CVE-2014-0224 PoC — OpenSSL 加密问题漏洞

Source

https://github.com/secretnonempty/CVE-2014-0224

Associated Vulnerability

Title:OpenSSL 加密问题漏洞 (CVE-2014-0224)
Description:OpenSSL是OpenSSL团队开发的一个开源的能够实现安全套接层（SSL v2/v3）和安全传输层（TLS v1）协议的通用加密库，它支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL中存在安全漏洞，该漏洞源于程序没有正确限制ChangeCipherSpec消息的处理。攻击者可借助特制的TLS握手利用该漏洞实施中间人攻击，在OpenSSL-to-OpenSSL通信过程中使用零长度的主密钥，劫持会话或获取敏感消息。以下版本受到影响：OpenSSL 0.9.8y及之前的版本，1.0

Readme

OPENSSL CVE-2014-0224 MITM exploit demo.<br>
<br>
Author : @bluerust<br>
Blog   : http://hi.baidu.com/bluerust/item/bf2ab031bbadcf09cfb9fe41<br>
Ver    : 1.1<br>
Desc   :<br>
Only for openssl 1.0.1*, only tested for cipher RC4-SHA.<br>
 a. server<br>
  openssl s_server -debug -accept 443 -cert server.crt -certform PEM -key server.key -cipher RC4-SHA<br>
  we don't want to discuss how to generate the certificate in here.<br>
 b. client<br>
  openssl s_client -connect 127.0.0.1:9999 -debug -cipher RC4-SHA<br>
 c. mitm proxy<br>
  go run proxy_all.go -host=127.0.0.1 -port 443 -listen_port=9999<br>
<br>
--------------------------<br>
 References:<br>
 [1] Early ChangeCipherSpec Attack (05 Jun 2014)<br>
 https://www.imperialviolet.org/2014/06/05/earlyccs.html <br>
 [2] SSL/TLS MITM vulnerability (CVE-2014-0224)<br>
 http://www.openssl.org/news/secadv_20140605.txt<br>
 [3] How I discovered CCS Injection Vulnerability (CVE-2014-0224)<br>
 http://ccsinjection.lepidum.co.jp/blog/2014-06-05/CCS-Injection-en/index.html<br>

File Snapshot


 [4.0K]  /data/pocs/55b2efe71c4371745e2400952405cee6d471598a
├── [199K]  flow.jpg
├── [2.9M]  proxy_all.exe
├── [ 60K]  proxy_all.go
└── [1.0K]  README.md

0 directories, 4 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!