来源

关联漏洞

描述

open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability

介绍

# CVE-2021-44228-log4jVulnScanner-metasploit
open detection and scanning tool for discovering and fuzzing for Log4J RCE CVE-2021-44228 vulnerability

# preparation POC
```cmd
git clone https://github.com/TaroballzChen/CVE-2021-44228-log4jVulnScanner-metasploit
cd CVE-2021-44228-log4jVulnScanner-metasploit
mkdir -p ~/.msf4/modules/auxiliary/scanner/http
cp log4j2.py ~/.msf4/modules/auxiliary/scanner/http/
chmod +x ~/.msf4/modules/auxiliary/scanner/http/log4j2.py
msfconsole
```

# POC usage
```text
use auxiliary/scanner/http/log4j2
set url <vuln url>
set dns <the self dns address or leave blank for dnslog.cn>
set request_type <GET, POST, ALL>
set headers_file <the path of http header param dictionary>
```

# result
![poc1](poc1.png)
![poc2](poc2.png)

# Reference
- https://github.com/fullhunt/log4j-scan

文件快照

 [4.0K]  /data/pocs/f401b8567f52d043eb1833c12ddd8ff66eb3a8c5
├── [ 17K]  headers-large.txt
├── [ 951]  headers.txt
├── [7.2K]  log4j2.py
├── [964K]  poc1.png
├── [885K]  poc2.png
└── [ 813]  README.md

0 directories, 6 files

备注