b-abderrahmane/cve-2021-44228-playgroundDocker-based lab to validate CVE-2021-44228 (Log4Shell) in Java apps, test mitigations, and simulate RCE via LDAP and HTTP payloads.
This tool allows you to verify whether a simple Java web app is vulnerable to CVE-2021-44228 for a user provided version of Java and of Log4J.
You can also [optionally] apply one of a view pre-defined mitigations.
The simulation lab spun up by log4shell_validator.py uses docker-compose to simulate exploiting the log4j vulnerability and gaining RCE on the vulnerable machine.
First of all, some docker images need to be built. The ./build_images.sh script should take care of that.
Ths attack simulation is done in the following way:
/2021-44228-via-message./poc_template./exploit.sh script which sends a payload to the vulnerable app.cd marshalsec/ ;mvn clean package -DskipTests ;cd -./build-images.shpython log4shell_validator.py --java-version 8 --log4j-version 2.12.1~/workspace/CVE-2021-44228-playground$ python log4shell_validator.py --help
usage: log4shell_validator.py [-h] [--java-version JAVA_VERSION] --log4j-version LOG4J_VERSION [--no-cleanup] [--disable-trust-url] [--remove-jndi-lookup-class] [--disable-message-lookup] [--debug]
[--exploit-via-thread-context]
log4j-vulnerability-tester
optional arguments:
-h, --help show this help message and exit
--java-version JAVA_VERSION
version of java to be used
--log4j-version LOG4J_VERSION
version of log4j to be used
--no-cleanup Don't delete used containers.
--disable-trust-url Disable the LDAP trustURLCodebase setting on the victim app
--remove-jndi-lookup-class
Remove the JNDI Lookup class from the log4j jar file
--disable-message-lookup
Disable the JNDI message lookup in the victim app's JVM
--debug Display all container's logs
--exploit-via-thread-context
By sending the payload to an HTTP handler which makes use of Custom logging with ThreadContext, attempt to bypass the no-message-lookup mitigation
This validator has been tested with several combinations of Java7/8 and different versions of Log4J2, for more examples please see the extended tests pipeline in the github actions tab.
For now, the following mitigations have been implemented:
-Dlog4j2.formatMsgNoLookups=TrueIn addition to that, a new flag has been added to test an exploitation vector which can bypass disabling message lookups: --exploit-via-thread-context
This software has been created purely for the purposes of research and for the development of effective mitigation techniques, and is not intended to be used to attack systems except where explicitly authorized. Project maintainers are not responsible or liable for misuse of the software. Use responsibly.