demo project to highlight how to execute the log4j (CVE-2021-44228) vulnerability# log4j-CVE-2021-44228-test
demo projects to highlight how to execute the log4j (CVE-2021-44228) vulnerability
used spring boot just to be quickly set up. you'll have to excuse all the hard coding, it was just a POC.
## Usage
Have Java 8 installed. Build using maven ```mvn clean package -DskipTests```. Run these commands in separate shell windows:
```shell
java -jar vulnerable-server/target/vulnerable-server.jar
java -jar malicious-server/target/malicious-server.jar
curl http://localhost:8880/victimLDAP
curl http://localhost:8880/victimRMI
```
This should execute the code in the Exploit class (which will just open up the calculator)
[4.0K] /data/pocs/e4a0fecd4ac147c25753a4209ce6fd46bbf2fbd6
├── [4.0K] malicious-server
│ ├── [1.9K] pom.xml
│ └── [4.0K] src
│ └── [4.0K] main
│ ├── [4.0K] java
│ │ ├── [4.0K] com
│ │ │ └── [4.0K] kossatzd
│ │ │ ├── [3.7K] MaliciousApplication.java
│ │ │ └── [ 957] MaliciousController.java
│ │ └── [ 675] Exploit.java
│ └── [4.0K] resources
│ └── [ 16] application.properties
├── [ 536] pom.xml
├── [ 644] README.md
└── [4.0K] vulnerable-server
├── [1.9K] pom.xml
└── [4.0K] src
└── [4.0K] main
├── [4.0K] java
│ └── [4.0K] com
│ └── [4.0K] kossatzd
│ ├── [ 630] VulnerableApplication.java
│ └── [ 647] VulnerableController.java
└── [4.0K] resources
└── [ 16] application.properties
14 directories, 11 files