Add LEAK_COUNT option to Heartbleed

[wvu]

I should have done this in 2014, but I'm a slacker.

• Test with LEAK_COUNT
• Test with repeat

msf5 auxiliary(scanner/ssl/openssl_heartbleed) > set leak_count 9001
leak_count => 9001
msf5 auxiliary(scanner/ssl/openssl_heartbleed) > run

[+] 127.0.0.1:443         - Heartbeat response with leak, 589880535 bytes
[+] 127.0.0.1:443         - Heartbeat data stored in /Users/wvu/.msf4/loot/20180920171424_default_127.0.0.1_openssl.heartble_551227.bin
[*] 127.0.0.1:443         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/ssl/openssl_heartbleed) >

msf5 auxiliary(scanner/ssl/openssl_heartbleed) > set leak_count 100
leak_count => 100
msf5 auxiliary(scanner/ssl/openssl_heartbleed) > repeat -n 2 run; sleep 10

[+] 127.0.0.1:443         - Heartbeat response with leak, 6553500 bytes
[+] 127.0.0.1:443         - Heartbeat data stored in /Users/wvu/.msf4/loot/20180920172522_default_127.0.0.1_openssl.heartble_399065.bin
[*] 127.0.0.1:443         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
[+] 127.0.0.1:443         - Heartbeat response with leak, 6553500 bytes
[+] 127.0.0.1:443         - Heartbeat data stored in /Users/wvu/.msf4/loot/20180920172535_default_127.0.0.1_openssl.heartble_300407.bin
[*] 127.0.0.1:443         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/ssl/openssl_heartbleed) >

#3206, #10625

[h00die]

Add both to .md?

[wvu]

There is no module doc.

[h00die]

Most likely because there wasn't a good vuln target to show actual exploitation (like pulling creds/key/sensitive data) since you'd need to make a bunch of requests to get memory filled up.
Since you all have a target, that could make some good doc examples (after removing sensitive data)

[wvu]

We didn't have module docs back then. :)

[wvu]

msf5 auxiliary(scanner/ssl/openssl_heartbleed) > check
^C[-] Check failed: Interrupt
msf5 auxiliary(scanner/ssl/openssl_heartbleed) > run

[+] 127.0.0.1:443         - Heartbeat response with leak, 65535 bytes
[+] 127.0.0.1:443         - Heartbeat data stored in /Users/wvu/.msf4/loot/20180920174641_default_127.0.0.1_openssl.heartble_640224.bin
[*] 127.0.0.1:443         - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
msf5 auxiliary(scanner/ssl/openssl_heartbleed) >

check is broken for scanners. RHOST is not set but used. Probably a regression from #7349 and #9246. We are currently tracking this internally.

[wvu]

Release Notes

This adds the LEAK_COUNT option to the Heartbleed scanner, allowing a user to specify the number of memory leaks to attempt per SCAN or DUMP action.

[busterb]

See #10688 for check method fixes.