Log4Shell-Scanner-Exploit

Bash script to remotely identify and/or exploit the Log4j vulnerability. This tool performs various tests using LDAP payloads and X-Api-Version, User-Agent, and X-Forwarded-For headers.

Always use this script with prior authorization from the owner of the audited service/application.

Dependencies:

1. Download and decompress the following file to start the LDAP and HTTP server: http://tiny.cc/t0smuz

2. Have Java installed #sudo apt install default-jre

3. Have Curl installed #sudo apt-get install curl

Usage example:

Enter the following parameters:

• List of URLs to scan
• LDAP server IP address
• LDAP server port
• HTTP server IP address
• HTTP server port

#Example scanning an application on internal network:

• ./Log4Shell_Scanner.sh <URL_List> <LDAP_Server_IP> <LDAP_Server_Port> <HTTP_Server_IP> <HTTP_Server_Port>

#Example scanning an application on the internet:

• ./Log4Shell_Scanner.sh <URL_List> <LDAP_Server_IP> <LDAP_Server_Port> <HTTP_Server_IP> <HTTP_Server_Port>

Clarifications:

• The payload used sends an "ifconfig" command to machines identified as vulnerable. This payload is Base64 encoded and can be modified to carry out the exploitation phase in a pentesting audit.
• If you wish to use the tool on internet services, you can start a Ngrok service that port-forwards to the local port of the LDAP Server.
• Always use this script with prior authorization from the owner of the analyzed service/application.