> For the complete documentation index, see [llms.txt](https://writeups.adityadindi.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.adityadindi.com/tryhackme/untitled/heartbleed.md).

# HeartBleed

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McZo4doTIAUOcmR-5Lv%2F-McZp0CAaFddF737kWJZ%2Fimage.png?alt=media\&token=031bbc7f-bd44-43cb-9c5d-62e6e1d20cbc)

## Background Information

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McZo4doTIAUOcmR-5Lv%2F-McZoL0JRLdC_sD2fDdW%2Fimage.png?alt=media\&token=3cd8aa45-ddf1-4b0a-ab7c-47b13a35360c)

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McZo4doTIAUOcmR-5Lv%2F-McZoQud1wzg55GXQNvX%2Fimage.png?alt=media\&token=08d16388-3703-4a53-877c-e012062d7dbf)

## Reconnaissance

Initial nmap scan to find open ports , using the flag "treat all hosts as alive" (**-Pn**)

```
nmap -Pn 34.253.197.133
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McZpZSpioSe9gBDRQS1%2F-McZpc2JPkWVo7PSxC7E%2Fimage.png?alt=media\&token=af867d29-2f32-4d62-830e-d3e529307f3c)

Detailed Nmap Scan : 

Command Breakdown: 

* (**-sV):** Service version
* (**-sC**): Default nmap scripts
* (**-p):** Specifying ports 22,111,135,139,443,445,593
* (**-oN nmap**): Saving it into a file called nmap

```
nmap -sV -sC -p 22,111,135,139,443,445,593 -oN nmap 34.253.197.133
```

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McZpZSpioSe9gBDRQS1%2F-McZpf_6cccYk4cXKjzc%2Fimage.png?alt=media\&token=f7ba00aa-4727-4e48-b775-5c3601142745)

## Enumeration

Lets visit the page on the https port 443

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McZq01NG4xA8gq84Ots%2F-McZrA_tzcNMfdl2b59S%2Fimage.png?alt=media\&token=aa941d38-4650-4430-9e9d-86887fe6e4b6)

I did not see anything interesting here or in the source code, so I went to google to look for exploits on `HeartBleed`. I found this [exploit](https://www.exploit-db.com/exploits/32745).

## Exploitation

 Lets download the exploit and rename it to `exploit.py`. Also make the exploit script a executable

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McZq01NG4xA8gq84Ots%2F-McZt5TVEFejr6xGD7Mj%2Fimage.png?alt=media\&token=35c1c2ed-7744-4848-b406-2470c90c5939)

Now lets run the exploit on port 443

![](https://1569822153-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Ma_-L-NUkJ1mxbddZG2%2F-McZq01NG4xA8gq84Ots%2F-McZtU4gs2LQRfchHTYd%2Fimage.png?alt=media\&token=75e154a0-6ec1-42f3-959c-9a3bba693570)

We have the flag in the output.