Fix TypeError when server closes connection mid-heartbeat read - #913
Open
jbug0x wants to merge 1 commit into
Open
Fix TypeError when server closes connection mid-heartbeat read#913jbug0x wants to merge 1 commit into
jbug0x wants to merge 1 commit into
Conversation
get_ssl_record() only guarded against tcp_client.recv_all() returning None for the SSL record header, but not for the heartbeat payload read that follows. When a target closes the connection (or times out) between the two reads -- which happens for hosts that are not vulnerable to Heartbleed -- data comes back as None and 'hdr += data' raises TypeError: can't concat NoneType to bytes. This crashes the scanning thread and aborts the autopwn run for that target. This adds the same None check for the second recv_all() call and returns None cleanly instead of raising. Tested against a target that closes the connection after the header read; the module now reports 'not vulnerable' instead of crashing.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Running the
heartbleedmodule (directly or viaautopwn) against atarget that closes the connection between the SSL record header read
and the heartbeat payload read crashes the scanning thread:
Traceback:
File ".../heartbleed.py", line 312, in get_ssl_record
hdr += data
This happens because
get_ssl_record()only checksrecv_all()forNoneon the header read, not on the payload read. Targets that arenot vulnerable to Heartbleed (or that simply drop the connection)
trigger this.
Fix
Add the same
Noneguard to the secondrecv_all()call and returnNonecleanly instead of letting the concatenation raise.Testing
Encountered this crash multiple times while running
autopwnagainst live targets in a lab environment — different targets
closed the connection between the SSL record header read and the
heartbeat payload read, consistently triggering the TypeError and
killing the scanning thread for that target. After applying the
fix,
autopwnhandles these targets gracefully, reporting them asnot vulnerable instead of crashing.