记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

Heartbleed 蜜罐脚本,OpenSSL 心脏出血漏洞蜜罐脚本,抓exp代码

2014-06-20 10:45

这个Perl脚本侦听TCP端口443,并响应完全伪造的SSL的心跳反应,除非它检测到类似于贾里德斯塔福德(jspenguin@jspenguin.org)演示中使用了CVE-2014-0160“Heartbleed'一个字节模式的开始。

以root权限端口运行,将涉嫌heartbleed扫描的IP地址输出到控制台,Rickrolls扫描程序于十六进制转储。

#!/usr/bin/perl

# hb_honeypot.pl -- a quick 'n dirty honeypot hack for Heartbleed
#
# This Perl script listens on TCP port 443 and responds with completely bogus
# SSL heartbeat responses, unless it detects the start of a byte pattern
# similar to that used in Jared Stafford's (jspenguin@jspenguin.org) demo for
# CVE-2014-0160 'Heartbleed'.
#
# Run as root for the privileged port. Outputs IPs of suspected heartbleed scan
# to the console. Rickrolls scanner in the hex dump.
#
# 8 April 2014
# http://www.glitchwrks.com/
# shouts to binrev

use strict;
use warnings;
use IO::Socket;

my $sock = new IO::Socket::INET (
LocalPort => '443',
Proto => 'tcp',
Listen => 1,
Reuse => 1,
);

die "Could not create socket!" unless $sock;

# The "done" bit of the handshake response
my $done = pack ("H*", '16030100010E');

# Your message here
my $taunt = "09809*)(*)(76&^%&(*&^7657332 Hi there! Your scan has been logged! Have no fear, this is for research only -- We're never gonna give you up, never gonna let you down!";
my $troll = pack ("H*", ('180301' . sprintf( "%04x", length($taunt))));

# main "barf responses into the socket" loop
while (my $client = $sock->accept()) {
$client->autoflush(1);

my $found = 0;

# read things that look like lines, puke nonsense heartbeat responses until
# a line that looks like it's from the PoC shows up
while (<$client>) {
my $line = unpack("H*", $_);

if ($line =~ /^0034.*/) {
print $client $done;
$found = 1;
} else {
print $client $troll;
print $client $taunt;
}

if ($found == 1) {
print $client $troll;
print $client $taunt;
print $client->peerhost . "n";
$found = 0;
}
}
}

close($sock);

openssl 多线程 多域名 EXP,支持自定义端口,保存二进制文件,节省空间

openssl 漏洞利用程序,支持smtp, pop3, imap, ftp, or xmpp的POC

OpenSSL 漏洞利用程序脚本 POC,OpenSSL“heartbleed”重大安全漏洞!

知识来源: lcx.cc/?i=4372

阅读:212066 | 评论:0 | 标签:exp 漏洞

想收藏或者和大家分享这篇好文章→复制链接地址

“Heartbleed 蜜罐脚本,OpenSSL 心脏出血漏洞蜜罐脚本,抓exp代码”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云