but at least is a first version and hopefully usable enough for people use metasploit to scan services such as HTTPS which could be vulnerable.

Tested with Ubuntu 13.10 since openssl package without any update was vulnerable.

DEMO:

```
msf > use auxiliary/scanner/ssl/openssl_ccs
msf auxiliary(openssl_ccs) > set rhosts 172.16.158.176
rhosts => 172.16.158.176
msf auxiliary(openssl_ccs) > set verbose true
verbose => true
msf auxiliary(openssl_ccs) > workspace -a openssl_ccs
[*] Added workspace: openssl_ccs
```

* Patched achine, set verbose to show the error messages:

```
msf auxiliary(openssl_ccs) > run

[*] 172.16.158.176:443 - Sending Client Hello...
[*] 172.16.158.176:443 - Sending CCS...
[-] 172.16.158.176:443 - Alert record as response to the invalid CCS Message
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```

* Unpatched machine

```
msf auxiliary(openssl_ccs) > set rhosts 172.16.158.175
rhosts => 172.16.158.175
msf auxiliary(openssl_ccs) > rexploit
[*] Reloading module...

[*] 172.16.158.175:443 - Sending Client Hello...
[*] 172.16.158.175:443 - Sending CCS...
[+] 172.16.158.175:443 - No Alert after invalid CSS message, probably vulnerable
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf auxiliary(openssl_ccs) > vulns
[*] Time: 2014-06-09 22:36:46 UTC Vuln: host=172.16.158.175 name=OpenSSL CCS Injection Scanner refs=CVE-2014-0224,URL-http://ccsinjection.lepidum.co.jp/,URL-http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html,URL-http://www.tripwire.com/state-of-security/incident-detection/detection-script-for-cve-2014-0224-openssl-cipher-change-spec-injection/,URL-https://www.imperialviolet.org/2014/06/05/earlyccs.html
```