CVE-2024-32030-Nuclei-Template

CVE-2024-32030 Nuclei Template Description This repository contains a Nuclei template for detecting the CVE-2024-32030 vulnerability. This vulnerability allows for remote code execution via JMX Metrics Collection JNDI Resolution. Vulnerability Details ID: CVE-2024-32030 Name: JMX Metrics Collecti...

cloudrasp-log4j2

CloudArmor · Runtime Application Self-Protection Module - Log4j2 Version 简体中文 This project is a local version from CloudArmor specifically built for defending Log4j2 CVE-2021-44228 . No network connection is required to run this project. Please DO TESTING before deploying it to production...

log4j-shell-csw

Log4j Simple Exploit A Proof-Of-Concept Exploit for CVE-2021-44228 vulnerability. Log4j, which is used to log security and performance information, impacts upwards of 3 billion devices that use Java across a variety of consumer and enterprise services, websites and applications, as well as medica...

XSYS-Log4J2Shell-Ex

XSYS-Log4J2Shell-Ex CVE-2021-44228 log4j2shell PoC as part of a security research for a vulnerability patch Overview root@kitploit: In this repository I will cover several topics and implementations which provide a PROOF OF CONCEPT regarding the Log4J 2.17.0 vulnerability . The main goal is to...

dubbo-CVE-2023-23638

CVE-2023-23638 For educational purposes only ZooKeeper required Tested on Java 8. Other versions have not been tested and are not guaranteed to work. To reproduce, add the VM parameter to DemoComsumer: -Ddubbo.hessian.allowNonSerializable=true. For details, see...

Log4jTools

Log4jTools Tools for investigating Log4j CVE-2021-44228 Bug explanation and Demo https://www.youtube.com/watch?v=0-abhd-CLwQ FetchPayload.py Get java payload from ldap path provided in JNDI lookup. Requirements: curl system, requests python Example command: root@kitploit: python FetchPayload.py...

CVE-2021-44228_Example

CVE-2021-44228Example Run each of the 3 sections in a spearate tab/console marshalsec LDAP server https://github.com/chilliwebs/marshalsec Forked from https://github.com/mbechler/marshalsec root@kitploit: docker build -t marshalsec marshalsec/. docker run -it --rm -p 1389:1389...

JndiRemover

JndiRemover Небольшой мод направленный на устранение уязвимости CVE-2021-44228 по средствам удаления/отключения Jndi в Log4j и перехват сообщений содержащих текст "$jndi:ldap://domainname.com/script", которые будут удалены. Поддерживаемые версии MC: Forge 1.7.10, 1.12.2...

CVE-2021-44228-example

이것은 CVE-2021-44228을 악용하는 예제입니다 Log4J2 RCE 취약점 저는 이 코드에 대해 책임을 지지 않습니다. 악의적으로 사용하지 마십시오 CVE-2021-44228 : 이 취약점은 대상 머신에서 악성 메시지를 로깅함으로써 임의 코드를 실행할 수 있게 합니다. 예를 들어, Minecraft 에서 채팅 메시지를 보내는 방식으로 이를 사용할 수 있으며, 서버/플레이어 머신이 채팅 메시지를 로깅하고 여러분의 코드를 실행하게 됩니다. LiveOverflow/CVE-2021-44228 영상 메시지에는 원격 객체를 로드하...

Wireshark

Анализ вредоносного ПО с помощью Wireshark Описание В этой лабораторной работе я проанализировал известный вредоносный захват пакетов при эксплуатации уязвимости Log4J. Я начал свое исследование с того же подхода, который использую для анализа захватов пакетов: изучение статистики и выяснение тог...

log4j2-CVE-2021-44228

Пример уязвимого приложения Log4j2 CVE-2021-44228 Затронутые версии: все версии с 2.0-beta9 по 2.14.1 Это приложение основано на веб-приложении Spring Boot, уязвимом к CVE-2021-44228. Оно использует Log4j 2.14.1 через spring-boot-starter-log4j2 2.6.1. Запуск приложения Запустите его: root@kitploi...

CVE-2021-44228-poc

Log4Shell sample vulnerable application CVE-2021-44228 This is an almost copy/similar vulnerable application to https://github.com/christophetd/log4shell-vulnerable-app The main differences are maven instead of gradle, and the usage of rogue-jndi. This repository contains a maven Spring Boot web...

CVE-2021-44228-demo

log4j-shell-poc Preuve de concept pour la vulnérabilité récemment découverte CVE-2021-44228. Récemment, une nouvelle vulnérabilité a été découverte dans log4j, une bibliothèque de journalisation Java très largement utilisée dans des applications comme Elasticsearch, Minecraft et bien d'autres. Da...

MyLog4Shell

MyLog4Shell log4j RCE Exploitation Detection You can use these commands and rules to search for exploitation attempts against log4j RCE vulnerability CVE-2021-44228 Grep / Zgrep This command searches for exploitation attempts in uncompressed files in folder /var/log - '/usr/var/log' and all sub...

CVE-Exploit

트위터: @0xAbbarhSF 1、CVE-2020-2551 CVE-2020-2551 poc exploit 파이썬 예제 키: GIOP corba 사용 방법 root@kitploit: python3 CVE-2020-2551.py -u http://192.168.26.79:7001 cat urls.txt|sort -u|xargs -I % python3 CVE-2020-2551.py -u % cat xxx.html|grep -Eo 'https?://^ /+'|sort -u|xargs -I % python3...

CVE-2021-44228-Log4j-PoC-RCE

Apache Log4j CVE-2021-44228 GK7 PoC Шаги 1. Скомпилируйте Log4jRCE.java и переместите файл .class на веб-сервер например, локальный PHP 1. cd src/main/java 2. javac Log4jRCE.java 3. Переместите файл .class на веб-сервер или запустите локальный PHP, например: php -S 127.0.0.1:8888 2. Запустите...

spring-boot-log4j-cve-2021-44228-docker-lab

Spring Boot Log4j - CVE-2021-44228 The Log4Shell vulnerability CVE-2021-44228 ultimately is a quite simple JNDI Injection flaw, but in a really really bad place. Log4J will perform a JNDI lookup while expanding placeholders in logging messages or indirectly as parameters for formatted messages...

CVE-2024-20931

CVE-2024-20931 CVE-2024-20931용 Poc 취약점 분석 JNDI 주입의 새로운 공격 표면-CVE-2024-20931 분석...

cve-2019-14540-exploit

CVE-2019-14540 Exploit http://www.leadroyal.cn/?p=939 Contrainte d'environnement : comme cette démo utilise la méthode d'exploitation JNDI via LDAP, il est nécessaire d'utiliser une version basse de JDK inférieure à 8u191. 1. Utiliser marshalsec pour créer un service LDAP sur le port local 1389,...

Weblogic-CVE-2023-21839

Weblogic-CVE-2023-21839 CVE-2023-21839 A wheel built based on publicly available PoC from the internet Affected Versions 12.2.1.3.0 12.2.1.4.0 14.1.1.0.0 Usage java -jar 目标ip:端口 ldap地址 Recommended Tool: https://github.com/WhiteHSBG/JNDIExploit Disclaimer This tool is only for cybersecurity...