关联漏洞
描述
Log4J CVE-2021-44228 Minecraft PoC
介绍
# CVE-2021-44228 in Minecraft
- Java 16
- Paper server build #397
- Minecraft 1.17.1
# Exploitation
In Java 16 only deserialization attacks work by default using log4j. To exploit this there needs to be a vulnerable serializable class in the classpath.
In the current state of this repository the server will only send a serialized string object. If you found a vulnerable serializable class feel free to create a pull request.
文件快照
[4.0K] /data/pocs/12ed73a24cf3916fa7679308f3d4de0a4df16531
├── [4.0K] build
│ ├── [4.0K] classes
│ │ └── [4.0K] java
│ │ └── [4.0K] main
│ │ ├── [2.5K] LDAPRefServer$OperationInterceptor.class
│ │ ├── [3.4K] LDAPRefServer.class
│ │ └── [ 715] Main.class
│ └── [4.0K] tmp
│ └── [4.0K] compileJava
│ └── [ 14K] previous-compilation-data.bin
├── [ 411] build.gradle
├── [4.0K] gradle
│ └── [4.0K] wrapper
│ ├── [ 58K] gradle-wrapper.jar
│ └── [ 200] gradle-wrapper.properties
├── [5.6K] gradlew
├── [2.7K] gradlew.bat
├── [ 429] README.md
├── [ 38] settings.gradle
└── [4.0K] src
└── [4.0K] main
└── [4.0K] java
├── [4.7K] LDAPRefServer.java
└── [ 268] Main.java
11 directories, 13 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。