CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URLs with multithreading

Readme

# MyLog4Shell
# log4j RCE Exploitation Detection

You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228

## Grep / Zgrep

This command searches for exploitation attempts in uncompressed files in folder `/var/log` - '/usr/var/log' and all sub folders

```bash
sudo egrep -I -i -r '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+' /var/log
```

This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

```bash
sudo find /var/log -name \*.gz -print0 | xargs -0 zgrep -E -i '\$(\{|%7B)jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):/[^\n]+'
```

## Grep / Zgrep - Obfuscated Variants

These commands cover even the obfuscated variants but lack the file name in a match. 

This command searches for exploitation attempts in uncompressed files in folder `/var/log` and all sub folders

```bash
sudo find /var/log/ -type f -exec sh -c "cat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -I -i 'jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):'" \;
```

This command searches for exploitation attempts in compressed files in folder `/var/log` and all sub folders

```bash
sudo find /var/log/ -name '*.gz' -type f -exec sh -c "zcat {} | sed -e 's/\${lower://'g | tr -d '}' | egrep -i 'jndi:(ldap[s]?|rmi|dns|nis|iiop|corba|nds|http):'" \;
```

## Log4Shell-Rex

A massive regex to cover even the most obfuscated variants: https://github.com/back2root/log4shell-rex

```regex
(?:\$|%(?:25)*24|\\(?:0024|0{0,2}44))(?:{|%(?:25)*7[Bb]|\\(?:007[Bb]|0{0,2}173)).{0,30}?((?:[Jj]|%(?:25)*[46][Aa]|\\(?:00[46][Aa]|0{0,2}1[15]2)).{0,30}?(?:[Nn]|%(?:25)*[46][Ee]|\\(?:00[46][Ee]|0{0,2}1[15]6)).{0,30}?(?:[Dd]|%(?:25)*[46]4|\\(?:00[46]4|0{0,2}1[04]4)).{0,30}?(?:[Ii]|%(?:25)*[46]9|\\(?:00[46]9|0{0,2}1[15]1)|ı).{0,30}?(?::|%(?:25)*3[Aa]|\\(?:003[Aa]|0{0,2}72)).{0,30}?((?:[Ll]|%(?:25)*[46][Cc]|\\(?:00[46][Cc]|0{0,2}1[15]4)).{0,30}?(?:[Dd]|%(?:25)*[46]4|\\(?:00[46]4|0{0,2}1[04]4)).{0,30}?(?:[Aa]|%(?:25)*[46]1|\\(?:00[46]1|0{0,2}1[04]1)).{0,30}?(?:[Pp]|%(?:25)*[57]0|\\(?:00[57]0|0{0,2}1[26]0))(?:.{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3)))?|(?:[Rr]|%(?:25)*[57]2|\\(?:00[57]2|0{0,2}1[26]2)).{0,30}?(?:[Mm]|%(?:25)*[46][Dd]|\\(?:00[46][Dd]|0{0,2}1[15]5)).{0,30}?(?:[Ii]|%(?:25)*[46]9|\\(?:00[46]9|0{0,2}1[15]1)|ı)|(?:[Dd]|%(?:25)*[46]4|\\(?:00[46]4|0{0,2}1[04]4)).{0,30}?(?:[Nn]|%(?:25)*[46][Ee]|\\(?:00[46][Ee]|0{0,2}1[15]6)).{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3))|(?:[Nn]|%(?:25)*[46][Ee]|\\(?:00[46][Ee]|0{0,2}1[15]6)).{0,30}?(?:[Ii]|%(?:25)*[46]9|\\(?:00[46]9|0{0,2}1[15]1)|ı).{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3))|(?:.{0,30}?(?:[Ii]|%(?:25)*[46]9|\\(?:00[46]9|0{0,2}1[15]1)|ı)){2}.{0,30}?(?:[Oo]|%(?:25)*[46][Ff]|\\(?:00[46][Ff]|0{0,2}1[15]7)).{0,30}?(?:[Pp]|%(?:25)*[57]0|\\(?:00[57]0|0{0,2}1[26]0))|(?:[Cc]|%(?:25)*[46]3|\\(?:00[46]3|0{0,2}1[04]3)).{0,30}?(?:[Oo]|%(?:25)*[46][Ff]|\\(?:00[46][Ff]|0{0,2}1[15]7)).{0,30}?(?:[Rr]|%(?:25)*[57]2|\\(?:00[57]2|0{0,2}1[26]2)).{0,30}?(?:[Bb]|%(?:25)*[46]2|\\(?:00[46]2|0{0,2}1[04]2)).{0,30}?(?:[Aa]|%(?:25)*[46]1|\\(?:00[46]1|0{0,2}1[04]1))|(?:[Nn]|%(?:25)*[46][Ee]|\\(?:00[46][Ee]|0{0,2}1[15]6)).{0,30}?(?:[Dd]|%(?:25)*[46]4|\\(?:00[46]4|0{0,2}1[04]4)).{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3))|(?:[Hh]|%(?:25)*[46]8|\\(?:00[46]8|0{0,2}1[15]0))(?:.{0,30}?(?:[Tt]|%(?:25)*[57]4|\\(?:00[57]4|0{0,2}1[26]4))){2}.{0,30}?(?:[Pp]|%(?:25)*[57]0|\\(?:00[57]0|0{0,2}1[26]0))(?:.{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3)))?).{0,30}?(?::|%(?:25)*3[Aa]|\\(?:003[Aa]|0{0,2}72)).{0,30}?(?:\/|%(?:25)*2[Ff]|\\(?:002[Ff]|0{0,2}57)|\${)|(?:[Bb]|%(?:25)*[46]2|\\(?:00[46]2|0{0,2}1[04]2)).{0,30}?(?:[Aa]|%(?:25)*[46]1|\\(?:00[46]1|0{0,2}1[04]1)).{0,30}?(?:[Ss]|%(?:25)*[57]3|\\(?:00[57]3|0{0,2}1[26]3)).{0,30}?(?:[Ee]|%(?:25)*[46]5|\\(?:00[46]5|0{0,2}1[04]5)).{2,60}?(?::|%(?:25)*3[Aa]|\\(?:003[Aa]|0{0,2}72))(JH[s-v]|[\x2b\x2f-9A-Za-z][CSiy]R7|[\x2b\x2f-9A-Za-z]{2}[048AEIMQUYcgkosw]ke[\x2b\x2f-9w-z]))
```

