hirokiii/cve-2023-44487Entorno educativo para LTAT.04.022 Tarea 4.
Entorno educativo para la Tarea 4 de LTAT.04.022.
Cuatro contenedores te permiten escanear y comparar configuraciones vulnerables y parcheadas.
| Contenedor | Puerto | Software | Estado |
|---|---|---|---|
| nginx-vuln | 8441 | nginx 1.24 | Vulnerable |
| nginx-secure | 8442 | nginx latest | Parcheado |
| apache-vuln | 8443 | Apache 2.4.57 | Vulnerable |
| apache-secure | 8444 | Apache latest | Parcheado |
# Generate self-signed TLS certs (required by all containers)
bash gen-certs.sh
# Start all 4 containers
docker compose up -d
# Verify all are running
docker compose ps
# Check each container responds (ignore cert warning with -k)
curl -k --http2 -I https://localhost:8441 # nginx vulnerable
curl -k --http2 -I https://localhost:8442 # nginx secure
curl -k --http2 -I https://localhost:8443 # apache vulnerable
curl -k --http2 -I https://localhost:8444 # apache secure
Esperado: HTTP/2 200 de los cuatro.
curl -k --http2 -v https://localhost:8441 2>&1 | grep -E "ALPN|HTTP/"
Busca:
* ALPN: server accepted h2
< HTTP/2 200
# Copy the scanner here first (or adjust the path)
cp ../scanner.py .
python3 scanner.py localhost 8441 # nginx vuln
python3 scanner.py localhost 8442 # nginx secure
python3 scanner.py localhost 8443 # apache vuln
python3 scanner.py localhost 8444 # apache secure
Resultados esperados:
| Objetivo | HTTP/2 | Veredicto |
|---|---|---|
| 8441 | YES | LIKELY VULNERABLE |
| 8442 | YES | LIKELY PATCHED |
| 8443 | YES | LIKELY VULNERABLE |
| 8444 | YES | UNKWOWN |
Usa nghttp para inspeccionar la trama SETTINGS que envía cada servidor.
Esto muestra directamente el valor de SETTINGS_MAX_CONCURRENT_STREAMS.
# Install nghttp2 client
sudo apt install nghttp2-client # Ubuntu/Debian
brew install nghttp2 # macOS
# Inspect SETTINGS frame
for port in 8441 8442 8443 8444; LIKELY PAdo
streams=$(nghttp -nvy https://localhost:$port 2>&1 | grep "MAX_CONCURRENT" | tail -1 | awk -F: '{print $2}' | tr -d ']')
echo "port $port → MAX_CONCURRENT_STREAMS: $streams"
done
# (Results)
port 8441 → MAX_CONCURRENT_STREAMS: 128
port 8442 → MAX_CONCURRENT_STREAMS: 32
port 8443 → MAX_CONCURRENT_STREAMS: 1000
port 8444 → MAX_CONCURRENT_STREAMS: 32
Servidor vulnerable: límite de flujo alto (128+)
Servidor seguro: limitado a 32
Esto envía 50 solicitudes rápidamente en una sola conexión — no es un ataque real, pero muestra el comportamiento de manejo de RST del servidor en los registros.
# h2load is part of nghttp2-client
h2load -n 1000 -c 1 -m 50 https://localhost:8441 # vuln
h2load -n 1000 -c 1 -m 50 https://localhost:8442 # secure
Registros esperados para los ejemplos:
$ h2load -n 1000 -c 1 -m 1000 https://localhost:8441
starting benchmark...
spawning thread #0: 1 total client(s). 1000 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 10% done
progress: 20% done
progress: 30% done
progress: 40% done
progress: 50% done
progress: 60% done
progress: 70% done
progress: 80% done
progress: 90% done
progress: 100% done
finished in 22.51ms, 44428.65 req/s, 5.38MB/s
requests: 1000 total, 1000 started, 1000 done, 1000 succeeded, 0 failed, 0 errored, 0 timeout
status codes: 1000 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 124.07KB (127049) total, 83.01KB (85000) headers (space savings 38.85%), 23.44KB (24000) data
min max mean sd +/- sd
time for request: 260us 2.98ms 2.25ms 384us 87.70%
time for connect: 2.51ms 2.51ms 2.51ms 0us 100.00%
time to 1st byte: 3.24ms 3.24ms 3.24ms 0us 100.00%
req/s : 45059.11 45059.11 45059.11 0.00 100.00%
$ h2load -n 1000 -c 1 -m 1000 https://localhost:8442
starting benchmark...
spawning thread #0: 1 total client(s). 1000 total requests
TLS Protocol: TLSv1.3
Cipher: TLS_AES_256_GCM_SHA384
Server Temp Key: X25519 253 bits
Application protocol: h2
progress: 10% done
finished in 5.38ms, 18583.91 req/s, 2.33MB/s
requests: 1000 total, 1000 started, 167 done, 100 succeeded, 900 failed, 900 errored, 0 timeout
status codes: 100 2xx, 0 3xx, 0 4xx, 0 5xx
traffic: 12.83KB (13134) total, 8.30KB (8500) headers (space savings 38.85%), 2.25KB (2300) data
min max mean sd +/- sd
time for request: 83us 1.04ms 533us 256us 63.00%
time for connect: 2.96ms 2.96ms 2.96ms 0us 100.00%
time to 1st byte: 3.55ms 3.55ms 3.55ms 0us 100.00%
req/s : 19316.22 19316.22 19316.22 0.00 100.00%
El contenedor seguro mostrará restablecimientos o rechazos de conexión cuando se alcance el límite de flujo; el vulnerable aceptará las 50 sin quejarse.
# Vulnerable servers expose version info
curl -k -I https://localhost:8441 2>/dev/null | grep -i server
curl -k -I https://localhost:8443 2>/dev/null | grep -i server
# Secure servers hide or minimize version info
curl -k -I https://localhost:8442 2>/dev/null | grep -i server
curl -k -I https://localhost:8444 2>/dev/null | grep -i server
docker compose down
| Ajuste | Vulnerable (1.24) | Seguro (1.25.3+) |
|---|---|---|
http2_max_concurrent_streams | 128 (por defecto) | 32 |
keepalive_requests | 10000 | 100 |
keepalive_timeout | 300s | 65s |
| Limitador de tasa RST_STREAM | Ninguno | Integrado en el parche |
| Ajuste | Vulnerable (2.4.57) | Seguro (2.4.58+) |
|---|---|---|
H2MaxSessionStreams | 1000 | 32 |
ServerTokens | Full | Prod |
| Parche de protección contra reset | No presente | Aplicado |