SSL/TLS類漏洞驗證與修復

近期工作中總會遇到一些關於SSL/TLS類的漏洞被掃描工具掃除來，就翻閱網絡上關於這類漏洞的成因與驗證方法做一些總結，便於日后翻閱。

掃描的漏洞類似這樣：

• SSL/TLS 受誡禮(BAR-MITZVAH)攻擊漏洞(CVE-2015-2808)【原理掃描】 
• SSL/TLS RC4 信息泄露漏洞(CVE-2013-2566)【原理掃描】

本文主要參考自：https://www.cnblogs.com/nul1/p/11233607.html

---

 

什么是TLS和SSL？

安全套接層（SSL）和傳輸層安全（TLS）加密用於通過互聯網提供通信安全（傳輸加密）和來保護網絡流量和互聯網上的隱私，用於諸如網絡，電子郵件，即時消息（IM）和一些虛擬專用網絡（VPN）。

因此，TLS安全配置很重要，應花時間學習如何識別常見的漏洞和安全配置錯誤。

TLS / SSL安全測試工具

測試要用到一個強大的工具 testssl.sh 它涵蓋了TLS和SSL評估所需的所有測試所需工具

您可以通過執行其git clone來安裝最新版本的tesetssl.sh：

git clone https://github.com/drwetter/testssl.sh.git

root@kali:~/testssl.sh# ./testssl.sh 

     "testssl.sh [options] <URI>"    or    "testssl.sh <options>"


"testssl.sh <options>", where <options> is:

     --help                        what you're looking at
     -b, --banner                  displays banner + version of testssl.sh
     -v, --version                 same as previous
     -V, --local                   pretty print all local ciphers
     -V, --local <pattern>         which local ciphers with <pattern> are available? If pattern is not a number: word match

     <pattern>                     is always an ignore case word pattern of cipher hexcode or any other string in the name, kx or bits

"testssl.sh <URI>", where <URI> is:

     <URI>                         host|host:port|URL|URL:port   port 443 is default, URL can only contain HTTPS protocol)

"testssl.sh [options] <URI>", where [options] is:

     -t, --starttls <protocol>     Does a default run against a STARTTLS enabled <protocol,
                                   protocol is <ftp|smtp|lmtp|pop3|imap|xmpp|telnet|ldap|nntp|postgres|mysql>
     --xmpphost <to_domain>        For STARTTLS enabled XMPP it supplies the XML stream to-'' domain -- sometimes needed
     --mx <domain/host>            Tests MX records from high to low priority (STARTTLS, port 25)
     --file/-iL <fname>            Mass testing option: Reads one testssl.sh command line per line from <fname>.
                                   Can be combined with --serial or --parallel. Implicitly turns on "--warnings batch".
                                   Text format 1: Comments via # allowed, EOF signals end of <fname>
                                   Text format 2: nmap output in greppable format (-oG), 1 port per line allowed
     --mode <serial|parallel>      Mass testing to be done serial (default) or parallel (--parallel is shortcut for the latter)
     --warnings <batch|off>        "batch" doesn't continue when a testing error is encountered, off continues and skips warnings
     --connect-timeout <seconds>   useful to avoid hangers. Max <seconds> to wait for the TCP socket connect to return
     --openssl-timeout <seconds>   useful to avoid hangers. Max <seconds> to wait before openssl connect will be terminated

single check as <options>  ("testssl.sh URI" does everything except -E and -g):
     -e, --each-cipher             checks each local cipher remotely
     -E, --cipher-per-proto        checks those per protocol
     -s, --std, --standard         tests certain lists of cipher suites by strength
     -p, --protocols               checks TLS/SSL protocols (including SPDY/HTTP2)
     -g, --grease                  tests several server implementation bugs like GREASE and size limitations
     -S, --server-defaults         displays the server's default picks and certificate info
     -P, --server-preference       displays the server's picks: protocol+cipher
     -x, --single-cipher <pattern> tests matched <pattern> of ciphers
                                   (if <pattern> not a number: word match)
     -c, --client-simulation       test client simulations, see which client negotiates with cipher and protocol
     -h, --header, --headers       tests HSTS, HPKP, server/app banner, security headers, cookie, reverse proxy, IPv4 address

