CVE-2021-44228 PoC — Apache Log4j 代码问题漏洞

Source

https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes

Associated Vulnerability

Title:Apache Log4j 代码问题漏洞 (CVE-2021-44228)
Description:Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。 Apache Log4J 存在代码问题漏洞，攻击者可设计一个数据请求发送给使用 Apache Log4j工具的服务器，当该请求被打印成日志时就会触发远程代码执行。

Description

Hashes for vulnerable LOG4J versions

Readme

# CVE-2021-44228-Log4Shell-Hashes
Hashes for vulnerable LOG4J versions

Created to help orgs search for this vulnerable versions

https://www.lunasec.io/docs/blog/log4j-zero-day/

Source of the hashes: https://archive.apache.org/dist/logging/log4j/

- ~~Possibly 1.X affected to https://github.com/apache/logging-log4j2/pull/608~~
- Version 1.0 is NOT vulnerable: https://twitter.com/ceki/status/1469449618316533762?s=20


- Detection Rules: https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
- VMware Vulnerable: https://www.randori.com/blog/cve-2021-44228/
- Proof of Concept JNDI/LDAP server: https://github.com/veracode-research/rogue-jndi

File Snapshot


 [4.0K]  /data/pocs/0ad1559f944b0923d171835167ed4441c0d58ec5
├── [ 17K]  Log4J-MD5.ioc
├── [3.5K]  md5sum.txt
├── [ 658]  README.md
├── [3.8K]  sha1sum.txt
└── [4.8K]  sha256sums.txt

0 directories, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!