CVE-2021-44228 PoC — Apache Log4j 代码问题漏洞

Source

https://github.com/badb33f/Apache-Log4j-POC

Associated Vulnerability

Title:Apache Log4j 代码问题漏洞 (CVE-2021-44228)
Description:Apache Log4j是美国阿帕奇（Apache）基金会的一款基于Java的开源日志记录工具。 Apache Log4J 存在代码问题漏洞，攻击者可设计一个数据请求发送给使用 Apache Log4j工具的服务器，当该请求被打印成日志时就会触发远程代码执行。

Description

Proof of Concept of apache log4j LDAP lookup vulnerability. CVE-2021-44228

Readme

# Apache-Log4j-POC CVE-2021-44228
Proof of Concept of apache log4j LDAP lookup vulnerability

You can read more about the vulnerability here:
https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/

How to run the provided ldap server that returns malicious object ? 

java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open /Applications/Calculator.app" -A "127.0.0.1"

# Courtesy: https://github.com/welk1n/JNDI-Injection-Exploit

File Snapshot


 [4.0K]  /data/pocs/25f0c61d46ee71cf6b7dd8b516efef2632fcd203
├── [9.9M]  JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar
├── [ 360]  log4j2.xml
├── [130K]  log4j-api-2.1.jar
├── [805K]  log4j-core-2.1.jar
├── [ 722]  log4j.java
└── [ 459]  README.md

0 directories, 6 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!