Hacker News Reader

Comment by danielweber | Hacker News Reader

If your webserver has the vulnerable version of the OpenSSL library, then your server will return some extra bytes, from someplace in memory.

It may turn out that the space in memory it's returning from is useless. Or, like yahoo, you may be giving out plain-text ASCII passwords to complete strangers who can type a command line. Which of these two extremes you get is largely based on luck.

View on HN

Thanks for the information. I modified the script to request a different number of bytes. It seems that 16384 is too much and causes the server to abort sending, but lower amounts work to successfully dump memory.

EDIT: The other thing is that it seems better to check for "Server Hello Done" at the end of the handshake message as some servers seem to send all submessages within one handshake message (though not sure if they're OpenSSL-based), i.e. look for ord(pay[-4]) == 0x0E rather than at ord(pay[0]).

For those that don't python and/or don't know where to edit.

  hb = h2bin('''
  18 03 02 00 03
  01 40 00
  ''')

See that "40 00" there? That's hex and 0x4000 = 16384. Change it to something like "02 00", so it's 0x200 = 512, or 0x400 = 1024 ...or whatever you want.(But keep it at a power of 2... I assume).

http://en.wikipedia.org/wiki/Power_of_two

As long as it's valid hex it should be fine, there seems to be a lower bound at which point servers don't respond but I didn't play around for too long with that part. Most articles also mention 64kb which the script can do with some small modifications.

you might also want to use [1] xmpp, starttls, proxy support with valid tls records, custom palyoad and stuff.. configurable via cmdline options.

[1] https://gist.github.com/tintinweb/10411753 | hb-test.py aka heartbleed.py

Reply on news.ycombinator.com