Help with creating Heartbleed vulnerable server

Question

I am using Virtualbox internal network with Kali Linux and Ubuntu 12.04. The version of OpenSSL for the Ubuntu is 1.0.1 which should be vulnerable. I have created a HTTPS server using nginx on the Ubuntu and when i scan with nmap on the Kali Linux it shows that port 80 for http and port 443 for https is open. However, when i use the heartbleed exploit on Metasploit in Kali and run the check command it says:

[*] 192.168.1.70:443 The target is not exploitable
[*] Checked 1 of 1 hosts (100% complete)

Running nmap with

nmap -d –script ssl-heartbleed –script-args vulns.showall -sV 192.168.1.70

also does not give me anything.

How do I create a heartbleed-vulnerable server? I dont mind trying out another method as long as it works. The method here was done following https://warroom.securestate.com/building-a-vulnerable-box-heartbleed/

Answer 1

Unless you are using a version of 12.04 which was unpatched for years the OpenSSL on your test server is not vulnerable even if the OpenSSL version number shows a vulnerable version. Vendors backport security fixes in the OpenSSL versions they ship and thus the version number itself does not say a lot. See Why is this version of OpenSSL (1.0.1e) not vulnerable to Heartbleed? .

Thus if you would like to setup a vulnerable system either get old and unpatched images or get the vulnerable version from openssl.org and compile it yourself and also make sure that all applications you want to test are linked with this vulnerable version.