Add support for OpenSSL 3 #16800

adfoster-r7 · 2022-07-21T13:44:45Z

Relates to #16818

Updates metasploit-framework to work with OpenSSL 3.0. Let's also run Ubuntu 22.04 in our test matrix, to catch any OpenSSL v3 regression issues

Verification

Code review
Verify CI passes

adfoster-r7 · 2022-07-21T13:46:22Z

lib/msf/core/exploit/remote/kerberos/client/as_request.rb

@@ -44,7 +44,7 @@ def build_as_pa_time_stamp(opts = {})
              time_stamp = opts[:time_stamp] || Time.now
              pausec = opts[:pausec] || 0
              etype = opts[:etype] || Rex::Proto::Kerberos::Crypto::RC4_HMAC
-              key = opts[:key] || ''
+              key = opts[:key] || OpenSSL::Random.random_bytes(16)


OpenSSL 3 throws errors on invalid keys

adfoster-r7 · 2022-07-21T13:47:43Z

Gemfile

+gem 'openssl-ccm', github: 'adfoster-r7/openssl-ccm', branch: 'add-support-openssl-3'
+gem 'openssl-cmac', github: 'adfoster-r7/openssl-cmac', branch: 'add-support-for-openssl3'
+gem 'metasploit-credential', github: 'adfoster-r7/metasploit-credential', branch: 'add-support-for-openssl3'
+


These custom forks will either need to be shipped by the maintainers, or we'll have to temporarily move them under the Rapid7 Github account until they're merged upstream and officially available in RubyGems

These are all landed now, apart from hrr_rb_ssh

adfoster-r7 · 2022-07-21T14:40:29Z

@msjenkins-r7 retest this please

adfoster-r7 · 2022-07-21T15:01:05Z

modules/auxiliary/scanner/ssl/openssl_heartbleed.rb


-    return key
+    key = OpenSSL::PKey::RSA.new(asn1.to_der)
+    key


I've also added additional documentation on running heartbleed with docker

This code path is triggered via:

msf6 auxiliary(scanner/ssl/openssl_heartbleed) > run 192.168.123.128 rport=8443 verbose=true action=KEYS [*] 192.168.123.128:8443 - Sending Client Hello... [*] 192.168.123.128:8443 - SSL record #1: [*] 192.168.123.128:8443 - Type: 22 [*] 192.168.123.128:8443 - Version: 0x0301 [*] 192.168.123.128:8443 ... etc ... [+] 192.168.123.128:8443 - Found factor at offset d297 [+] 192.168.123.128:8443 - 2022-07-21 14:55:50 UTC - Got the private key [*] 192.168.123.128:8443 - -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAxjgB/cs7Hg3X+LPIL3Sgtq3Kf17D0dsF9FD2zz3z/pn7d4kq YvJhPgM4gFGcP+EkLmMa7cEZyOy1e0egIOsC0pKIjd77bP+CaffznkTdjlbZ9o34 MJjj7BDsG0LO2ErT+lmsY5p3T6nNs+eFTbpEZub5Uq0LmJgi8jTAdeXO/QIOEdeF tMCdh/oOClDhPjw3ZH1WSzRekiSxU7LcVbridfmeUjds5iu5SM7Shd47LlZcnncU P6W6Kc2qLscOuvfOrlv48wakTbyjM/UV/6L2wT+lz2UbyOlXQkle9bEmDyf0bmhW Id8YgJQb+C5WjjuuzQN5AAwrJnRtw2Mx86YzLQIDAQABAoIBAF/+G6jG1RhW5/J/ TkD9IB+Xxmss.... etc... [*] 192.168.123.128:8443 - Private key stored in /home/a/.msf4/loot/20220721155550_default_192.168.123.128_openssl.heartble_546413.txt [*] 192.168.123.128:8443 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed

adfoster-r7 · 2022-07-21T22:50:20Z

lib/rex/proto/rfb/cipher.rb

-    dh.generate_key!
-
-    shared_key = dh.compute_key(dh_peer.pub_key)
+    # OpenSSL 3.0+


Code path triggered via vnc_login module and connecting to an apple VNC server. I added a user to a mac that has permissions to log in, as well as going into Mac's sharing menu, enabling Screen Sharing and granting access to the new test_user account

msf6 auxiliary(scanner/vnc/vnc_login) > run 192.168.123.1 username=test_user password=p4$$w0rd1 [*] 192.168.123.1:5900 - 192.168.123.1:5900 - Starting VNC login sweep [!] 192.168.123.1:5900 - No active DB -- Credential data will not be saved! [+] 192.168.123.1:5900 - 192.168.123.1:5900 - Login Successful: test_user:p4$$w0rd1 [*] 192.168.123.1:5900 - Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed

Wireshark details on where the values are coming from:

Gemfile.lock

adfoster-r7 · 2022-08-03T12:56:42Z

@msjenkins-r7 retest this please

Gemfile

adfoster-r7 · 2022-08-03T14:50:43Z

Gemfile.lock

@@ -234,7 +234,7 @@ GEM
      activemodel (~> 6.0)
      activesupport (~> 6.0)
      railties (~> 6.0)
-    metasploit-credential (5.0.7)
+    metasploit-credential (5.0.8)


Adds support for OpenSSL3 rapid7/metasploit-credential#163

adfoster-r7 · 2022-08-03T14:51:11Z

Gemfile.lock

-    openssl-ccm (1.2.2)
-    openssl-cmac (2.0.1)
+    openssl-ccm (1.2.3)
+    openssl-cmac (2.0.2)


