heartbleed-vulnerability-exploitation

Description

hands on investigation of the Heartbleed vulnerability (CVE-2014-0160).

Summary

this lab documents a hands-on investigation of the Heartbleed vulnerability, a critical flaw in OpenSSL's implementation of the TLS heartbeat extension. the goal was to understand how the vulnerability works at the protocol level and exploit it in a controlled environment to observe its impact, practicing skills directly relevant to SOC analysis (vulnerability assessment and impact analysis).

Objective

• understand the root cause of Heartbleed (improper bounds checking in OpenSSL's heartbeat extension).
• identify a vulnerable OpenSSL service using reconnaissance and scanning tools.
• exploit the vulnerability in a controlled lab environment to observe data exposure.
• document remediation strategies from a SOC/analyst perspective.

Environment & Tools

• Target: vulnerable web server (nginx 1.15.7 on port 443) running an outdated OpenSSL version, isolated lab VM.
• Attacker/Analyst Machine: linux-based analysis environment.
• Tools Used:

 nmap - service enumeration and vulnerability discovery.

 Metasploit - auxiliary/scanner/ssl/openssl_heartbleed module for exploitation.

Methodology

1. Reconnaissance

• ran a full TCP port scan with service/version detection (nmap -sS -vv -p-p -A )
• identified open ports: 22 (SSH), 111 (rpcbind), 443 (SSL/HTTP).
• fingerprinted port 443 as running ngix 1.15.7 over SSL/TLS (candidate for outdated OpenSSL)

2. Vulnerability Identification

• ran (nmap -sV --script vuln ) to check all discovered services against known vulnerability scripts.
• confirmed the target as VULNERABLE to Heartbleed via the ssl-heartbleed NSE script, flagged as high risk.

3. Exploitation

• launched metasploit framework (msfconsole) and located the relevant module with (search heartbleed).
• selected auxiliary/scanner/ssl/openssl_heartbleed and reviewed module options.
• configured RHOSTS, RPORT 443, and verbose true, then ran the module.
• the module sent a malformed TLS heartbeat request and captured the server's oversized response, leaking adjacent process memory.

Findings

• the target (nginx 1.15.7, port 443) was confirmed vulnerable to CVE-2014-0160 via both nmap's ssl-heartbleed script and Metasploit's openssl_heartbleed scanner.
• exploitation successfully leaked heap memory from the server, returning printable strings alongside binary data.
• the leaked memory contained fragments of a prior HTTP request body, including "user_name, user_email, and user_message" parameters demonstrating that Heartbleed can expose application layer data that happened to reside in adjacent memory.
• no authentication was required to exploit the vulnerability, making it exploitable by any network-adjacent attacker.

Remediation

• upgrade OpenSSL to a patched version.
• revoke and reissue any SSL certificates/private keys potentially exposed prior to patching.
• force password resets for accounts with sessions active during the vulnerable window.
• disable the heartbeat extension entirely if patching is not immediately possible.

Skills Demonstrated

• full-scope port scanning and service enumeration (nmap).
• vulnerability scanning with NSE scripts (vuln, ssl-heartbleed)
• exploit module configuration and execution in Metasploit framework.
• root cause analysis of a memory-safety vulnerability.
• security reporting and remediation planning.

References

• https://nvd.nist.gov/vuln/detail/CVE-2014-0160
• https://heartbleed.com/
• https://www.openssl.org/news/secadv/20140407.txt