## Log4Shell Detector (Python)

Python based scanner to detect the most obfuscated forms of the exploit codes. 

https://github.com/Neo23x0/log4shell-detector

## Find Log4j on Linux

```
ps aux | egrep '[l]og4j'
find / -iname "log4j*"
lsof | grep log4j
grep -r --include *.[wj]ar "JndiLookup.class" / 2>&1 | grep matches
```

## Find Vulnerable Log4j on Windows

```powershell 
gci 'C:\' -rec -force -include *.jar -ea 0 | foreach {select-string "JndiLookup.class" $_} | select -exp Path
```

by [@CyberRaiju](https://twitter.com/CyberRaiju/status/1469505677580124160)


## YARA

https://github.com/Neo23x0/signature-base/blob/master/yara/expl_log4j_cve_2021_44228.yar

## Help all

Please report findings that are not covered by these detection attempts.
# Using setup.py
<h1 align="center">
  <br>
  log4j-detect
</h1>

<h4 align="center">Simple Python 3 script to detect the "Log4j" Java library vulnerability (CVE-2021-44228) for a list of URL with multithreading</h4>

---

The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228.

To do so, it sends a GET request using threads (higher performance) to each of the URLs in the specified list. The GET request contains a payload that on success returns a DNS request to Burp Collaborator / interactsh. This payload is sent in a test parameter and in the "User-Agent" / "Referer" / "X-Forwarded-For" / "Authentication" headers.
Finally, if a host is vulnerable, an identification number will appear in the subdomain prefix of the Burp Collaborator / interactsh payload and in the output of the script, allowing to know which host has responded via DNS.

It should be noted that this script only handles DNS detection of the vulnerability and does not test remote command execution.

### Downloading log4j-detect.py

```sh
wget https://github.com/takito1812/log4j-detect/raw/main/log4j-detect.py
```

### Running log4j-detect.py

```sh
python3 log4j-detect.py <urlFile> <collaboratorPayload>
```

![imagen](https://user-images.githubusercontent.com/56491288/145856295-f85b06da-17f2-4aa7-85fb-e0b75d6e1965.png)

File Snapshot

 [4.0K]  /data/pocs/aab2c1bb59cababe9bf802280ff3f83df818c7d3
├── [4.0K]  CVE-2021-44228-Scanner
│   ├── [3.6K]  checkjndi.ps1
│   ├── [ 33K]  checkjndi_ps1.png
│   ├── [2.5K]  checkjndi.py
│   ├── [ 33K]  checkjndi_py.png
│   ├── [2.9K]  checkjndi.sh
│   ├── [255K]  checkjndi_sh.png
│   └── [3.3K]  README.md
├── [ 34K]  LICENSE
├── [4.0K]  log4j_checker_test
│   ├── [1.2K]  LICENSE
│   ├── [5.0K]  log4j_checker_beta.sh
│   └── [1.7K]  README.md
├── [2.2K]  log4j-detect.py
├── [4.0K]  log4jrce-python
│   ├── [4.0K]  java
│   │   ├── [ 139]  Exploit.java
│   │   └── [ 173]  LinuxExploit.java
│   ├── [1.0K]  LICENSE
│   ├── [ 14K]  log4rce.py
│   └── [3.0K]  README.md
├── [4.0K]  log4j-scanner
│   ├── [ 212]  Dockerfile
│   ├── [1.4K]  FAQ.md
│   ├── [ 17K]  headers-large.txt
│   ├── [ 951]  headers.txt
│   ├── [1.1K]  LICENSE.txt
│   ├── [ 15K]  log4j-scan.py
│   ├── [5.9K]  README.md
│   └── [  31]  requirements.txt
├── [4.0K]  log4shell-tools
│   ├── [4.0K]  env_verify
│   │   ├── [ 179]  build.gradle
│   │   └── [4.0K]  src
│   │       └── [4.0K]  main
│   │           └── [4.0K]  java
│   │               └── [4.0K]  env_verify
│   │                   └── [1.8K]  Main.java
│   ├── [4.0K]  img
│   │   ├── [ 12K]  env_verify_results.PNG
│   │   └── [ 64K]  jndi_manager_results.PNG
│   ├── [ 11K]  LICENSE
│   ├── [9.0K]  README.md
│   ├── [  36]  requirements.txt
│   ├── [8.4K]  scan_log4j_calls_jar.py
│   ├── [6.3K]  scan_log4j_calls_src.py
│   ├── [4.0K]  scan_log4j_versions
│   │   ├── [ 179]  build.gradle
│   │   └── [4.0K]  src
│   │       └── [4.0K]  main
│   │           └── [4.0K]  java
│   │               └── [4.0K]  scan_log4j_versions
│   │                   └── [8.1K]  Main.java
│   └── [5.6K]  scan_log4j_versions.py
├── [6.0K]  README.md
└── [2.2K]  setup.py

17 directories, 39 files

Remarks