Adds support for openssl 3 SmallLars/openssl-cmac#5

adfoster-r7 · 2022-08-03T14:51:27Z

Gemfile.lock

@@ -287,8 +287,8 @@ GEM
    octokit (4.25.1)
      faraday (>= 1, < 3)
      sawyer (~> 0.9)
-    openssl-ccm (1.2.2)
-    openssl-cmac (2.0.1)
+    openssl-ccm (1.2.3)


Adds support for openssl 3 SmallLars/openssl-ccm#10

adfoster-r7 · 2022-08-03T14:51:49Z

Gemfile.lock

@@ -429,7 +429,7 @@ GEM
    ruby-progressbar (1.11.0)
    ruby-rc4 (0.1.5)
    ruby2_keywords (0.0.5)
-    ruby_smb (3.1.6)
+    ruby_smb (3.1.7)


Adds support for openssl 3 rapid7/ruby_smb#234

lib/msfenv.rb

jmartin-tech · 2022-08-05T19:24:12Z

Release Notes

This adds support for OpenSSL 3 compatibility with legacy ciphers.

adfoster-r7 · 2022-08-06T00:16:32Z

cc @sbrun for visibility 👍

This fixes a lot of the OpenSSL 3 issues with Metasploit on Kali, especially the SMB modules such as windows/smb/ms17_010_eternalblue/auxiliary/admin/dcerpc/cve_2020_1472_zerologon etc. The original Kali OpenSSL issue (https://bugs.kali.org/view.php?id=7804) was closed so I couldn't provide a progress update there.

adfoster-r7 marked this pull request as draft July 21, 2022 13:44

adfoster-r7 added the openssl3 Tracking issues related to OpenSSL 3's backwards breaking changes label Jul 21, 2022

adfoster-r7 changed the title ~~Run Ubuntu 22.04 in test matrix~~ Add support for OpenSSL 3 Jul 21, 2022

adfoster-r7 commented Jul 21, 2022

View reviewed changes

adfoster-r7 force-pushed the add-support-for-openssl3 branch from f3d6eb5 to c7e8912 Compare July 21, 2022 14:56

adfoster-r7 commented Jul 21, 2022

View reviewed changes

adfoster-r7 force-pushed the add-support-for-openssl3 branch from c7e8912 to 51c735a Compare July 21, 2022 22:48

adfoster-r7 commented Jul 21, 2022

View reviewed changes

adfoster-r7 commented Jul 28, 2022

View reviewed changes

Gemfile.lock Outdated Show resolved Hide resolved

adfoster-r7 mentioned this pull request Jul 29, 2022

Support OpenSSL 3 #16818

Closed

adfoster-r7 force-pushed the add-support-for-openssl3 branch from 51c735a to 23d0d33 Compare August 3, 2022 10:31

adfoster-r7 commented Aug 3, 2022

View reviewed changes

Gemfile Outdated Show resolved Hide resolved

Support OpenSSL3 and run Ubuntu 22.04 in test matrix

f65119b

adfoster-r7 force-pushed the add-support-for-openssl3 branch from 23d0d33 to f65119b Compare August 3, 2022 14:50

adfoster-r7 commented Aug 3, 2022

View reviewed changes

adfoster-r7 marked this pull request as ready for review August 3, 2022 14:52

adfoster-r7 requested a review from jmartin-tech August 3, 2022 17:44

jmartin-tech self-assigned this Aug 3, 2022

jmartin-tech reviewed Aug 4, 2022

View reviewed changes

lib/msfenv.rb Show resolved Hide resolved

Add warning if OPENSSL_CONF is already present

756c910

jmartin-tech merged commit c45262c into rapid7:master Aug 5, 2022

jmartin-tech added the rn-enhancement release notes enhancement label Aug 5, 2022

adfoster-r7 deleted the add-support-for-openssl3 branch August 5, 2022 21:10

adfoster-r7 mentioned this pull request Aug 5, 2022

Metasploit error when using eternalblue on a vulnerable test machine and weird lines when running metasploit #16868

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add support for OpenSSL 3 #16800

Add support for OpenSSL 3 #16800

adfoster-r7 commented Jul 21, 2022 •

edited

Loading

adfoster-r7 Jul 21, 2022

adfoster-r7 Jul 21, 2022

adfoster-r7 Aug 3, 2022

adfoster-r7 commented Jul 21, 2022

adfoster-r7 Jul 21, 2022

adfoster-r7 Jul 21, 2022 •

edited

Loading

adfoster-r7 commented Aug 3, 2022

adfoster-r7 Aug 3, 2022

adfoster-r7 Aug 3, 2022

adfoster-r7 Aug 3, 2022

adfoster-r7 Aug 3, 2022

jmartin-tech commented Aug 5, 2022

adfoster-r7 commented Aug 6, 2022

Add support for OpenSSL 3 #16800

Add support for OpenSSL 3 #16800

Conversation

adfoster-r7 commented Jul 21, 2022 • edited Loading

Verification

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

adfoster-r7 commented Jul 21, 2022

Choose a reason for hiding this comment

adfoster-r7 Jul 21, 2022 • edited Loading

Choose a reason for hiding this comment

adfoster-r7 commented Aug 3, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jmartin-tech commented Aug 5, 2022

Release Notes

adfoster-r7 commented Aug 6, 2022

adfoster-r7 commented Jul 21, 2022 •

edited

Loading

adfoster-r7 Jul 21, 2022 •

edited

Loading