dariusiakabos/log4jCurated OSINT compilation on Log4Shell (CVE-2021-44228) covering detection methods, attack surface, mitigation steps, and indicators of compromise for incident response.
Compilation of log4j OSINT findings, including Detection, Attack Surface, Mitigation, IoCs.
This vulnerability makes it possible for any attacker who can inject text into log messages or log message parameters into server logs to load code from a remote server. The targeted server then executes that code via calls to the Java Naming and Directory INterface (JNDI).
JNDI interfaces with a number of network services:
As of 13.12.2021, the attacks so far were either cryptominers and automated botnets (Mirai, Tsunami and Kinsing)
Best fix is to upgrade to the patched version, but the challenge is to find where log4j was deployed as a component &/or wait for vendor to patch.
Short term:
Long term:
https://www.techsolvency.com/story-so-far/cve-2021-44228-log4j-log4shell/ - by @TychoTithonus (Royce Williams).
A compilation of exploit examples. https://github.com/YfryTchsGD/Log4jAttackSurface
Resources by Florian Roth (comment section also contains usefull info) https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b
/.({|%7B)[Jj][Nn][Dd][Ii]./
https://twitter.com/ThinkstCanary/status/1469439743905697797 You can use a point & click canarytoken from https://canarytokens.org to help test for the #log4j / #Log4Shell issue.
Details on their page https://log4shell.huntress.com/
"How to detect if affected: Start netcat parallel to your app: "nc -lp 1234", then type the following into app where it gets logged (e.g. the query string of your search): "${jndi:ldap://127.0.0.1:1234/abc}" If you then see garbage/emojis in the netcat console your're vulnerable!"
"I've written a simple (i.e. standalone, no dependencies) Java program which patches JndiLookup.lookup() to return a fixed string and not parse its arguments. This should fix CVE-2021-44228 (i.e. RCE in Log4j) without restarting your JVM process." https://github.com/simonis/Log4jPatch "This is a POC of a simple tool which injects a Java agent into a running JVM process. The agent will patch the lookup() method of all loaded org.apache.logging.log4j.core.lookup.JndiLookup instances to unconditionally return the string "Patched JndiLookup::lookup()". This should fix the CVE-2021-44228 remote code execution vulnerability in Log4j without restarting the Java process. This has been currently only tested with JDK 8 & 11!"
Source: Greynose.io
Community API https://docs.greynoise.io/reference/get_v3-community-ip
API call: curl -X POST https://threatfox-api.abuse[.]ch/api/v1/ -d '{ "query": "taginfo", "tag": "log4j" }
"Please find the following raw CVE-2021-44228 Log4J / Logshell payloads GreyNoise has detected thus far." https://gist.github.com/nathanqthai/01808c569903f41a52e7e7b575caa890
"Seeing 45[.]155[.]205[.]233 do the initial scan with an base64 encoded string. When decoded tries to do a curl wget bash etc....to setup a shell. Stage 2,3 and 4 also seen with final payloads: nspps/Kingsing malware via following ip's 44.240.146.137 45.137.155.55 185.154.53.140 185.191.32.198"
45.155.205.233 - Russian IP seen exploiting. https://twitter.com/VessOnSecurity/status/1469950517010968582 https://twitter.com/entropyqueen_/status/1469961345848299520
