Metasploit-framework: [ Metasploit Framework ] OpenSSL

[XSecr3t]

Hello excuse me i just want ask one questions

Is there possible if OPENSSL 1.0.1c version is vulnerable?

Example :
I have 2 targets that having the same openssl version
The first targets is vulnerable
But second targets said not vulnerable.

really confuse about this, if it is true about not at all version 1.0.1c is vulnerable why the first targets is vulnerable?

By the way,
Can you reference me how to exploit some information ssl user and passwd attack?
Cause i just want test this websites,the owner of this websites is my friend.

Thank you for reply

[bcoles]

Vulnerable to what exactly?

Also: https://en.wikipedia.org/wiki/Backporting

[XSecr3t]

@bcoles heartbleed information leaked openssl 1.0.1c

Targets ==> 80/tcp open http Apache httpd 2.2.22 ((FreeBSD) PHP/5.2.17 with Suhosin-Patch mod_ssl/2.2.22 OpenSSL/1.0.1c DAV/2)

For Response Handshake :
See this

pict 1 ==> http://i63.tinypic.com/vnzd7a.jpg
pict 2 ==> http://i68.tinypic.com/f1mrz7.jpg
Pict 3 ==> http://i68.tinypic.com/x2rzpl.jpg

[bcoles]

It might not be vulnerable.

You could try modifying the HEARTBEAT_LENGTH, or try verifying with another tool such as sslscan or testssl.

[XSecr3t]

@bcoles
Are you sure about that?

When i used check for exploitable it says the targets appears to be vulnerable

This is the result said :

[*] xx. xx.47.159:443 - The target appears to be vulnerable

[bcoles]

@bcoles
Are you sure about that?

Nope. You could try modifying the HEARTBEAT_LENGTH, or try verifying with another tool such as sslscan or testssl. Nmap also has a script to dump process memory via heartbleed.

If it is vulnerable, it may not always have any data to leak. You could try requesting multiple times, while also generating traffic to the HTTPS port.

But since the owner of the website is your friend, and you've apparently identified one server that is vulnerable, you may as well recommend updating the version of OpenSSL on both, and call it a day. The latest version of OpenSSL in the 1.0.x branch is OpenSSL 1.0.2q.

[XSecr3t]

@bcoles

Okay, give me some time 24 hours for this issues.
I'll be back.

Thank you.

[bcoles]

Are you sure the owner of mail.dvorec.eu is your friend?

[XSecr3t]

@bcoles
Another websites is my friend
The vulnerable websites is the targets

That's why i ask why this targets vulnerable but my friend's websites is not

[busterb]

Generally 1.0.1c is vulnerable, assuming it is upstream and not a backported patch. But this discussion is a bit outside of a Metasploit-specific question, so I'm closing it.