1

I am building a testing environment for Heartbleed vulnerability. So I do the following things:

  1. Before start, I setup apache2 to work with SSL (https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04). I ran this command:

    openssl s_client -connect [server IP] -tlsextdebug 2>&1 | grep 'server extension "heartbeat" (id=15)' || echo safe
    

    It returns this TLS server extension "heartbeat" (id=15), len=1 ==> heartbeat extension is being used.

  2. I choose Ubuntu server 12.04 as OS

  3. I remove Openssl and Apache2 completely with apt-get remove --purge and apt-get autoremove
  4. I download Openssl 1.0.1e from here: https://www.openssl.org/source/old/1.0.1/
  5. I build it with following commands:

    ./config --prefix=/usr/openssl --openssldir=/usr/openssl
    make
    make install
    
  6. Reinstall Apache2 with apt-get install apache2
  7. Do the same things as Step 0 to check. But this time, it returns safe, means heartbeat is not running.

How can I make it work now?

Additional information: after building Openssl from source, I check by running these commands:

openssl genrsa -out server.pem 1024
openssl req -new -x509 -key server.pem -subj /CN=localhost >> server.pem
openssl s_server -www

and test with Metasploit, it shows that this version of Openssl has the vulnerabitlity.

Using command openssl version show 1.0.1e ==> The version which I built

  • 1
    If you installed the apache2 package, it will install the OpenSSL libraries from Ubuntu as well. You'll need to build apache yourself to use your locally built OpenSSL. – muru Jan 16 '17 at 14:04
  • Sorry, I forgot to say that I prevented installiing new version of Openssl by adding these 3 lines to /etc/apt/preferences: Package: openssl Pin: release * Pin-Priority: -1 However, I will try to build apache myself – thanh dat tang Jan 16 '17 at 14:22
  • @muru thank you. I follow your suggestion and it works now. How can I mark this question is answered ? – thanh dat tang Jan 17 '17 at 2:45
  • consider posting an answer, with how you built Apache. Then you can accept it and mark this post as answered – muru Jan 17 '17 at 12:53
2

Below is my script to prepare an environment to demonstrate CVE-2014-0160.

Here I cannot post download link because I do not have enough reputation. You need to download openssl-1.0.1e.tar.gz, httpd-2.4.25.tar.gz, apr-1.5.2.tar.gz, apr-util-1.5.4.tar.gz, pcre-8.40.tar.gz into your home directory.

#!/bin/sh

#Download installation files
cd ~
#Here I cannot post download link because I do not have enough reputation. 
#You need to download openssl-1.0.1e.tar.gz, httpd-2.4.25.tar.gz, apr-1.5.2.tar.gz, 
#apr-util-1.5.4.tar.gz, pcre-8.40.tar.gz into your home directory.

#Install compilers
yum -y groupinstall "Development Tools"

#Install pcre
cd ~
tar -zxvf pcre-8.40.tar.gz
cd pcre-8.40
./configure --prefix=/usr/local/pcre
make
make install

#Install openssl
cd ~
tar -zxvf openssl-1.0.1e.tar.gz
cd openssl-1.0.1e
./config     --prefix=/opt/openssl-1.0.1e     --openssldir=/opt/openssl-1.0.1e -fPIC -DOPENSSL_PIC
make
make install_sw

#Install openssl
cd ~
tar -zxvf openssl-1.0.1e.tar.gz
cd openssl-1.0.1e
./config     --prefix=/opt/openssl-1.0.1e     --openssldir=/opt/openssl-1.0.1e -fPIC -DOPENSSL_PIC
make
make install_sw

#Install httpd (using just installed opensll)
cd ~
tar -zxvf httpd-2.4.25.tar.gz
cd httpd-2.4.25/srclib/
tar zxvf ../../apr-1.5.2.tar.gz
ln -s apr-1.5.2/ apr
tar zxvf ../../apr-util-1.5.4.tar.gz
ln -s apr-util-1.5.4/ apr-util
cd ~
cd httpd-2.4.25
./configure     --prefix=/opt/httpd     --with-included-apr     --enable-ssl     --with-ssl=/opt/openssl-1.0.1e --enable-ssl-staticlib-deps     --enable-mods-static=ssl --with-pcre=/usr/local/pcre
make
make install

#Add configuration to use HTTPS (port 443)
cd ~
sed -i '/^#.*Include conf\/extra\/httpd-ssl.conf/s/^#//' /opt/httpd/conf/httpd.conf
sed -i '/^#.*LoadModule socache_shmcb_module modules\/mod_socache_shmcb.so/s/^#//' /opt/httpd/conf/httpd.conf

cd ~
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /opt/httpd/conf/server.key -out /opt/httpd/conf/server.crt -subj "/C=JP/ST=/L=/O=/OU=/CN=192.168.122.137"

/opt/httpd/bin/apachectl start

iptables -F

#Start httpd on booting
chmod +x /etc/rc.d/rc.local
echo '/opt/httpd/bin/apachectl start' >> /etc/rc.local

#Remove downloaded files
cd ~
rm -rf ~/openssl-1.0.1*

rm -rf ~/httpd*

rm -rf ~/pcre*

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.