     -U, --vulnerable              tests all (of the following) vulnerabilities (if applicable)
     -H, --heartbleed              tests for Heartbleed vulnerability
     -I, --ccs, --ccs-injection    tests for CCS injection vulnerability
     -T, --ticketbleed             tests for Ticketbleed vulnerability in BigIP loadbalancers
     -BB, --robot                  tests for Return of Bleichenbacher's Oracle Threat (ROBOT) vulnerability
     -R, --renegotiation           tests for renegotiation vulnerabilities
     -C, --compression, --crime    tests for CRIME vulnerability (TLS compression issue)
     -B, --breach                  tests for BREACH vulnerability (HTTP compression issue)
     -O, --poodle                  tests for POODLE (SSL) vulnerability
     -Z, --tls-fallback            checks TLS_FALLBACK_SCSV mitigation
     -W, --sweet32                 tests 64 bit block ciphers (3DES, RC2 and IDEA): SWEET32 vulnerability
     -A, --beast                   tests for BEAST vulnerability
     -L, --lucky13                 tests for LUCKY13
     -F, --freak                   tests for FREAK vulnerability
     -J, --logjam                  tests for LOGJAM vulnerability
     -D, --drown                   tests for DROWN vulnerability
     -f, --pfs, --fs, --nsa        checks (perfect) forward secrecy settings
     -4, --rc4, --appelbaum        which RC4 ciphers are being offered?

tuning / connect options (most also can be preset via environment variables):
     --fast                        omits some checks: using openssl for all ciphers (-e), show only first preferred cipher.
     -9, --full                    includes tests for implementation bugs and cipher per protocol (could disappear)
     --bugs                        enables the "-bugs" option of s_client, needed e.g. for some buggy F5s
     --assume-http                 if protocol check fails it assumes HTTP protocol and enforces HTTP checks
     --ssl-native                  fallback to checks with OpenSSL where sockets are normally used
     --openssl <PATH>              use this openssl binary (default: look in $PATH, $RUN_DIR of testssl.sh)
     --proxy <host:port|auto>      (experimental) proxy connects via <host:port>, auto: values from $env ($http(s)_proxy)
     -6                            also use IPv6. Works only with supporting OpenSSL version and IPv6 connectivity
     --ip <ip>                     a) tests the supplied <ip> v4 or v6 address instead of resolving host(s) in URI
                                   b) arg "one" means: just test the first DNS returns (useful for multiple IPs)
     -n, --nodns <min|none>        if "none": do not try any DNS lookups, "min" queries A, AAAA and MX records
     --sneaky                      leave less traces in target logs: user agent, referer
     --ids-friendly                skips a few vulnerability checks which may cause IDSs to block the scanning IP
     --phone-out                   allow to contact external servers for CRL download and querying OCSP responder
     --add-ca <cafile>             path to <cafile> or a comma separated list of CA files enables test against additional CAs.
     --basicauth <user:pass>       provide HTTP basic auth information.

output options (can also be preset via environment variables):
     --quiet                       don't output the banner. By doing this you acknowledge usage terms normally appearing in the banner
     --wide                        wide output for tests like RC4, BEAST. PFS also with hexcode, kx, strength, RFC name
     --show-each                   for wide outputs: display all ciphers tested -- not only succeeded ones
     --mapping <openssl|           openssl: use the OpenSSL cipher suite name as the primary name cipher suite name form (default)
                iana|rfc             -> use the IANA/(RFC) cipher suite name as the primary name cipher suite name form
                no-openssl|          -> don't display the OpenSSL cipher suite name, display IANA/(RFC) names only
                no-iana|no-rfc>      -> don't display the IANA/(RFC) cipher suite name, display OpenSSL names only
     --color <0|1|2|3>             0: no escape or other codes,  1: b/w escape codes,  2: color (default), 3: extra color (color all ciphers)
     --colorblind                  swap green and blue in the output
     --debug <0-6>                 1: screen output normal but keeps debug output in /tmp/.  2-6: see "grep -A 5 '^DEBUG=' testssl.sh"

測試單個主機上的所有內容並輸出到控制台

./testssl.sh -e -E -f -p  -S -P -c -H -U TARGET-HOST

測試單個主機上的所有內容並輸出到HTML

./testssl.sh -e -E -f -p  -S -P -c -H -U TARGET-HOST | aha> OUTPUT-FILE.html

---

漏洞詳情與回顧

SSL/TLS RC4 信息泄露漏洞(CVE-2013-2566)【原理掃描】

詳細描述

安全套接層（Secure Sockets Layer，SSL），一種安全協議，是網景公司（Netscape）在推出Web瀏覽器首版的同時提出的，目的是為網絡通信提供安全及數據完整性。SSL在傳輸層對網絡連接進行加密。傳輸層安全（Transport Layer Security），IETF對SSL協議標准化（RFC 2246）后的產物，與SSL 3.0差異很小。 SSL/TLS內使用的RC4算法存在單字節偏差安全漏洞，可允許遠程攻擊者通過分析統計使用的大量相同的明文會話，利用此漏洞恢復純文本信息。

