CSCI61-FinalProj

The demonstration of Heartbleed is based on vulhub's method, which can be found at this link: https://github.com/vulhub/vulhub/tree/master/openssl/CVE-2014-0160

Our demo video can be found at this link: https://drive.google.com/file/d/1xjpqaAhIYXyGAy6xVWHl_-tCMd95Sar8/view?usp=sharing

The demonstration uses vulhub's docker container to implement the demo's Nginx server using OpenSSL 1.0.1c. When the group attempted to make the container for the web app themselves, we found that the libraries we needed were outdated, and incompatible with our current build tools.

docker-compose.yml is the container's build file, which uses the html file in the www folder to define the welcome page.

test_connect.py is the program which sends the malicious heartbeat packet to the server, and receives its response as well. Our group based it on vulhub's ssltest.py, streamlining the program's usage by defining the TCP address and port inside the program itself. The program's functions are as follows:

1. hex_to_bin(hex_string) converts a cleaned hexadecimal string into binary.
2. hexdump(s) formats a string into its hex and ASCII representation, 16 bytes per line.
3. receive_all(socket, length, timeout=5) receives bytes from the given socket and reads them in chunks.
4. receive_msg(socket) receives and unpacks a complete TLS record, returning the received bytes.
5. send_heartbeat(socket) sends the HEARTBLEED_MSG to the server, entering a loop to receive responses. It then check the type of the received record to determine if it is a valid Heartbeat response.
6. main() initiaites a TCP connection with the specified address and port, sending the HELLO message to initiate the TLS handshake. After detecting acknowledgement from the server, it sends the malicious heartbeat request.

Demonstration Method

1. Ensure that the system has the Docker engine currently running.

2. On the command line, execute the following command to start the web server: docker compose up -d

3. After the server starts, you may use the following URL to view the welcome page: https://127.0.0.1:8443

4. Execute the Heartbleed python code using the following command: python test-connect.py