0

I am building a testing environment for Heartbleed vulnerability. So I do the following things:

  1. Before start, I setup apache2 to work with SSL (https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04). I ran this command:

    openssl s_client -connect [server IP] -tlsextdebug 2>&1 | grep 'server extension "heartbeat" (id=15)' || echo safe
    

    It returns this TLS server extension "heartbeat" (id=15), len=1 ==> heartbeat extension is being used.

  2. I choose Ubuntu server 12.04 as OS

  3. I remove Openssl and Apache2 completely with apt-get remove --purge and apt-get autoremove
  4. I download Openssl 1.0.1e from here: https://www.openssl.org/source/old/1.0.1/
  5. I build it with following commands:

    ./config --prefix=/usr/openssl --openssldir=/usr/openssl
    make
    make install
    
  6. Reinstall Apache2 with apt-get install apache2
  7. Do the same things as Step 0 to check. But this time, it returns safe, means heartbeat is not running.

How can I make it work now?

Additional information: after building Openssl from source, I check by running these commands:

openssl genrsa -out server.pem 1024
openssl req -new -x509 -key server.pem -subj /CN=localhost >> server.pem
openssl s_server -www

and test with Metasploit, it shows that this version of Openssl has the vulnerabitlity.

Using command openssl version show 1.0.1e ==> The version which I built

4
  • 1
    If you installed the apache2 package, it will install the OpenSSL libraries from Ubuntu as well. You'll need to build apache yourself to use your locally built OpenSSL.
    – muru
    Jan 16, 2017 at 14:04
  • Sorry, I forgot to say that I prevented installiing new version of Openssl by adding these 3 lines to /etc/apt/preferences: Package: openssl Pin: release * Pin-Priority: -1 However, I will try to build apache myself Jan 16, 2017 at 14:22
  • @muru thank you. I follow your suggestion and it works now. How can I mark this question is answered ? Jan 17, 2017 at 2:45
  • consider posting an answer, with how you built Apache. Then you can accept it and mark this post as answered
    – muru
    Jan 17, 2017 at 12:53

1 Answer 1

1

Below is my script to prepare an environment to demonstrate CVE-2014-0160.

Here I cannot post download link because I do not have enough reputation. You need to download openssl-1.0.1e.tar.gz, httpd-2.4.25.tar.gz, apr-1.5.2.tar.gz, apr-util-1.5.4.tar.gz, pcre-8.40.tar.gz into your home directory.

#!/bin/sh

#Download installation files
cd ~
#Here I cannot post download link because I do not have enough reputation. 
#You need to download openssl-1.0.1e.tar.gz, httpd-2.4.25.tar.gz, apr-1.5.2.tar.gz, 
#apr-util-1.5.4.tar.gz, pcre-8.40.tar.gz into your home directory.

#Install compilers
yum -y groupinstall "Development Tools"

#Install pcre
cd ~
tar -zxvf pcre-8.40.tar.gz
cd pcre-8.40
./configure --prefix=/usr/local/pcre
make
make install

#Install openssl
cd ~
tar -zxvf openssl-1.0.1e.tar.gz
cd openssl-1.0.1e
./config     --prefix=/opt/openssl-1.0.1e     --openssldir=/opt/openssl-1.0.1e -fPIC -DOPENSSL_PIC
make
make install_sw

#Install openssl
cd ~
tar -zxvf openssl-1.0.1e.tar.gz
cd openssl-1.0.1e
./config     --prefix=/opt/openssl-1.0.1e     --openssldir=/opt/openssl-1.0.1e -fPIC -DOPENSSL_PIC
make
make install_sw

#Install httpd (using just installed opensll)
cd ~
tar -zxvf httpd-2.4.25.tar.gz
cd httpd-2.4.25/srclib/
tar zxvf ../../apr-1.5.2.tar.gz
ln -s apr-1.5.2/ apr
tar zxvf ../../apr-util-1.5.4.tar.gz
ln -s apr-util-1.5.4/ apr-util
cd ~
cd httpd-2.4.25
./configure     --prefix=/opt/httpd     --with-included-apr     --enable-ssl     --with-ssl=/opt/openssl-1.0.1e --enable-ssl-staticlib-deps     --enable-mods-static=ssl --with-pcre=/usr/local/pcre
make
make install

#Add configuration to use HTTPS (port 443)
cd ~
sed -i '/^#.*Include conf\/extra\/httpd-ssl.conf/s/^#//' /opt/httpd/conf/httpd.conf
sed -i '/^#.*LoadModule socache_shmcb_module modules\/mod_socache_shmcb.so/s/^#//' /opt/httpd/conf/httpd.conf

cd ~
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /opt/httpd/conf/server.key -out /opt/httpd/conf/server.crt -subj "/C=JP/ST=/L=/O=/OU=/CN=192.168.122.137"

/opt/httpd/bin/apachectl start

iptables -F

#Start httpd on booting
chmod +x /etc/rc.d/rc.local
echo '/opt/httpd/bin/apachectl start' >> /etc/rc.local

#Remove downloaded files
cd ~
rm -rf ~/openssl-1.0.1*

rm -rf ~/httpd*

rm -rf ~/pcre*

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .