Log4Shell
CVE-2021-44228: Brief Description
Apache Log4j2 2.0-beta9 through 2.15.0 (no releases 2.12.2, 2.12.3, and 2.3.1)
JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
As a result, it is rated at CVSS v3 score of 10.0.(MAXIMUM SCORE)
An attacker can perform a remote code execution/reverse code execution in vulnerable servers that rely on these versions.
Luckily this is a 0-day Attack. So the developers fixed this in a 0-day.
Scenario
Who uses Log4J?
The Apache Log4j Project is among the most deployed pieces of open source software, providing logging capabilities for Java applications.
How this Proof-of-Concept works?
First of all this PoC uses:
- Spring Vulnerable App by christophetd
- marshalsec To spin-up a malicious LDAP Server
Run HTTP Server which contains Exploit codes.
In http_server you will find 2 files: MyExploit.java and its compiled .class file MyExploit.class
đŸ’¡REMINDER: javac namefile.java to compile a Java class :)
You can run an HTTP server on-fly using the command: python -m http.server [PORT] In this cases
Run LDAP Server
marshalsec's repository Details here
Run Spring Vulnerable App
christophetd's repository Details here
HTTP GET with curl having in header malicious payload
Usually the target field in request header is the User-agent, in this PoC it will be used X-Api-Version
Check if it works.
This PoC launch a Command-Execution on Vulnerable Server in order to create a file named "pwned_by_pierpaolosestito_dev" in tmp folder. MyExploit.java contains also a malicious payload that permit to attacker to perform a Reverse-Code-Execution and obtain a Reverse-Shell.
đŸ’¡SOME TIP: If you launch docker exec [container_id] ifconfig you can notice that it is a runner that isn't in your local subdomain. In order to perform a RCE you can change the IP inside MyExploit.java which contains a RCE command's string. From the moment that Docker's runner cannot contact you on private IP you need a public IP and you can obtain it with Port forwarding