Heartbleed 漏洞檢測與分析

FROM buildpack-deps:wily

EXPOSE 80 443

# 安裝作業系統先決條件：
RUN DEBIAN_FRONTEND=noninteractive \
    apt-get update -q -y && \
    apt-get dist-upgrade -q -y && \
    apt-get install -q -y \
    apache2 \
    build-essential \
    curl \
    cython \
    djvulibre-bin \
    gettext \
    ghostscript \
    git \
    less \
    libapache2-mod-wsgi \
    libapache2-mod-xsendfile \
    libhdf5-dev \
    libjpeg-dev \
    libffi-dev \
    libfreetype6-dev \
    libldap2-dev \
    libmagickwand-dev \
    libreoffice-script-provider-python \
    libsasl2-dev \
    libssl-dev \
    libtiff-dev \
    libtiff-tools \
    libxml2-dev \
    libxslt-dev \
    locate \
    mysql-client \
    nano \
    netcat \
    texlive-latex-base \
    poppler-utils \
    python-dev \
    python-openssl \
    python-software-properties \
    sendmail \
    subversion \
    sudo \
    ssl-cert \
    unzip \
    vim \
    wget

RUN a2enmod rewrite && \
    a2enmod wsgi && \
    a2enmod xsendfile && \
    a2enmod proxy && \
    a2enmod headers && \
    a2enmod proxy_http

RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*

# 為每個 bash 會話匯出 xterm
RUN sed -i '1s/^/export TERM=xterm\n/' /etc/bash.bashrc

# 如果 pip 不是原生模組，則從 pypa.io 取得
RUN python -m pip version && \
    python -m pip install -U pip || \
    curl --silent --show-error --retry 5 \
    https://bootstrap.pypa.io/get-pip.py | python2.7

# supervisor 與 Invenio 無關，但特定於此佈署。
# ubuntu 自帶的版本太舊，不符合需求。
RUN pip install supervisor

local match = require('match')
local nmap = require('nmap')
local shortport = require('shortport')
local sslcert = require('sslcert')
local stdnse = require('stdnse')
local string = require("string")
local table = require('table')
local vulns = require('vulns')
local have_tls, tls = pcall(require,'tls')
assert(have_tls, "This script requires the tls.lua library from https://nmap.org/nsedoc/lib/tls.html")

description = [[
檢測伺服器是否容易受到 OpenSSL Heartbleed 漏洞（CVE-2014-0160）的影響。
程式碼根據 Jared Stafford (jspenguin@jspenguin.org) 編寫的 Python 指令碼 ssltest.py。
]]

---
-- @usage
-- nmap -p 443 --script ssl-heartbleed <target>
--
-- @output
-- PORT STATE SERVICE
-- 443/tcp open https
-- | ssl-heartbleed:
-- | VULNERABLE:
-- | The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. It allows for stealing information intended to be protected by SSL/TLS encryption.
-- | State: VULNERABLE
-- | Risk factor: High
-- | Description:
-- | OpenSSL versions 1.0.1 and 1.0.2-beta releases (including 1.0.1f and 1.0.2-beta1) of OpenSSL are affected by the Heartbleed bug.

author = "Patrik Karlsson <patrik@cqure.net>"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = { "vuln", "safe" }

local arg_protocols = stdnse.get_script_args(SCRIPT_NAME .. ".protocols") or {'TLSv1.0', 'TLSv1.1', 'TLSv1.2'}

portrule = function(host, port)
    return shortport.ssl(host, port) or sslcert.getPrepareTLSWithoutReconnect(port)
end

-- 後續程式碼省略，請參閱原始碼取得完整內容。

local status, err = s:send(hb)
if not status then
    stdnse.debug1("Couldn’t send heartbeat request: %s", err)
    s:close()
    return nil
end

while(true) do
    local status, typ, ver, len = recvhdr(s)
    if not status then
        stdnse.debug1('No heartbeat response received, server likely not vulnerable')
        break
    end
    if typ == 24 then
        local pay
        status, pay = recvmsg(s, 0x0fe9)
        s:close()
        if #pay > 3 then
            return true
        else
            stdnse.debug1('Server processed malformed heartbeat, but did not return any extra data.')
            break
        end
    end
end

def hit_hb(s):
    s.send(hb)
    while True:
        typ, ver, pay = recvmsg(s)
        if typ is None:
            print 'No heartbeat response received, server likely not vulnerable'
            return False

if typ == 24:
    print 'Received heartbeat response:'
    hexdump(pay)
    if len(pay) > 3:
        print 'WARNING: server returned more data than it should - server is vulnerable!'
    else:
        print 'Server processed malformed heartbeat, but did not return any extra data.'
    return True

import sys
import socket

# ...

def hit_hb(s):
    # 傳送心跳請求
    s.send(hb)
    while True:
        # 接收伺服器回應
        typ, ver, pay = recvmsg(s)
        if typ == None:
            print('伺服器關閉連線')
            return
        # 檢查伺服器回應是否為心跳回應
        if typ == 24:
            print('收到心跳回應：')
            print(pay)
            # 如果回應長度大於3，表示可能存在漏洞
            if len(pay) > 3:
                print('可能存在心跳出血漏洞')
            return

if __name__ == '__main__':
    main()

openssl req -x509 -newkey rsa:2048 -nodes -keyout private_key.pem -out certificate.pem -days 365