关联漏洞
描述
demo project to highlight how to execute the log4j (CVE-2021-44228) vulnerability
介绍
# log4j-CVE-2021-44228-test
demo projects to highlight how to execute the log4j (CVE-2021-44228) vulnerability
used spring boot just to be quickly set up. you'll have to excuse all the hard coding, it was just a POC.
## Usage
Have Java 8 installed. Build using maven ```mvn clean package -DskipTests```. Run these commands in separate shell windows:
```shell
java -jar vulnerable-server/target/vulnerable-server.jar
java -jar malicious-server/target/malicious-server.jar
curl http://localhost:8880/victimLDAP
curl http://localhost:8880/victimRMI
```
This should execute the code in the Exploit class (which will just open up the calculator)
文件快照
[4.0K] /data/pocs/e4a0fecd4ac147c25753a4209ce6fd46bbf2fbd6
├── [4.0K] malicious-server
│ ├── [1.9K] pom.xml
│ └── [4.0K] src
│ └── [4.0K] main
│ ├── [4.0K] java
│ │ ├── [4.0K] com
│ │ │ └── [4.0K] kossatzd
│ │ │ ├── [3.7K] MaliciousApplication.java
│ │ │ └── [ 957] MaliciousController.java
│ │ └── [ 675] Exploit.java
│ └── [4.0K] resources
│ └── [ 16] application.properties
├── [ 536] pom.xml
├── [ 644] README.md
└── [4.0K] vulnerable-server
├── [1.9K] pom.xml
└── [4.0K] src
└── [4.0K] main
├── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] kossatzd
│ ├── [ 630] VulnerableApplication.java
│ └── [ 647] VulnerableController.java
└── [4.0K] resources
└── [ 16] application.properties
14 directories, 11 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。