来源

关联漏洞

描述

CVE 2021-44228 Proof-of-Concept. Log4Shell is an attack against Servers that uses vulnerable versions of Log4J. 

介绍

# Log4Shell

<div align="center">
<img src="https://miro.medium.com/max/719/1*Zao7wMZxnQN4yMw8haHKxg.png"/>
</div>


## CVE-2021-44228: Brief Description

Apache Log4j2 2.0-beta9 through 2.15.0 (no releases 2.12.2, 2.12.3, and 2.3.1) 

JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

As a result, it is rated at **CVSS v3** score of **10.0**.(MAXIMUM SCORE)

#### An attacker can perform a remote code execution/reverse code execution in vulnerable servers that rely on these versions.

Luckily this is a 0-day Attack. So the developers fixed this in a 0-day.

## Scenario
<div align="center">
<img src="images/scenario.png"/>
</div>

#### Who uses Log4J?
The Apache _Log4j_ Project is among the most deployed pieces of open source software, providing logging capabilities for Java applications.



## How this Proof-of-Concept works?

First of all this PoC uses:
<ul>
<li> <a src="https://github.com/christophetd/log4shell-vulnerable-app">Spring Vulnerable App by christophetd</a></li>
<li> <a src="https://github.com/mbechler/marshalsec">marshalsec</a> To spin-up a malicious LDAP Server</li>
</ul>


### Run HTTP Server which contains Exploit codes.
<div align="center">
<img src="images/http_server_exploit_class.png"/>
</div>


In **http_server** you will find 2 files: <i>MyExploit.java</i> and its compiled <i>.class</i> file <i>MyExploit.class</i>

💡REMINDER: <i>javac namefile.java</i> to compile a Java class :)

You can run an HTTP server on-fly using the command:
**<i>python -m http.server [PORT]</i>** In this cases 

### Run LDAP Server
<div align="center">
<img src="images/marshalsec.png"/>
</div>


<a src="https://github.com/mbechler/marshalsec">marshalsec's repository</a> Details here


### Run Spring Vulnerable App
<div align="center">
<img src="images/spring_vulnerable.png"/>
</div>


<a src="https://github.com/christophetd/log4shell-vulnerable-app">christophetd's repository</a> Details here

### HTTP GET with curl having in header malicious payload
<div align="center">
<img src="images/curl_http_req.png"/>
</div>


Usually the target field in request header is the **User-agent**, in this PoC it will be used **X-Api-Version**


### Check if it works.
<div align="center">
<img src="images/check.png"/>
</div>


This PoC launch a **Command-Execution** on Vulnerable Server in order to **create a file named "pwned_by_pierpaolosestito_dev"** in tmp folder.
MyExploit.java contains also a malicious payload that permit to attacker to perform a **Reverse-Code-Execution** and obtain a **Reverse-Shell**.

💡SOME TIP:
If you launch <i>docker exec [container_id] ifconfig </i> you can notice that it is a **runner** that **isn't in your local subdomain**. In order to perform a RCE you can change the IP inside MyExploit.java which contains a RCE command's string. From the moment that Docker's runner cannot contact you on private IP you need a public IP and you can obtain it with **Port forwarding**

文件快照

 [4.0K]  /data/pocs/29d699c61664aa3454fa0b1ff20671fe5fcfeac7
├── [4.0K]  http_server
│   ├── [1.1K]  MyExploit.class
│   └── [ 479]  MyExploit.java
├── [4.0K]  images
│   ├── [173K]  check.png
│   ├── [148K]  curl_http_req.png
│   ├── [195K]  http_server_exploit_class.png
│   ├── [ 43K]  log4shell_header.png
│   ├── [152K]  marshalsec.png
│   ├── [ 58K]  scenario.png
│   └── [271K]  spring_vulnerable.png
├── [4.0K]  log4shell-vulnerable-app
│   ├── [ 611]  build.gradle
│   ├── [ 340]  Dockerfile
│   ├── [4.0K]  gradle
│   │   └── [4.0K]  wrapper
│   │       ├── [ 58K]  gradle-wrapper.jar
│   │       └── [ 202]  gradle-wrapper.properties
│   ├── [7.9K]  gradlew
│   ├── [2.7K]  gradlew.bat
│   ├── [ 11K]  LICENSE
│   ├── [3.3K]  README.md
│   ├── [189K]  screenshot.png
│   ├── [  46]  settings.gradle
│   └── [4.0K]  src
│       └── [4.0K]  main
│           ├── [4.0K]  java
│           │   └── [4.0K]  fr
│           │       └── [4.0K]  christophetd
│           │           └── [4.0K]  log4shell
│           │               └── [4.0K]  vulnerableapp
│           │                   ├── [ 657]  MainController.java
│           │                   └── [ 346]  VulnerableAppApplication.java
│           └── [4.0K]  resources
│               └── [   0]  application.properties
└── [3.4K]  README.md

13 directories, 23 files

备注