CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

Static detection of vulnerable log4j librairies on Windows servers, members of an AD domain.

Readme

# PS-CVE-2021-44228
Static detection of vulnerable log4j librairies on Windows members of an AD domain.
Uses detection tool binary provided by @1lann : https://github.com/1lann/log4shelldetect

# Prerequisites
- Administrator privileges on targeted computers.
- Active Directory PowerShell module.
- WindowsManagementFramwork 5.1 (PS 5.1) on targeted computers.

# Configuration
The script starts by creating a .csv list of your domain-joined servers, in the script folder.
Just run it, if that file doesn't exist yet, it will ask you for create it.

`./log4shelldetect.ps1`

You can use a search pattern to fulfill that list and target specific servers names.
That pattern will be added to the "Get-AdComputer -Filter". Example:

`./log4shelldetect.ps1 -searchPattern '*tst*'` 

# Usage
Simply launch the script without arguments. It will create PSJob foreach entries in the server list.
These PSJobs will create scheduled tasks remotely on every AD computer targeted, for each local drive detected.
Then, the scan binary will be executed to scan the filesystem, searching for vulnerable libraries.

`./log4shelldetect.ps1`

Finally, you need to retrieve the job outputs to update the server list with status (vulnerable, not vulnerable, not reachable...)
If the server is detected vulnerable, a folder named with the concerned machine name will be created in the current folder, containing the output of the scan tool.
Each line of these text files represent a vulnerable log4j binary.

`./log4shelldetect.ps1 -update`

# Considerations
**Be careful with automation !**  
The scheduled tasks runs as 'NT AUTHORITY\SYSTEM' to access every directories on the local filesystem.
Use at your owns risks. Do not hesitate to review the script before using it.

# Thanks
**Special thanks for @1lann work**, for his early development of an effective tool to detect log4j vulnerabilities.

File Snapshot

 [4.0K]  /data/pocs/8076fcac537ae5870f7a7a4a0ab03e80272e2f0b
├── [1.8M]  log4shelldetect.exe
├── [ 13K]  log4shelldetect.ps1
└── [1.8K]  README.md

0 directories, 3 files

Remarks