解決辦法

建議：避免使用RC4算法 1、禁止apache服務器使用RC4加密算法 vi /etc/httpd/conf.d/ssl.conf 修改為如下配置 SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4 重啟apache服務 2、關於lighttpd加密算法  在配置文件lighttpd.conf中禁用RC4算法，例如：  ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"  重啟lighttpd 服務。 3、Windows系統建議參考官網鏈接修復： https://support.microsoft.com/en-us/help/2868725/microsoft-security-advisory-update-for-disabling-rc4

SSL/TLS 受誡禮(BAR-MITZVAH)攻擊漏洞(CVE-2015-2808)【原理掃描】

詳細描述

SSL/TLS協議是一個被廣泛使用的加密協議,Bar Mitzvah攻擊實際上是利用了"不變性漏洞"，這是RC4算法中的一個缺陷，它能夠在某些情況下泄露SSL/TLS加密流量中的密文，從而將賬戶用戶名密碼，信用卡數據和其他敏感信息泄露給黑客。

解決辦法

臨時解決方法： SSL/TLS -------- 1、禁止apache服務器使用RC4加密算法 vi /etc/httpd/conf.d/ssl.conf 修改為如下配置 SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5:!RC4 重啟apache服務 2、關於nginx加密算法 1.0.5及以后版本，默認SSL密碼算法是HIGH:!aNULL:!MD5 0.7.65、0.8.20及以后版本，默認SSL密碼算法是HIGH:!ADH:!MD5 0.8.19版本，默認SSL密碼算法是 ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM 0.7.64、0.8.18及以前版本，默認SSL密碼算法是ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP 低版本的nginx或沒注釋的可以直接修改域名下ssl相關配置為 ssl_ciphers "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES 256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GC M-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4"; ssl_prefer_server_ciphers on; 需要nginx重新加載服務 3、關於lighttpd加密算法 在配置文件lighttpd.conf中禁用RC4算法，例如： ssl.cipher-list = "EECDH+AESGCM:EDH+AESGCM:ECDHE-RSA-AES128-GCM-SHA256:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4" 重啟lighttpd 服務。 4、tomcat參考: https://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html 5、瀏覽器手工屏蔽方案 Windows 用戶： 1）完全關閉 Chrome 瀏覽器和Mozilla Firefox瀏覽器 2）復制一個平時打開 Chrome 瀏覽器(Mozilla Firefox瀏覽器)的快捷方式 3）在新的快捷方式上右鍵點擊，進入屬性 4）在「目標」后面的空格中字段的末尾輸入以下命令 --cipher-suite-blacklist=0x0004,0x0005,0xc011,0xc007 Mac OS X 用戶： 1）完全關閉 Chrome 瀏覽器 2）找到本機自帶的終端（Terminal） 3）輸入以下命令：/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --cipher-suite-blacklist=0x0004,0x0005,0xc011,0xc007 Linux 用戶： 1）完全關閉 Chrome 瀏覽器

RC4 CVE-2013-2566

TLS協議和SSL協議中使用的RC4算法具有許多單字節偏移。遠程攻擊者可以通過使用相同明文的大量會話中的密文統計分析來進行明文破解攻擊。

自動RC4測試

testssl.sh RC4測試

./testssl.sh -4 目標

手動RC4測試

使用./testssl.sh -E TARGET手動枚舉服務器密碼或者nmap -p 443 --script=ssl-enum-ciphers TARGET確保服務器支持密碼類型不使用RC4。

 

TLS和SSL證書

對沒有加密的服務器證書應該被評估為配置錯誤和弱加密簽名，下面是證書檢查的項目列表：

使用以下方式獲取目標服務器證書：

openssl s_client -connect TARGET：443 | openssl x509 -noout -text

證書檢查項目表

名稱	描述
識別證書頒發者	確保證書頒發機構（CA）來自受信任的來源，不使用自簽名證書，因為自簽名證書允許中間人員攻擊（除非是內部的，並且與內部CA簽名）。
簽名算法	用於確保證書完整性的算法，您應該確保密碼是安全的，而不是使用MD5（已知不安全）或SHA1。
公鑰	關鍵長度應該足夠長以確保它不能被破解，最小值應該是2048位。
Not Before	證書開始日期。
Not After	證書結束日期。
Subject&Subject Alternative Name	Subject應該列出證書所涉及的DNS名稱，如果這是不正確的瀏覽器會引發錯誤。Subject Alternative Name應列出通配符證書的DNS名稱，應列出此證書的所有DNS名稱。

 

 

123