> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/heartbleed.md).

# HeartBleed

![](/files/-McZp0CAaFddF737kWJZ)

## Background Information

![](/files/-McZoL0JRLdC_sD2fDdW)

![](/files/-McZoQud1wzg55GXQNvX)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 34.253.197.133
```

![](/files/-McZpc2JPkWVo7PSxC7E)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,111,135,139,443,445,593
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 22,111,135,139,443,445,593 -oN nmap 34.253.197.133
```

![](/files/-McZpf_6cccYk4cXKjzc)

## Enumeration

Lets visit the page on the https port 443

![](/files/-McZrA_tzcNMfdl2b59S)

I did not see anything interesting here or in the source code, so I went to google to look for exploits on `HeartBleed`. I found this [exploit](https://www.exploit-db.com/exploits/32745).

## Exploitation

 Lets download the exploit and rename it to `exploit.py`. Also make the exploit script a executable

![](/files/-McZt5TVEFejr6xGD7Mj)

Now lets run the exploit on port 443

![](/files/-McZtU4gs2LQRfchHTYd)

We have the flag in the output.