CVE-2021-44228 PoC — Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

Source

Associated Vulnerability

Description

CVE-2021-44228 

Readme

# Disclaimer
This project is for personal practice purposes only.
## CVE-2021-44228 log4j-shell-poc Exploit
This project demonstrates how to exploit the Apache Log4j vulnerability to gain access to a remote shell using a reverse shell command. 
## Getting Started
To get started with this project, follow the steps below:
## Prerequisites
* Virtual Box
* Docker
* JAVA SE Development kit 8u20
## Installing
1. clone this project from kozmer
git clone https://github.com/kozmer/log4j-shell-poc
2. Build the Docker image:
sudo docker build -t log4j-shell-poc 
3. Download and extract the Java SE Development kit 8u20 file:
sudo tar -xf jdk-8u20-linux-x64.tar.gz
## Exploiting the Vulnerability
1. Open a listener port on port 9001
2. Run the Python3 script that is downloaded from Github. The script will auto-setup the HTTP server and the LDAP server and create the payload that will be used to paste into the vulnerable parameter. The LDAP server contains the address link to our listener.
3. Run the Docker container with the vulnerable web app.
4. Open the web page that was set up previously and enter the malicious code into the user parameter.

At this stage, you will be able to connect to the web page shell. From here, you can browse and delete files. The creator has included a file called safeToDelete.tmp for you to test with. If this file contained sensitive information, a hacker could retrieve the data for malicious purposes or delete the file just for fun.
## Authors
* Kozmer https://github.com/kozmer 

File Snapshot

 [4.0K]  /data/pocs/d290c11b340deae324b4f6186a076309e7b5a1d4
├── [ 14K]  mitigation tehniques.docx
├── [1.5K]  README.md
├── [1.7M]  Step for exploiting.docx
└── [ 72K]  Vulnerabities description.docx

0 directories, 4 files

Remarks