CVE-2021-44228 PoC — Apache Log4j 代码问题漏洞

Source

Associated Vulnerability

Description

A micro lab for CVE-2021-44228 (log4j)

Readme

# horrors-log4shell

> A micro lab (playground?) for CVE-2021-44228 (log4j)

* Can be used for executing payloads against multiple targets.
* Target-specific payloads are generated runtime.
* Adjustable configuration and bypasses.

## Installation

### Java-related requirements

* Development / Running example
    * Gradle
    * Maven
* In order to test the recent log4j related vulnerabilities (CVE-2021-44228, CVE-2021-45046):
    * JDK 8u121
    * Ysoserial compiled JAR (https://github.com/frohoff/ysoserial)
* Make sure to have compatible JDKs on both sides.

### Python requirements

    % pip3 install pyasn1 pyjnius git+https://github.com/tasooshi/horrors

## Usage

### Step 1: Configuring

Copy and adjust the `attacker_config.py.example` configuration file.

### Step 2: Running the vulnerable application

Listens on `8080` by default and exposes two paths: `/` and `/endpoint`:

    $ cd Vulnerable; mvn spring-boot:run

### Step 3: Running the data collector service

This daemon collects data incoming from exploited machines and logs into a JSON file:

    (.venv) $ ./collector.py

### Step 4: Executing the attack:

Opens up several ports that get proxied to a single JNDI handler (`class JNDI(services.Service)`). Starts sending requests automatically:

    (.venv) $ ./attacker.py

Visit `http://127.0.0.1:8889/send-requests` to resend the requests.

### Check:

So, in the end you should have the following services running:

* `collector.py` at port `8888`
* `attacker.py` for static content and control at port `8889`
* `attacker.py` at ports `1389` and `8443`
* `Vulnerable.java` at port `8080`

File Snapshot

 [4.0K]  /data/pocs/ab6f86b7a154556aeb53c359baf5665747501bf0
├── [ 984]  attacker_config.py.example
├── [8.1K]  attacker.py
├── [1.4K]  collector.py
├── [ 18K]  LDAP.py
├── [ 34K]  LICENSE
├── [4.0K]  payloads
│   ├── [4.0K]  generic
│   │   ├── [ 997]  collect.py
│   │   ├── [   8]  shell_reverse.py
│   │   └── [1.7K]  ysoserial.py
│   ├── [4.0K]  linux
│   │   ├── [4.0K]  x64
│   │   │   └── [  23]  placeholder.py
│   │   └── [4.0K]  x86
│   │       └── [  23]  placeholder.py
│   └── [4.0K]  windows
│       ├── [4.0K]  x64
│       │   └── [  23]  placeholder.py
│       └── [4.0K]  x86
│           └── [  23]  placeholder.py
├── [1.6K]  README.md
├── [4.0K]  templates
│   ├── [ 464]  RuntimeExec.java.tpl
│   └── [   8]  ShellReverse.java.tpl
└── [4.0K]  Vulnerable
    ├── [2.9K]  pom.xml
    └── [4.0K]  src
        └── [4.0K]  main
            └── [4.0K]  java
                └── [4.0K]  com
                    └── [4.0K]  example
                        └── [1.7K]  Vulnerable.java

15 directories, 17 files

Remarks