本仓库包含一些脚本，可帮助识别可能受 CVE-2021-44228（又名 Log4Shell）影响的 .jar 文件。
该脚本将从指定路径开始扫描文件系统中的 .jar 文件，为找到的每个 .jar 文件计算 SHA-256 哈希（与文件名无关），并将该值与用户提供的 SHA-256 哈希列表进行比对。
针对官方 Log4j 版本计算得到的已知哈希文件可从 https://github.com/mubix/CVE-2021-44228-Log4Shell-Hashes 获取，本仓库包含的哈希文件即来源于此。
注意：如果系统中使用的 Log4j .jar 文件已被修改（例如由于从源代码编译、供应商进行了任何类型的自定义，或者 Log4j 类已被包含在更大的 .jar 文件中），其 SHA-256 哈希将与对应的官方 Log4j 版本不同，脚本将无法将其标记出来。
log4shell_hash_check.sh <path> <sha256file>
E.g.: sudo ./log4shell_hash_check.sh / sha256sum.txt
sudo ./log4shell_hash_check.sh ./ sha256sum.txt
sudo ./log4shell_hash_check.sh /opt/tomcat/ sha256sum.txt
log4shell_hash_check.ps1 -path <path> -hashfile <sha256file>
E.g.: .\log4shell_hash_check.ps1 -path c:\ -hashfile sha256sum.txt
.\log4shell_hash_check.ps1 -path .\ -hashfile sha256sum.txt
.\log4shell_hash_check.ps1 -path c:\opt\tomcat\ -hashfile sha256sum.txt
OccamSec $ ./log4shell_hash_check.sh ./ log4j_2.x_sha256sum.txt
Please be patient, scanning the file system for .jar files starting at ./
.//apache-log4j-2.13.1-bin/log4j-flume-ng-2.13.1.jar
.//apache-log4j-2.13.1-bin/log4j-core-2.13.1.jar
[CUT]
.//apache-log4j-2.13.1-bin/log4j-mongodb2-2.13.1.jar
.//apache-log4j-2.13.1-bin/log4j-to-slf4j-2.13.1-sources.jar
.//apache-log4j-2.13.1-bin/log4j-to-slf4j-2.13.1-javadoc.jar
.//apache-log4j-2.13.1-bin/log4j-appserver-2.13.1-javadoc.jar
.//apache-log4j-2.13.1-bin/log4j-appserver-2.13.1-sources.jar
Checking hash 6f38a25482d82cd118c4255f25b9d78d96821d22bab498cdce9cda7a563ca992 .//apache-log4j-2.13.1-bin/log4j-core-2.13.1.jar
>>> MATCH: 6f38a25482d82cd118c4255f25b9d78d96821d22bab498cdce9cda7a563ca992 .//apache-log4j-2.13.1-bin/log4j-core-2.13.1.jar
Checking hash eafab7995f042e0386e08fa5e299d63465b63f1e4e5cb754612c68d52b72516d .//apache-log4j-2.13.1-bin/log4j-appserver-2.13.1-sources.jar
List of .jar files found under ./ (if any) saved as ./jarfiles.txt
List of .jar files matching user-provided Log4j hashes (if any) saved as ./matchinglog4j.txt
该脚本将从指定路径开始扫描文件系统中的 .jar 文件，并检查它们是否包含 JndiLookup 类。如果包含，脚本将从 .jar 文件的清单（manifest）中提取信息，以帮助确定该 .jar 文件是否包含 Log4j 版本，以及该版本是否易受攻击。最后，脚本还会计算 SHA-256 哈希以提供完整信息。
由用户决定是将该脚本作为“Log4Shell 哈希检查”脚本的配套工具，还是作为独立工具使用。
log4shell_jndilookup_finder.sh <path>
E.g.: sudo ./log4shell_jndilookup_finder.sh /
sudo ./log4shell_jndilookup_finder.sh ./
sudo ./log4shell_jndilookup_finder.sh /opt/tomcat/
log4shell_jndilookup_finder.ps1 -path <path>
E.g.: .\log4shell_jndilookup_finder.ps1 -path c:\
.\log4shell_jndilookup_finder.ps1 -path .\
.\log4shell_jndilookup_finder.ps1 -path c:\opt\tomcat\
OccamSec $ ./log4shell_jndilookup_finder.sh ./
Please be patient, scanning the file system for .jar files starting at ./
.//apache-log4j-2.13.1-bin/log4j-flume-ng-2.13.1.jar
.//apache-log4j-2.13.1-bin/log4j-core-2.13.1.jar
[CUT]
.//apache-log4j-2.13.1-bin/log4j-mongodb2-2.13.1.jar
.//apache-log4j-2.13.1-bin/log4j-to-slf4j-2.13.1-sources.jar
.//apache-log4j-2.13.1-bin/log4j-to-slf4j-2.13.1-javadoc.jar
.//apache-log4j-2.13.1-bin/log4j-appserver-2.13.1-javadoc.jar
.//apache-log4j-2.13.1-bin/log4j-appserver-2.13.1-sources.jar
-------------------------------------------
>>> JndiLookup.class found in: .//apache-log4j-2.13.1-bin/log4j-core-2.13.1.jar
PACKAGE INFORMATION:
Automatic-Module-Name: org.apache.logging.log4j.core
Bundle-Name: Apache Log4j Core
Bundle-SymbolicName: org.apache.logging.log4j.core
Implementation-Title: Apache Log4j Core
Implementation-URL: https://logging.apache.org/log4j/2.x/log4j-core/
Implementation-Vendor-Id: org.apache.logging.log4j
Specification-Title: Apache Log4j Core
VERSION INFORMATION:
Bundle-Version: 2.13.1
Implementation-Version: 2.13.1
Log4jReleaseVersion: 2.13.1
Specification-Version: 2.13.1
SHA-256 hash:
6f38a25482d82cd118c4255f25b9d78d96821d22bab498cdce9cda7a563ca992 *.//apache-log4j-2.13.1-bin/log4j-core-2.13.1.jar
List of .jar files found under ./ (if any) saved as ./jarfiles.txt
Details about .jar files containing 'JndiLookup.class' (if any) saved as ./jndilookup_jarfiles.txt